CVE-2020-16268

The MSI installer in 1E Client 4.1.0.267 and 5.0.0.745 allows remote authenticated users and local users to gain elevated privileges via the repair option. This applies to installations that have a TRANSFORM (MST) with the option to disable the installation of the Nomad module. An attacker may craft a .reg file in a specific location that will be able to write to any registry key as an elevated user.

• CWE-74
• CWE-668

• https://help.1e.com/display/GI/1E+Security+Advisory-1E+Client+for+Windows%3A+CVE-2020-16268%2C+CVE-2020-27643%2C+CVE-2020-27644%2C+CVE-2020-27645Vendor Advisory
• https://help.1e.com/display/GI/1E+Security+Advisory-1E+Client+for+Windows%3A+CVE-2020-16268%2C+CVE-2020-27643%2C+CVE-2020-27644%2C+CVE-2020-27645Vendor Advisory

Published

Dec 29, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-16260Winston 1.5.4 devices do not enforce authorization. This is …7.5
• CVE-2020-16261Winston 1.5.4 devices allow a U-Boot interrupt, resulting in…6.8
• CVE-2020-16262Winston 1.5.4 devices have a local www-data user that is ove…7.8
• CVE-2020-16263Winston 1.5.4 devices have a CORS configuration that trusts …9.1
• CVE-2020-16266An XSS issue was discovered in MantisBT before 2.24.2. Impro…5.4
• CVE-2020-16267Zoho ManageEngine Applications Manager version 14740 and pri…8.8
• CVE-2020-16269radare2 4.5.0 misparses DWARF information in executable file…5.5
• CVE-2020-1627A vulnerability in Juniper Networks Junos OS on vMX and MX15…7.5
• CVE-2020-16270OLIMPOKS under 3.3.39 allows Auth/Admin ErrorMessage XSS. Re…6.1
• CVE-2020-16271The SRP-6a implementation in Kee Vault KeePassRPC before 1.1…9.1
• CVE-2020-16272The SRP-6a implementation in Kee Vault KeePassRPC before 1.1…9.1
• CVE-2020-16273In Arm software implementing the Armv8-M processors (all ver…7.8