CVE-2020-18169

A vulnerability in the Windows installer XML (WiX) toolset of TechSmith Snagit 19.1.1.2860 allows attackers to escalate privileges. NOTE: Exploit of the Snagit installer would require the end user to ignore other safety mechanisms provided by the Host OS. See reference document for more details.

• CWE-269

• https://docs.google.com/document/d/1W33rsdISmexLOGS4VmLUIITRU_KqGULcij1Z6QyxsjU/edit?usp=sharingThird Party Advisory
• https://github.com/GitHubAssessments/CVE_Assessment_04_2019/blob/master/Snagit_Report.pdfExploit, Third Party Advisory
• https://github.com/TechSmith/TSC-Security-Public/blob/main/advisories/2020/CVE-2020-18169-dispute.md
• https://docs.google.com/document/d/1W33rsdISmexLOGS4VmLUIITRU_KqGULcij1Z6QyxsjU/edit?usp=sharingThird Party Advisory
• https://github.com/GitHubAssessments/CVE_Assessment_04_2019/blob/master/Snagit_Report.pdfExploit, Third Party Advisory

Published

Jul 26, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-18158Cross Site Scripting (XSS) vulnerability in HuCart 5.7.4 via…5.4
• CVE-2020-1816Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and …7.5
• CVE-2020-18164SQL Injection vulnerability exists in tp-shop 2.x-3.x via th…9.8
• CVE-2020-18165Cross Site Scripting (XSS) in LAOBANCMS v2.0 allows remote a…4.8
• CVE-2020-18166Unrestricted File Upload in LAOBANCMS v2.0 allows remote att…9.8
• CVE-2020-18167Cross Site Scripting (XSS) in LAOBANCMS v2.0 allows remote a…4.8
• CVE-2020-1817Huawei PCManager with versions earlier than 10.0.1.36 has a …7.8
• CVE-2020-18170An issue in the SeChangeNotifyPrivilege component of Abloy K…9.8
• CVE-2020-18171TechSmith Snagit 19.1.0.2653 uses Object Linking and Embeddi…8.8
• CVE-2020-18172A code injection vulnerability in the SeDebugPrivilege compo…9.8
• CVE-2020-18173A DLL injection vulnerability in 1password.dll of 1Password …7.8
• CVE-2020-18174A process injection vulnerability in setup.exe of AutoHotkey…9.8