CVE-2020-27187

An issue was discovered in KDE Partition Manager 4.1.0 before 4.2.0. The kpmcore_externalcommand helper contains a logic flaw in which the service invoking D-Bus is not properly checked. An attacker on the local machine can replace /etc/fstab, and execute mount and other partitioning related commands, while KDE Partition Manager is running. the mount command can then be used to gain full root privileges.

• https://bugzilla.redhat.com/show_bug.cgi?id=1890199Issue Tracking, Vendor Advisory
• https://github.com/KDE/partitionmanager/compare/v4.1.0...v4.2.0Release Notes, Third Party Advisory
• https://kde.org/info/security/advisory-20201017-1.txtPatch, Vendor Advisory
• https://security.gentoo.org/glsa/202011-03Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1890199Issue Tracking, Vendor Advisory
• https://github.com/KDE/partitionmanager/compare/v4.1.0...v4.2.0Release Notes, Third Party Advisory
• https://kde.org/info/security/advisory-20201017-1.txtPatch, Vendor Advisory
• https://security.gentoo.org/glsa/202011-03Third Party Advisory

Published

Oct 26, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-27180konzept-ix publiXone before 2020.015 allows attackers to dow…7.5
• CVE-2020-27181A hardcoded AES key in CipherUtils.java in the Java applet o…6.5
• CVE-2020-27182Multiple cross-site scripting (XSS) vulnerabilities in konze…6.1
• CVE-2020-27183A RemoteFunctions endpoint with missing access control in ko…9.8
• CVE-2020-27184The NPort IA5000A Series devices use Telnet as one of the ne…5.9
• CVE-2020-27185Cleartext transmission of sensitive information via Moxa Ser…7.5
• CVE-2020-2719Vulnerability in the Oracle Banking Corporate Lending produc…4.3
• CVE-2020-27191LionWiki before 3.2.12 allows an unauthenticated user to rea…7.5
• CVE-2020-27192BinaryNights ForkLift 3.4 was compiled with the com.apple.se…7.8
• CVE-2020-27193A cross-site scripting (XSS) vulnerability in the Color Dial…6.1
• CVE-2020-27194An issue was discovered in the Linux kernel before 5.8.15. s…5.5
• CVE-2020-27195HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.1…9.1