CVE-2020-37221
📛 CVE Title
(no title)
Description
Atomic Alarm Clock 6.3 contains a stack overflow vulnerability that allows local attackers to execute arbitrary code by supplying a malicious string to the display name textbox in the Time Zones Clock configuration. Attackers can craft a buffer with structured exception handling overwrite and encoded shellcode to bypass SafeSEH protections and execute arbitrary commands with application privileges.
Overview
- State
- —
- Assigner (CNA)
- —
- CVSS severity
- high
- CVSS score
- 8.4 / 10
- CVSS vector
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Effective score
- 8.4 / 10 HIGH source: CNA overview
- CWE(s)
- —
- Reserved
- —
- Published
- —
- Last updated
- —
- Source
- https://www.tenable.com/cve/CVE-2020-37221
- Linked Threat
- CVE-2020-37221 — CVE-2020-37221
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-05-13 16:16:33 UTC
- NVD last modified
- 2026-05-13 17:26:28 UTC
- NVD CVSS v3.1
- 8.4 / 10 HIGH source: disclosure@vulncheck.com
- NVD CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Exploitability subscore
- 2.5 / 10
- Impact subscore
- 5.9 / 10
- EPSS score
- 0.0002 (probability of exploitation in next 30 days)
- EPSS percentile
- 4.11% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24
NVD-assigned CWE(s):
CWE-121
(differs from the CNA list above)
NVD / KEV / EPSS data refreshed 2026-05-25 00:02 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2020-31222 - Assigner
- VulnCheck
- Published
- May 13, 2026, 2:22:32 PM
- Updated
- May 13, 2026, 3:32:56 PM
- EUVD base score (CVSS 4.0)
-
8.6 / 10
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - EUVD-reported EPSS
- 0.0200
- Vendors
- Drive-Software
- Products
-
Atomic Alarm Clock (6.3)
ENISA description: Atomic Alarm Clock 6.3 contains a stack overflow vulnerability that allows local attackers to execute arbitrary code by supplying a malicious string to the display name textbox in the Time Zones Clock configuration. Attackers can craft a buffer with structured exception handling overwrite and encoded shellcode to bypass SafeSEH protections and execute arbitrary commands with application privileges.
Vendor references (0)
References embedded in the original CVE record by the assigning CNA.
None in the CVE record.
Web references (5)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
- https://nvd.nist.gov/vuln/detail/CVE-2020-37221 tenable:nvd.nist.gov
- https://www.cve.org/CVERecord?id=CVE-2020-37221 tenable:www.cve.org
- https://www.exploit-db.com/exploits/48346 tenable:www.exploit-db.com
- https://www.first.org/epss/ tenable:www.first.org
- https://www.vulncheck.com/advisories/atomic-alarm-clock-stack-overflow-via-seh-unicode tenable:www.vulncheck.com
NVD-tagged references (2)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- https://www.exploit-db.com/exploits/48346 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/atomic-alarm-clock-stack-overflow-via-seh-unicode disclosure@vulncheck.com
Remediations (10)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:attack.mitre.org
This mitigation can be implemented through the following measures: Regular Operating System Updates Implementation: Apply the latest Windows security updates monthly using WSUS (Windows Server Update Services) or a similar patch management solution. Configure systems to check for updates automatically and schedule reboots during maintenance ...
2026-05-26 02:52 UTC -
web:blog.qualys.com
Oracle released its second quarterly edition of this year's Critical Patch Update. The update received patches for 481 security vulnerabilities.
2026-05-26 02:52 UTC -
web:cheatsheetseries.owasp.org
Virtual Patching Cheat Sheet Introduction The goal with this cheat Sheet is to present a concise virtual patching framework that organizations can follow to maximize the timely implementation of mitigation protections. Definition: Virtual Patching A security policy enforcement layer which prevents and reports the exploitation attempt of a known vulnerability. The virtual patch works when the ...
2026-05-26 02:52 UTC -
web:feedly.com
15-Second summary Keeping up with Microsoft's Patch Tuesday releases is time-consuming for analysts, who need to assess vulnerabilities quickly, determine their relevance and criticality, and prioritize remediation—all while under pressure to protect their organizations. With Feedly's free Patch Tuesday report, you can: View charts breaking down the vulnerabilities by attack type and ...
2026-05-26 02:52 UTC -
web:msrc.microsoft.com
The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.
2026-05-26 02:52 UTC -
web:nvd.nist.gov
The NVD is the U.S. government repository of standards based vulnerability management data represented using the Security Content Automation Protocol (SCAP). This data enables automation of vulnerability management, security measurement, and compliance. The NVD includes databases of security checklist references, security-related software flaws, product names, and impact metrics. For ...
2026-05-26 02:52 UTC -
web:source.android.com
Android partners are encouraged to fix all issues in this bulletin and use the latest security patch level. Devices that use the 2024-02-01 security patch level must include all issues associated with that security patch level, as well as fixes for all issues reported in previous security bulletins.
2026-05-26 02:52 UTC -
web:support.servicenow.com
Overview The advisories below document publicly disclosed Common Vulnerabilities and Exposures ( CVEs ) in the Now Platform by ServiceNow. Because ServiceNow uses various methods to communicate vulnerability information, patches, and other fixes, customers should review family, security patch , and hotfix release notes, which are available at https://docs.servicenow.com, for a complete list of ...
2026-05-26 02:52 UTC -
web:www.oracle.com
Critical Security Patch Updates Critical Security Patch Updates provide security patches for supported Oracle on-premises products. A Critical Security Patch Update provides targeted, high-priority security fixes in a smaller, more focused format, making them easier to apply with minimal disruption.
2026-05-26 02:52 UTC -
web:www.virustotal.com
Streamline your investigations with Google Threat Intelligence Agentic and the new Dark Web (DDW) module. Perform hunting and pivoting across forums using natural language or specific modifiers. Bridge threat actor identities and map global operations easy.
2026-05-26 02:52 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.