Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-27657 State: PUBLISHED Published: 2020-10-29T08:55:22.868313Z Last Updated: 2024-09-16T23:55:31.913Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: Synology Products: Synology Router Manager (SRM) Problem Types: CWE-319 Description: Cleartext transmission of sensitive information vulnerability in DDNS in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to eavesdrop authentication information of DNSExit via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/security/advisory/Synology_SA_20_14 - https://www.talosintelligence.com/vulnerability_reports
- https://www.synology.com/security/advisory/Synology_SA_20_14 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1071
CVE ID: CVE-2020-27658 State: PUBLISHED Published: 2020-10-29T08:55:23.280975Z Last Updated: 2024-09-17T03:23:52.926Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Synology Products: Synology Router Manager (SRM) Problem Types: CWE-1004 Description: Synology Router Manager (SRM) before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/security/advisory/Synology_SA_20_14 - https://www.talosintelligence.com/vul
iner: References: - https://www.synology.com/security/advisory/Synology_SA_20_14 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1086
CVE ID: CVE-2020-27659 State: PUBLISHED Published: 2020-11-30T09:30:15.481484Z Last Updated: 2024-09-17T04:00:17.636Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: Synology Products: Safe Access Problem Types: CWE-79 Description: Multiple cross-site scripting (XSS) vulnerabilities in Synology SafeAccess before 1.2.3-0234 allow remote attackers to inject arbitrary web script or HTML via the (1) domain or (2) profile parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/security/advisory/Synology_SA_20_25 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1087 - https://github.com/thomasfady/Syno
_SA_20_25 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1087 - https://github.com/thomasfady/Synology_SA_20_25
CVE ID: CVE-2020-27660 State: PUBLISHED Published: 2020-11-30T09:30:15.887498Z Last Updated: 2024-09-17T04:25:26.833Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Synology Products: Safe Access Problem Types: CWE-89 Description: SQL injection vulnerability in request.cgi in Synology SafeAccess before 1.2.3-0234 allows remote attackers to execute arbitrary SQL commands via the domain parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/security/advisory/Synology_SA_20_25 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1087 - https://github.com/thomasfady/Synology_SA_20_25
CVE ID: CVE-2020-27661 State: PUBLISHED Published: 2021-06-02T15:25:19 Last Updated: 2024-08-04T16:18:45.773Z Vendors: n/a Products: n/a Problem Types: n/a Description: A divide-by-zero issue was found in dwc2_handle_packet in hw/usb/hcd-dwc2.c in the hcd-dwc2 USB host controller emulation of QEMU. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://lists.nongnu.org/archive/html/qemu-devel/2020-10/msg04263.html - https://bugzilla.redhat.com/show_bug.cgi?id=1890653 - https://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg1770368.html - https://git.qe
w_bug.cgi?id=1890653 - https://www.mail-archive.com/debian-bugs-dist%40lists.debian.org/msg1770368.html - https://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=bea2a9e3e00b275dc40cfa09c760c715b8753e03 - https://security.netapp.com/advisory/ntap-20210720-0010/
CVE ID: CVE-2020-27662 State: PUBLISHED Published: 2020-11-26T16:46:53 Last Updated: 2024-08-04T16:18:45.595Z Vendors: n/a Products: n/a Problem Types: n/a Description: In GLPI before 9.5.3, ajax/comments.php has an Insecure Direct Object Reference (IDOR) vulnerability that allows an attacker to read data from any database table (e.g., glpi_tickets, glpi_users, etc.). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-wq38-gwxp-8p5p
CVE ID: CVE-2020-27663 State: PUBLISHED Published: 2020-11-26T16:49:03 Last Updated: 2024-08-04T16:18:45.666Z Vendors: n/a Products: n/a Problem Types: n/a Description: In GLPI before 9.5.3, ajax/getDropdownValue.php has an Insecure Direct Object Reference (IDOR) vulnerability that allows an attacker to read data from any itemType (e.g., Ticket, Users, etc.). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-pqfv-4pvr-55r4
CVE ID: CVE-2020-27664 State: PUBLISHED Published: 2020-10-22T18:19:44 Last Updated: 2024-08-04T16:18:45.677Z Vendors: n/a Products: n/a Problem Types: n/a Description: admin/src/containers/InputModalStepperProvider/index.js in Strapi before 3.2.5 has unwanted /proxy?url= functionality. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/strapi/strapi/releases/tag/v3.2.5 - https://github.com/strapi/strapi/pull/8442
CVE ID: CVE-2020-27665 State: PUBLISHED Published: 2020-10-22T18:19:31 Last Updated: 2024-08-04T16:18:45.659Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Strapi before 3.2.5, there is no admin::hasPermissions restriction for CTB (aka content-type-builder) routes. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/strapi/strapi/releases/tag/v3.2.5 - https://github.com/strapi/strapi/pull/8439
CVE ID: CVE-2020-27666 State: PUBLISHED Published: 2020-10-22T18:19:19 Last Updated: 2024-08-04T16:18:45.559Z Vendors: n/a Products: n/a Problem Types: n/a Description: Strapi before 3.2.5 has stored XSS in the wysiwyg editor's preview feature. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/strapi/strapi/releases/tag/v3.2.5 - https://github.com/strapi/strapi/pull/8440
CVE ID: CVE-2020-27670 State: PUBLISHED Published: 2020-10-22T20:34:22 Last Updated: 2024-08-04T16:18:45.542Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a denial of service (data corruption), cause a data leak, or possibly gain privileges because an AMD IOMMU page-table entry can be half-updated. Additional Analyst Notes: - CVE Program Container: References: - http://xenbits.xen.org/xsa/advisory-347.html - https://xenbits.xen.org/xsa/advisory-347.html - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00075.html - http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00
rg/opensuse-security-announce/2020-10/msg00075.html - http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00025.html - https://security.gentoo.org/glsa/202011-06 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XIK57QJOVOPWH6RFRNMGOBCROBCKMDG2/ - https://www.debian.org/security/2020/dsa-4804 - http://www.openwall.com/lists/oss-security/2021/01/19/9
CVE ID: CVE-2020-27671 State: PUBLISHED Published: 2020-10-22T20:34:07 Last Updated: 2024-08-04T16:18:45.523Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Xen through 4.14.x allowing x86 HVM and PVH guest OS users to cause a denial of service (data corruption), cause a data leak, or possibly gain privileges because coalescing of per-page IOMMU TLB flushes is mishandled. Additional Analyst Notes: - CVE Program Container: References: - http://xenbits.xen.org/xsa/advisory-346.html - https://xenbits.xen.org/xsa/advisory-346.html - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00075.html - http://lists.opensuse.org/opensuse-security-annou
/lists.opensuse.org/opensuse-security-announce/2020-10/msg00075.html - http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00025.html - https://security.gentoo.org/glsa/202011-06 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XIK57QJOVOPWH6RFRNMGOBCROBCKMDG2/ - https://www.debian.org/security/2020/dsa-4804 - http://www.openwall.com/lists/oss-security/2021/01/19/8
CVE ID: CVE-2020-27672 State: PUBLISHED Published: 2020-10-22T20:33:53 Last Updated: 2024-08-04T16:18:45.678Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a host OS denial of service, achieve data corruption, or possibly gain privileges by exploiting a race condition that leads to a use-after-free involving 2MiB and 1GiB superpages. Additional Analyst Notes: - CVE Program Container: References: - http://xenbits.xen.org/xsa/advisory-345.html - https://xenbits.xen.org/xsa/advisory-345.html - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00075.html - http://lists.opensuse.org/opens
-345.html - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00075.html - http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00025.html - https://security.gentoo.org/glsa/202011-06 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XIK57QJOVOPWH6RFRNMGOBCROBCKMDG2/ - https://www.debian.org/security/2020/dsa-4804 - http://www.openwall.com/lists/oss-security/2021/01/19/7
CVE ID: CVE-2020-27673 State: PUBLISHED Published: 2020-10-22T20:33:26 Last Updated: 2024-08-04T16:18:45.526Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. Guest OS users can cause a denial of service (host OS hang) via a high rate of events to dom0, aka CID-e99502f76271. Additional Analyst Notes: - CVE Program Container: References: - https://xenbits.xen.org/xsa/advisory-332.html - https://github.com/torvalds/linux/commit/e99502f76271d6bc4e374fe368c50c67a1fd3070 - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e99502f76271d6bc4e374fe368c50c67a1fd3070 - http://
://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e99502f76271d6bc4e374fe368c50c67a1fd3070 - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00075.html - http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00025.html - https://security.gentoo.org/glsa/202011-06 - https://lists.debian.org/debian-lts-announce/2020/12/msg00015.html - https://lists.debian.org/debian-lts-announce/2020/12/msg00027.html - http://www.openwall.com/lists/oss-security/2021/01/19/6
CVE ID: CVE-2020-27674 State: PUBLISHED Published: 2020-10-22T20:33:07 Last Updated: 2024-08-04T16:18:45.522Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Xen through 4.14.x allowing x86 PV guest OS users to gain guest OS privileges by modifying kernel memory contents, because invalidation of TLB entries is mishandled during use of an INVLPG-like attack technique. Additional Analyst Notes: - CVE Program Container: References: - https://xenbits.xen.org/xsa/advisory-286.html - https://security.gentoo.org/glsa/202011-06 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3U4LNKKXU4UP4Z5XP6TMIWSML3QODPE/ - h
fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3U4LNKKXU4UP4Z5XP6TMIWSML3QODPE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZAM3LYJ5TZLSSNL3KXFILM46QKVTOUA/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XIK57QJOVOPWH6RFRNMGOBCROBCKMDG2/ - https://www.debian.org/security/2020/dsa-4804 - http://www.openwall.com/lists/oss-security/2021/01/19/5
CVE ID: CVE-2020-27675 State: PUBLISHED Published: 2020-10-22T20:32:49 Last Updated: 2024-08-04T16:18:45.560Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. drivers/xen/events/events_base.c allows event-channel removal during the event-handling loop (a race condition). This can cause a use-after-free or NULL pointer dereference, as demonstrated by a dom0 crash via events for an in-reconfiguration paravirtualized device, aka CID-073d0552ead5. Additional Analyst Notes: - CVE Program Container: References: - https://xenbits.xen.org/xsa/advisory-331.html - https://github.com/torvalds/linux/com
E Program Container: References: - https://xenbits.xen.org/xsa/advisory-331.html - https://github.com/torvalds/linux/commit/073d0552ead5bfc7a3a9c01de590e924f11b5dd2 - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=073d0552ead5bfc7a3a9c01de590e924f11b5dd2 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3ZG6TZLD23QO3PV2AN2HB625ZX47ALTT/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6USZ4APZSBQDHGJLJMHW5JBN4QZV6SKZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GNF2R7FUT4IOJ2RIRGQ7X5R4F4FVVLSR/ - https://security
rg/archives/list/package-announce%40lists.fedoraproject.org/message/GNF2R7FUT4IOJ2RIRGQ7X5R4F4FVVLSR/ - https://security.gentoo.org/glsa/202011-06 - https://lists.debian.org/debian-lts-announce/2020/12/msg00015.html - https://lists.debian.org/debian-lts-announce/2020/12/msg00027.html - http://www.openwall.com/lists/oss-security/2021/01/19/3
CVE ID: CVE-2020-27678 State: PUBLISHED Published: 2020-10-23T20:25:17 Last Updated: 2024-08-04T16:18:45.659Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in illumos before 2020-10-22, as used in OmniOS before r151030by, r151032ay, and r151034y and SmartOS before 20201022. There is a buffer overflow in parse_user_name in lib/libpam/pam_framework.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/illumos/illumos-gate/commit/1d276e0b382cf066dae93640746d8b4c54d15452
CVE ID: CVE-2020-27687 State: PUBLISHED Published: 2020-12-18T18:27:23 Last Updated: 2024-08-04T16:18:45.658Z Vendors: n/a Products: n/a Problem Types: n/a Description: ThingsBoard before v3.2 is vulnerable to Host header injection in password-reset emails. This allows an attacker to send malicious links in password-reset emails to victims, pointing to an attacker-controlled server. Lack of validation of the Host header allows this to happen. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/thingsboard/thingsboard/commits/master - https://gist.github.com/vin01/26a8bb13233acd9425e7575a7ad4c936
CVE ID: CVE-2020-27688 State: PUBLISHED Published: 2020-11-05T14:59:51 Last Updated: 2024-08-04T16:18:45.641Z Vendors: n/a Products: n/a Problem Types: n/a Description: RVToolsPasswordEncryption.exe in RVTools 4.0.6 allows users to encrypt passwords to be used in the configuration files. This encryption used a static IV and key, and thus using the Decrypt() method from VISKD.cs from the RVTools.exe executable allows for decrypting the encrypted passwords. The accounts used in the configuration files have access to vSphere instances. Additional Analyst Notes: - CVE Program Container: References: - https://www.robware.net/rvtools/ - https://github.com/matthiasmaes/CVE-2020-27688
CVE ID: CVE-2020-27689 State: PUBLISHED Published: 2020-11-04T20:01:38 Last Updated: 2024-08-04T16:18:45.716Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Relish (Verve Connect) VH510 device with firmware before 1.0.1.6L0516 contains undocumented default admin credentials for the web management interface. A remote attacker could exploit this vulnerability to login and execute commands on the device, as well as upgrade the firmware image to a malicious version. Additional Analyst Notes: - CVE Program Container: References: - https://6point6.co.uk/insights/security-advisory-relish-4g-hub-vh510/ - https://6point6.co.uk/wp-content/uploads/2020/10/Relish-4G-VH510-Hub-Full-Disclo
ecurity-advisory-relish-4g-hub-vh510/ - https://6point6.co.uk/wp-content/uploads/2020/10/Relish-4G-VH510-Hub-Full-Disclosure-v1.3.pdf
CVE ID: CVE-2020-27690 State: PUBLISHED Published: 2020-11-04T20:06:49 Last Updated: 2024-08-04T16:18:45.549Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Relish (Verve Connect) VH510 device with firmware before 1.0.1.6L0516 contains a buffer overflow within its web management portal. When a POST request is sent to /boaform/admin/formDOMAINBLK with a large blkDomain value, the Boa server crashes. Additional Analyst Notes: - CVE Program Container: References: - https://6point6.co.uk/insights/security-advisory-relish-4g-hub-vh510/ - https://6point6.co.uk/wp-content/uploads/2020/10/Relish-4G-VH510-Hub-Full-Disclosure-v1.3.pdf
CVE ID: CVE-2020-27691 State: PUBLISHED Published: 2020-11-04T20:10:48 Last Updated: 2024-08-04T16:18:45.557Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Relish (Verve Connect) VH510 device with firmware before 1.0.1.6L0516 allows XSS via URLBlocking Settings, SNMP Settings, and System Log Settings. Additional Analyst Notes: - CVE Program Container: References: - https://6point6.co.uk/insights/security-advisory-relish-4g-hub-vh510/ - https://6point6.co.uk/wp-content/uploads/2020/10/Relish-4G-VH510-Hub-Full-Disclosure-v1.3.pdf
CVE ID: CVE-2020-27692 State: PUBLISHED Published: 2020-11-04T20:14:21 Last Updated: 2024-08-04T16:18:45.665Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Relish (Verve Connect) VH510 device with firmware before 1.0.1.6L0516 contains multiple CSRF vulnerabilities within its web management portal. Attackers can, for example, use this to update the TR-069 configuration server settings (responsible for managing devices remotely). This makes it possible to remotely reboot the device or upload malicious firmware. Additional Analyst Notes: - CVE Program Container: References: - https://6point6.co.uk/insights/security-advisory-relish-4g-hub-vh510/ - https://6point6.co.uk/wp-conten
r: References: - https://6point6.co.uk/insights/security-advisory-relish-4g-hub-vh510/ - https://6point6.co.uk/wp-content/uploads/2020/10/Relish-4G-VH510-Hub-Full-Disclosure-v1.3.pdf
CVE ID: CVE-2020-27693 State: PUBLISHED Published: 2020-11-09T23:10:35 Last Updated: 2024-08-04T16:18:45.678Z Vendors: Trend Micro Products: Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) Problem Types: Insufficient Password Storage Description: Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 stores administrative passwords using a hash that is considered outdated. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000279833 - https://sec-consult.com/en/blog/advisories/vulnerabilities-in-trend-micro-interscan-messaging-security-virtual-appliance-imsva/
CVE ID: CVE-2020-27694 State: PUBLISHED Published: 2020-11-09T23:10:35 Last Updated: 2024-08-04T16:18:45.774Z Vendors: Trend Micro Products: Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) Problem Types: Outdated Library Description: Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 has updated a specific critical library that may vulnerable to attack. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/000279833 - https://sec-consult.com/en/blog/advisories/vulnerabilities-in-trend-micro-interscan-messaging-security-virtual-appliance-imsva/
CVE ID: CVE-2020-27695 State: PUBLISHED Published: 2020-11-18T18:45:37 Last Updated: 2024-08-04T16:18:45.580Z Vendors: Trend Micro Products: Trend Micro Security (Consumer) Problem Types: Local Privilege Escalation Description: Trend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that could be exploited by placing a malicious DLL in a local directory which can lead to obtaining administrative privileges during the installation of the product. Additional Analyst Notes: - CVE Program Container: References: - https://helpcenter.trendmicro.com/en-us/article/TMKA-10036
CVE ID: CVE-2020-27696 State: PUBLISHED Published: 2020-11-18T18:45:37 Last Updated: 2024-08-04T16:18:45.580Z Vendors: Trend Micro Products: Trend Micro Security (Consumer) Problem Types: Local Privilege Escalation Description: Trend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that could be exploited by placing a specific Windows system directory which can lead to obtaining administrative privileges during the installation of the product. Additional Analyst Notes: - CVE Program Container: References: - https://helpcenter.trendmicro.com/en-us/article/TMKA-10036
CVE ID: CVE-2020-27697 State: PUBLISHED Published: 2020-11-18T18:45:38 Last Updated: 2024-08-04T16:18:45.678Z Vendors: Trend Micro Products: Trend Micro Security (Consumer) Problem Types: Local Privilege Escalation Description: Trend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that could be exploited by placing a malicious DLL in a non-protected location with high privileges (symlink attack) which can lead to obtaining administrative privileges during the installation of the product. Additional Analyst Notes: - CVE Program Container: References: - https://helpcenter.trendmicro.com/en-us/article/TMKA-10036
CVE ID: CVE-2020-27708 State: PUBLISHED Published: 2020-10-30T16:23:56 Last Updated: 2024-08-04T16:18:45.679Z Vendors: n/a Products: Origin Problem Types: Elevation of Privilege Description: A vulnerability exists in the Origin Client that could allow a non-Administrative user to elevate their access to either Administrator or System. Once the user has obtained elevated access, they may be able to take control of the system and perform actions otherwise reserved for high privileged users or system Administrators. Additional Analyst Notes: - CVE Program Container: References: - https://www.ea.com/security/news/easec-2020-002-elevation-of-privilege-vulnerability-in-origin-client
CVE ID: CVE-2020-27713 State: PUBLISHED Published: 2020-12-11T19:00:15 Last Updated: 2024-08-04T16:18:45.649Z Vendors: n/a Products: BIG-IP Problem Types: DoS Description: In certain configurations on version 13.1.3.4, when a BIG-IP AFM HTTP security profile is applied to a virtual server and the BIG-IP system receives a request with specific characteristics, the connection is reset and the Traffic Management Microkernel (TMM) leaks memory. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K37960100
CVE ID: CVE-2020-27714 State: PUBLISHED Published: 2020-12-24T15:10:43 Last Updated: 2024-08-04T16:18:45.771Z Vendors: n/a Products: BIG-IP AFM Problem Types: DoS Description: On the BIG-IP AFM version 15.1.0-15.1.0.5, 14.1.0-14.1.3, and 13.1.0-13.1.3.5, when a Protocol Inspection Profile is attached to a FastL4 virtual server with the protocol field configured to either Other or All Protocols, the TMM may experience a restart if the profile processes non-TCP traffic. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K60344652
CVE ID: CVE-2020-27715 State: PUBLISHED Published: 2020-12-24T15:07:51 Last Updated: 2024-08-04T16:18:45.587Z Vendors: n/a Products: BIG-IP Problem Types: DoS Description: On BIG-IP 15.1.0-15.1.0.5 and 14.1.0-14.1.3, crafted TLS request to the BIG-IP management interface via port 443 can cause high (~100%) CPU utilization by the httpd daemon. Additional Analyst Notes: - CVE Program Container: References: - https://support.f5.com/csp/article/K25691186