Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
iner: - CISA ADP Vulnrichment: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=26224 - https://sourceware.org/bugzilla/show_bug.cgi?id=19519#c21 - https://security.gentoo.org/glsa/202107-07 - https://www.oracle.com/security-alerts/cpujan2022.html - https://security.netapp.com/advisory/ntap-20210401-0006/ - https://www.oracle.com/security-alerts/cpuapr2022.html - https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html
CVE ID: CVE-2020-27619 State: PUBLISHED Published: 2020-10-22T00:00:00 Last Updated: 2024-08-04T16:18:44.776Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.python.org/issue41944 - https://github.com/python/cpython/commit/2ef5caa58febc8968e670e39e3d37cf8eef3cab8 - https://github.com/python/cpython/commit/b664a1df4ee71d3760ab937653b10997081b1794 - https://github.com/python/cpython/commit/6c6c256df3636ff6f6136820afaefa5a10a3ac33 - https://github.com/python/cpython/commit/43e52310388
om/python/cpython/commit/6c6c256df3636ff6f6136820afaefa5a10a3ac33 - https://github.com/python/cpython/commit/43e523103886af66d6c27cd72431b5d9d14cd2a9 - https://github.com/python/cpython/commit/e912e945f2960029d039d3390ea08835ad39374b - https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/ - https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c279522
rg/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/ - https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E - https://www.oracle.com/security-alerts/cpujul2022.html - https://security.netapp.com/advisory/ntap-20201123-0004/ - https://security.gentoo.org/glsa/202402-04
CVE ID: CVE-2020-27620 State: PUBLISHED Published: 2020-10-22T03:05:10 Last Updated: 2024-08-04T16:18:44.920Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Cosmos Skin for MediaWiki through 1.35.0 has stored XSS because MediaWiki messages were not being properly escaped. This is related to wfMessage and Html::rawElement, as demonstrated by CosmosSocialProfile::getUserGroups. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T265440 - https://gerrit.wikimedia.org/r/c/mediawiki/skins/Cosmos/+/634749 - https://gerrit.wikimedia.org/r/c/mediawiki/skins/Cosmos/+/634752 - https://gerrit.wikimedia.org/r/c/mediawiki/skins/Cosmos/+/6347
errit.wikimedia.org/r/c/mediawiki/skins/Cosmos/+/634752 - https://gerrit.wikimedia.org/r/c/mediawiki/skins/Cosmos/+/634751
CVE ID: CVE-2020-27621 State: PUBLISHED Published: 2020-10-22T03:04:57 Last Updated: 2024-08-04T16:18:44.821Z Vendors: n/a Products: n/a Problem Types: n/a Description: The FileImporter extension in MediaWiki through 1.35.0 was not properly attributing various user actions to a specific user's IP address. Instead, for various actions, it would report the IP address of an internal Wikimedia Foundation server by omitting X-Forwarded-For data. This resulted in an inability to properly audit and attribute various user actions performed via the FileImporter extension. Additional Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T265810 - https://gerrit.wikime
Analyst Notes: - CVE Program Container: References: - https://phabricator.wikimedia.org/T265810 - https://gerrit.wikimedia.org/r/q/I24a240253c7a5c66dd493a68e8c23d95a17e1b21
CVE ID: CVE-2020-27622 State: PUBLISHED Published: 2020-11-16T15:11:25 Last Updated: 2024-08-04T16:18:44.665Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains IntelliJ IDEA before 2020.2, the built-in web server could expose information about the IDE version. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/2020/11/16/jetbrains-security-bulletin-q3-2020/
CVE ID: CVE-2020-27623 State: PUBLISHED Published: 2020-11-16T15:12:05 Last Updated: 2024-08-04T16:18:45.503Z Vendors: n/a Products: n/a Problem Types: n/a Description: JetBrains IdeaVim before version 0.58 might have caused an information leak in limited circumstances. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/2020/11/16/jetbrains-security-bulletin-q3-2020/
CVE ID: CVE-2020-27624 State: PUBLISHED Published: 2020-11-16T14:59:42 Last Updated: 2024-08-04T16:18:45.542Z Vendors: n/a Products: n/a Problem Types: n/a Description: JetBrains YouTrack before 2020.3.888 was vulnerable to SSRF. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/2020/11/16/jetbrains-security-bulletin-q3-2020/
CVE ID: CVE-2020-27625 State: PUBLISHED Published: 2020-11-16T14:59:02 Last Updated: 2024-08-04T16:18:45.402Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains YouTrack before 2020.3.888, notifications might have mentioned inaccessible issues. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com
CVE ID: CVE-2020-27626 State: PUBLISHED Published: 2020-11-16T14:58:33 Last Updated: 2024-08-04T16:18:45.415Z Vendors: n/a Products: n/a Problem Types: n/a Description: JetBrains YouTrack before 2020.3.5333 was vulnerable to SSRF. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/2020/11/16/jetbrains-security-bulletin-q3-2020/
CVE ID: CVE-2020-27627 State: PUBLISHED Published: 2020-11-16T15:08:17 Last Updated: 2024-08-04T16:18:45.411Z Vendors: n/a Products: n/a Problem Types: n/a Description: JetBrains TeamCity before 2020.1.2 was vulnerable to URL injection. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/2020/11/16/jetbrains-security-bulletin-q3-2020/
CVE ID: CVE-2020-27628 State: PUBLISHED Published: 2020-11-16T15:02:28 Last Updated: 2024-08-04T16:18:44.849Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains TeamCity before 2020.1.5, the Guest user had access to audit records. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/2020/11/16/jetbrains-security-bulletin-q3-2020/
CVE ID: CVE-2020-27629 State: PUBLISHED Published: 2020-11-16T15:01:52 Last Updated: 2024-08-04T16:18:45.490Z Vendors: n/a Products: n/a Problem Types: n/a Description: In JetBrains TeamCity before 2020.1.5, secure dependency parameters could be not masked in depending builds when there are no internal artifacts. Additional Analyst Notes: - CVE Program Container: References: - https://blog.jetbrains.com - https://blog.jetbrains.com/2020/11/16/jetbrains-security-bulletin-q3-2020/
CVE ID: CVE-2020-27630 State: PUBLISHED Published: 2023-10-10T00:00:00 Last Updated: 2024-09-19T15:29:41.791Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Silicon Labs uC/TCP-IP 3.6.0, TCP ISNs are improperly random. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.forescout.com - https://www.cisa.gov/news-events/ics-advisories/icsa-21-042-01 - https://www.forescout.com/resources/numberjack-weak-isn-generation-in-embedded-tcpip-stacks/
CVE ID: CVE-2020-27631 State: PUBLISHED Published: 2023-10-10T00:00:00 Last Updated: 2024-09-19T15:28:15.213Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Oryx CycloneTCP 1.9.6, TCP ISNs are improperly random. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.forescout.com - https://www.cisa.gov/news-events/ics-advisories/icsa-21-042-01 - https://www.forescout.com/resources/numberjack-weak-isn-generation-in-embedded-tcpip-stacks/
CVE ID: CVE-2020-27632 State: PUBLISHED Published: 2021-03-10T00:00:00 Last Updated: 2024-08-04T16:18:45.486Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SIMATIC MV400 family versions prior to v7.0.6, the ISN generator is initialized with a constant value and has constant increments. An attacker could predict and hijack TCP sessions. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-599268.pdf - https://www.cisa.gov/news-events/ics-advisories/icsa-21-042-01 - https://www.forescout.com/resources/numberjack-weak-isn-generation-in-embedded-tcpip-stacks/
CVE ID: CVE-2020-27633 State: PUBLISHED Published: 2023-10-10T00:00:00 Last Updated: 2024-09-19T15:10:06.481Z Vendors: n/a Products: n/a Problem Types: n/a Description: In FNET 4.6.3, TCP ISNs are improperly random. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.forescout.com - https://www.cisa.gov/news-events/ics-advisories/icsa-21-042-01 - https://www.forescout.com/resources/numberjack-weak-isn-generation-in-embedded-tcpip-stacks/
CVE ID: CVE-2020-27634 State: PUBLISHED Published: 2023-10-10T00:00:00 Last Updated: 2024-09-19T15:04:22.313Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Contiki 4.5, TCP ISNs are improperly random. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.forescout.com - https://www.cisa.gov/news-events/ics-advisories/icsa-21-042-01 - https://www.forescout.com/resources/numberjack-weak-isn-generation-in-embedded-tcpip-stacks/
CVE ID: CVE-2020-27635 State: PUBLISHED Published: 2023-10-10T00:00:00 Last Updated: 2024-09-19T15:02:11.284Z Vendors: n/a Products: n/a Problem Types: n/a Description: In PicoTCP 1.7.0, TCP ISNs are improperly random. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.forescout.com - https://www.cisa.gov/news-events/ics-advisories/icsa-21-042-01 - https://www.forescout.com/resources/numberjack-weak-isn-generation-in-embedded-tcpip-stacks/
CVE ID: CVE-2020-27636 State: PUBLISHED Published: 2023-10-10T00:00:00 Last Updated: 2024-09-19T15:27:23.843Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Microchip MPLAB Net 3.6.1, TCP ISNs are improperly random. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.forescout.com - https://www.cisa.gov/news-events/ics-advisories/icsa-21-042-01 - https://www.forescout.com/resources/numberjack-weak-isn-generation-in-embedded-tcpip-stacks/
CVE ID: CVE-2020-27637 State: PUBLISHED Published: 2021-01-12T00:00:00 Last Updated: 2024-08-04T16:18:44.949Z Vendors: n/a Products: n/a Problem Types: n/a Description: The R programming language’s default package manager CRAN is affected by a path traversal vulnerability that can lead to server compromise. This vulnerability affects packages installed via the R CMD install cli command or the install.packages() function from the interpreter. Update to version 4.0.3 Additional Analyst Notes: - CVE Program Container: References: - https://www.r-project.org/foundation/ - https://labs.bishopfox.com/advisories/cran-version-4.0.2 - https://security.gentoo.org/glsa/202401-07
CVE ID: CVE-2020-27638 State: PUBLISHED Published: 2020-10-22T12:27:04 Last Updated: 2024-08-04T16:18:45.492Z Vendors: n/a Products: n/a Problem Types: n/a Description: receive.c in fastd before v21 allows denial of service (assertion failure) when receiving packets with an invalid type code. Additional Analyst Notes: - CVE Program Container: References: - https://fastd.readthedocs.io/en/stable/releases/v21.html - https://github.com/NeoRaider/fastd/commit/737925113363b6130879729cdff9ccc46c33eaea - https://bugs.debian.org/972521 - https://lists.debian.org/debian-lts-announce/2020/10/msg00025.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/messag
/2020/10/msg00025.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GUZ3AGTAXH7OOP45F5WXBVRQ3IDWUR7M/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WSMH65GHKHMJAK2VMPROIPIUS4IA63CW/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D2LNSF2LI4RQ7BVGHTJQUJWP7RVGHDTK/
CVE ID: CVE-2020-27639 State: PUBLISHED Published: 2020-12-18T07:17:52 Last Updated: 2024-08-04T16:18:45.247Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Bluetooth handset of Mitel MiVoice 6873i, 6930, and 6940 SIP phones with firmware before 5.1.0.SP6 could allow an unauthenticated attacker within Bluetooth range to pair a rogue Bluetooth device when a phone handset loses connection, due to an improper pairing mechanism. A successful exploit could allow an attacker to eavesdrop on conversations. Additional Analyst Notes: - CVE Program Container: References: - https://www.mitel.com/support/security-advisories
CVE ID: CVE-2020-27640 State: PUBLISHED Published: 2020-12-18T07:19:04 Last Updated: 2024-08-04T16:18:45.486Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Bluetooth handset of Mitel MiVoice 6940 and 6930 MiNet phones with firmware before 1.5.3 could allow an unauthenticated attacker within Bluetooth range to pair a rogue Bluetooth device when a phone handset loses connection, due to an improper pairing mechanism. A successful exploit could allow an attacker to eavesdrop on conversations. Additional Analyst Notes: - CVE Program Container: References: - https://www.mitel.com/support/security-advisories
CVE ID: CVE-2020-27641 State: REJECTED Published: 2020-12-07T21:54:25 Last Updated: 2020-12-07T21:54:25 Description: No description available.
CVE ID: CVE-2020-27642 State: PUBLISHED Published: 2020-10-22T12:56:56 Last Updated: 2024-08-04T16:18:45.476Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability exists in the 'merge account' functionality in admins.js in BigBlueButton Greenlight 2.7.6. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bigbluebutton/greenlight/pull/2214
CVE ID: CVE-2020-27643 State: PUBLISHED Published: 2020-12-29T20:08:52 Last Updated: 2024-08-04T16:18:45.566Z Vendors: n/a Products: n/a Problem Types: n/a Description: The %PROGRAMDATA%\1E\Client directory in 1E Client 5.0.0.745 and 4.1.0.267 allows remote authenticated users and local users to create and modify files in protected directories (where they would not normally have access to create or modify files) via the creation of a junction point to a system directory. This leads to partial privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://help.1e.com/display/GI/1E+Security+Advisory-1E+Client+for+Windows%3A+CVE-2020-16268%2C+CVE-2020-27643%2C+CV
s: - https://help.1e.com/display/GI/1E+Security+Advisory-1E+Client+for+Windows%3A+CVE-2020-16268%2C+CVE-2020-27643%2C+CVE-2020-27644%2C+CVE-2020-27645
CVE ID: CVE-2020-27644 State: PUBLISHED Published: 2020-12-29T20:10:36 Last Updated: 2024-08-04T16:18:45.480Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Inventory module of the 1E Client 5.0.0.745 doesn't handle an unquoted path when executing %PROGRAMFILES%\1E\Client\Tachyon.Performance.Metrics.exe. This may allow remote authenticated users and local users to gain elevated privileges by placing a malicious cryptbase.dll file in %WINDIR%\Temp\. Additional Analyst Notes: - CVE Program Container: References: - https://help.1e.com/display/GI/1E+Security+Advisory-1E+Client+for+Windows%3A+CVE-2020-16268%2C+CVE-2020-27643%2C+CVE-2020-27644%2C+CVE-2020-27645
CVE ID: CVE-2020-27645 State: PUBLISHED Published: 2020-12-29T20:12:02 Last Updated: 2024-08-04T16:18:44.994Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Inventory module of the 1E Client 5.0.0.745 doesn't handle an unquoted path when executing %PROGRAMFILES%\1E\Client\Tachyon.Performance.Metrics.exe. This may allow remote authenticated users and local users to gain elevated privileges. Additional Analyst Notes: - CVE Program Container: References: - https://help.1e.com/display/GI/1E+Security+Advisory-1E+Client+for+Windows%3A+CVE-2020-16268%2C+CVE-2020-27643%2C+CVE-2020-27644%2C+CVE-2020-27645
CVE ID: CVE-2020-27646 State: PUBLISHED Published: 2020-10-22T13:27:29 Last Updated: 2024-08-04T16:18:45.327Z Vendors: n/a Products: n/a Problem Types: n/a Description: Biscom Secure File Transfer (SFT) before 5.1.1082 and 6.x before 6.0.1011 allows user credential theft. Additional Analyst Notes: - CVE Program Container: References: - https://cve.biscom.com/bis-sft-cv-0011/
CVE ID: CVE-2020-27648 State: PUBLISHED Published: 2020-10-29T09:00:25.133928Z Last Updated: 2024-09-16T20:27:27.929Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Synology Products: DiskStation Manager (DSM) Problem Types: CWE-295 Description: Improper certificate validation vulnerability in OpenVPN client in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/security/advisory/Synology_SA_20_18 - https://www.talosintelligence.com/vulnerability_reports/TA
ttps://www.synology.com/security/advisory/Synology_SA_20_18 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1058
CVE ID: CVE-2020-27649 State: PUBLISHED Published: 2020-10-29T08:55:20.493003Z Last Updated: 2024-09-16T17:18:38.304Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Synology Products: Synology Router Manager (SRM) Problem Types: CWE-295 Description: Improper certificate validation vulnerability in OpenVPN client in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/security/advisory/Synology_SA_20_14 - https://www.talosintelligence.com/vulnerability_reports/TALOS-
://www.synology.com/security/advisory/Synology_SA_20_14 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1058
CVE ID: CVE-2020-27650 State: PUBLISHED Published: 2020-10-29T09:00:25.555729Z Last Updated: 2024-09-16T23:10:20.265Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Synology Products: DiskStation Manager (DSM) Problem Types: CWE-614 Description: Synology DiskStation Manager (DSM) before 6.2.3-25426-2 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/security/advisory/Synology_SA_20_18
CVE ID: CVE-2020-27651 State: PUBLISHED Published: 2020-10-29T08:55:20.903504Z Last Updated: 2024-09-16T16:53:56.749Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Synology Products: Synology Router Manager (SRM) Problem Types: CWE-614 Description: Synology Router Manager (SRM) before 1.2.4-8081 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/security/advisory/Synology_SA_20_14 - https://www.talosintelligence.com/vulnerabi
References: - https://www.synology.com/security/advisory/Synology_SA_20_14 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1059
CVE ID: CVE-2020-27652 State: PUBLISHED Published: 2020-10-29T09:00:26.029280Z Last Updated: 2024-09-16T19:55:59.604Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Synology Products: DiskStation Manager (DSM) Problem Types: CWE-327 Description: Algorithm downgrade vulnerability in QuickConnect in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/security/advisory/Synology_SA_20_18 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1061
CVE ID: CVE-2020-27653 State: PUBLISHED Published: 2020-10-29T08:55:21.316433Z Last Updated: 2024-09-16T19:04:23.639Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Synology Products: Synology Router Manager (SRM) Problem Types: CWE-327 Description: Algorithm downgrade vulnerability in QuickConnect in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/security/advisory/Synology_SA_20_14 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1061
CVE ID: CVE-2020-27654 State: PUBLISHED Published: 2020-10-29T08:55:21.725529Z Last Updated: 2024-09-17T04:00:00.849Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Synology Products: Synology Router Manager (SRM) Problem Types: CWE-269 Description: Improper access control vulnerability in lbd in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to execute arbitrary commands via port (1) 7786/tcp or (2) 7787/tcp. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/security/advisory/Synology_SA_20_14 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1065 - https://www.talosintel
ory/Synology_SA_20_14 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1065 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1064
CVE ID: CVE-2020-27655 State: PUBLISHED Published: 2020-10-29T08:55:22.192913Z Last Updated: 2024-09-17T00:25:27.752Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: Synology Products: Synology Router Manager (SRM) Problem Types: CWE-269 Description: Improper access control vulnerability in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to access restricted resources via inbound QuickConnect traffic. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/security/advisory/Synology_SA_20_14 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1066
CVE ID: CVE-2020-27656 State: PUBLISHED Published: 2020-10-29T09:00:26.440634Z Last Updated: 2024-09-16T17:28:58.260Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: Synology Products: DiskStation Manager (DSM) Problem Types: CWE-319 Description: Cleartext transmission of sensitive information vulnerability in DDNS in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to eavesdrop authentication information of DNSExit via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.synology.com/security/advisory/Synology_SA_20_18 - https://www.talosintelligence.com/vulnerability_rep
es: - https://www.synology.com/security/advisory/Synology_SA_20_18 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1071