deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-16256
Published: 2020-10-28
Description: The API on Winston 1.5.4 devices is vulnerable to CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://labs.bishopfox.com/advisories/winston-privacy-version-1.5.4; https://winstonprivacy.com/; https://labs.bishopfox.com/advisories/winston-privacy-version-1.5.4
CVE: CVE-2020-16258
Published: 2020-10-28
Description: Winston 1.5.4 devices make use of a Monit service (not managed during the normal user process) which is configured with default credentials.
CVSS Score: 7.1 (HIGH)
CWE: CWE-798
References: https://labs.bishopfox.com/advisories/winston-privacy-version-1.5.4; https://winstonprivacy.com/; https://labs.bishopfox.com/advisories/winston-privacy-version-1.5.4
CVE: CVE-2020-16259
Published: 2020-10-28
Description: Winston 1.5.4 devices have an SSH user account with access from bastion hosts. This is undocumented in device documents and is not announced to the user.
CVSS Score: 9.8 (CRITICAL)
References: https://labs.bishopfox.com/advisories/winston-privacy-version-1.5.4; https://winstonprivacy.com/; https://labs.bishopfox.com/advisories/winston-privacy-version-1.5.4
CVE: CVE-2020-16260
Published: 2020-10-28
Description: Winston 1.5.4 devices do not enforce authorization. This is exploitable from the intranet, and can be combined with other vulnerabilities for remote exploitation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://labs.bishopfox.com/advisories/winston-privacy-version-1.5.4; https://winstonprivacy.com/; https://labs.bishopfox.com/advisories/winston-privacy-version-1.5.4
CVE: CVE-2020-16261
Published: 2020-10-28
Description: Winston 1.5.4 devices allow a U-Boot interrupt, resulting in local root access.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-284
References: https://labs.bishopfox.com/advisories/winston-privacy-version-1.5.4; https://winstonprivacy.com/; https://labs.bishopfox.com/advisories/winston-privacy-version-1.5.4
CVE: CVE-2020-16262
Published: 2020-10-28
Description: Winston 1.5.4 devices have a local www-data user that is overly permissioned, resulting in root privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://labs.bishopfox.com/advisories/winston-privacy-version-1.5.4; https://winstonprivacy.com/; https://labs.bishopfox.com/advisories/winston-privacy-version-1.5.4
CVE: CVE-2020-16263
Published: 2020-10-28
Description: Winston 1.5.4 devices have a CORS configuration that trusts arbitrary origins. This allows requests to be made and viewed by arbitrary origins.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-668
References: https://labs.bishopfox.com/advisories/winston-privacy-version-1.5.4; https://winstonprivacy.com/; https://labs.bishopfox.com/advisories/winston-privacy-version-1.5.4
CVE: CVE-2020-25966
Published: 2020-10-28
Description: Sectona Spectra before 3.4.0 has a vulnerable SOAP API endpoint that leaks sensitive information about the configured assets without proper authentication. This could be used by unauthorized parties to get configured login credentials of the assets via a modified pAccountID value. NOTE: The vendor has indicated this is not a vulnerability and states "This vulnerability occurred due to wrong configuration of system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://gitlab.com/Gazzaz/Spectra_API_Issue/; https://sectona.com/products/spectra-privileged-access-management/; https://gitlab.com/Gazzaz/Spectra_API_Issue/
CVE: CVE-2020-26130
Published: 2020-10-28
Description: Issues were discovered in Open TFTP Server multithreaded 1.66 and Open TFTP Server single port 1.66. Due to insufficient access restrictions in the default installation directory, an attacker can elevate privileges by replacing the OpenTFTPServerMT.exe or the OpenTFTPServerSP.exe binary.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://github.com/OffensiveOceloot/advisories/blob/main/CVE-2020-26130.md; https://github.com/an0ry/advisories; https://sourceforge.net/projects/tftp-server/
CVE: CVE-2020-26131
Published: 2020-10-28
Description: Issues were discovered in Open DHCP Server (Regular) 1.75 and Open DHCP Server (LDAP Based) 0.1Beta. Due to insufficient access restrictions in the default installation directory, an attacker can elevate privileges by replacing the OpenDHCPServer.exe (Regular) or the OpenDHCPLdap.exe (LDAP Based) binary.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://github.com/OffensiveOceloot/advisories/blob/main/CVE-2020-26131.md; https://github.com/an0ry/advisories; https://sourceforge.net/projects/dhcpserver/
CVE: CVE-2020-26132
Published: 2020-10-28
Description: An issue was discovered in Home DNS Server 0.10. Due to insufficient access restrictions in the default installation directory, an attacker can elevate privileges by replacing the HomeDNSServer.exe binary.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://github.com/OffensiveOceloot/advisories/blob/main/CVE-2020-26132.md; https://github.com/an0ry/advisories; https://sourceforge.net/projects/dnsserver/
CVE: CVE-2020-26133
Published: 2020-10-28
Description: An issue was discovered in Dual DHCP DNS Server 7.40. Due to insufficient access restrictions in the default installation directory, an attacker can elevate privileges by replacing the DualServer.exe binary.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://github.com/OffensiveOceloot/advisories/blob/main/CVE-2020-26133.md; https://github.com/an0ry/advisories; https://sourceforge.net/projects/dhcp-dns-server/
CVE: CVE-2020-24990
Published: 2020-10-28
Description: An issue was discovered in QSC Q-SYS Core Manager 8.2.1. By utilizing the TFTP service running on UDP port 69, a remote attacker can perform a directory traversal and obtain operating system files via a TFTP GET request, as demonstrated by reading /etc/passwd or /proc/version.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/159699/QSC-Q-SYS-Core-Manager-8.2.1-Directory-Traversal.html; http://seclists.org/fulldisclosure/2020/Oct/30; https://q-syshelp.qsc.com/Content/Core_Manager/CoreManager_Overview.htm
CVE: CVE-2020-25204
Published: 2020-10-28
Description: The God Kings application 0.60.1 for Android exposes a broadcast receiver to other apps called com.innogames.core.frontend.notifications.receivers.LocalNotificationBroadcastReceiver. The purpose of this broadcast receiver is to show an in-game push notification to the player. However, the application does not enforce any authorization schema on the broadcast receiver, allowing any application to send fully customizable in-game push notifications.
CVSS Score: 5.5 (MEDIUM)
References: http://packetstormsecurity.com/files/159747/God-Kings-0.60.1-Notification-Spoofing.html; http://packetstormsecurity.com/files/159747/God-Kings-0.60.1-Notification-Spoofing.html
CVE: CVE-2020-27739
Published: 2020-10-28
Description: A Weak Session Management vulnerability in Citadel WebCit through 926 allows unauthenticated remote attackers to hijack recently logged-in users' sessions. NOTE: this was reported to the vendor in a publicly archived "Multiple Security Vulnerabilities in WebCit 926" thread.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-613
References: http://uncensored.citadel.org/readfwd?go=Citadel%20Security?start_reading_at=4592834; https://www.citadel.org/; http://uncensored.citadel.org/readfwd?go=Citadel%20Security?start_reading_at=4592834
CVE: CVE-2020-27740
Published: 2020-10-28
Description: Citadel WebCit through 926 allows unauthenticated remote attackers to enumerate valid users within the platform. NOTE: this was reported to the vendor in a publicly archived "Multiple Security Vulnerabilities in WebCit 926" thread.
CVSS Score: 5.3 (MEDIUM)
References: http://uncensored.citadel.org/readfwd?go=Citadel%20Security?start_reading_at=4592834; https://www.citadel.org/; http://uncensored.citadel.org/readfwd?go=Citadel%20Security?start_reading_at=4592834
CVE: CVE-2020-27741
Published: 2020-10-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in Citadel WebCit through 926 allow remote attackers to inject arbitrary web script or HTML via multiple pages and parameters. NOTE: this was reported to the vendor in a publicly archived "Multiple Security Vulnerabilities in WebCit 926" thread.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://uncensored.citadel.org/readfwd?go=Citadel%20Security?start_reading_at=4592834; https://www.citadel.org/; http://uncensored.citadel.org/readfwd?go=Citadel%20Security?start_reading_at=4592834
CVE: CVE-2020-27742
Published: 2020-10-28
Description: An Insecure Direct Object Reference vulnerability in Citadel WebCit through 926 allows authenticated remote attackers to read someone else's emails via the msg_confirm_move template. NOTE: this was reported to the vendor in a publicly archived "Multiple Security Vulnerabilities in WebCit 926" thread.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: http://uncensored.citadel.org/readfwd?go=Citadel%20Security?start_reading_at=4592834; https://www.citadel.org/; http://uncensored.citadel.org/readfwd?go=Citadel%20Security?start_reading_at=4592834
CVE: CVE-2020-27980
Published: 2020-10-28
Description: Genexis Platinum-4410 P4410-V2-1.28 devices allow stored XSS in the WLAN SSID parameter. This could allow an attacker to perform malicious actions in which the XSS popup will affect all privileged users.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://genexis.eu/product/platinum/; https://www.exploit-db.com/exploits/48948; https://genexis.eu/product/platinum/
CVE: CVE-2020-24707
Published: 2020-10-28
Description: Gophish before 0.11.0 allows the creation of CSV sheets that contain malicious content.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1236
References: https://github.com/gophish/gophish/commit/b25f5ac5e468f6730e377f43c7995e18f8fccc2b; https://github.com/gophish/gophish/releases/tag/v0.11.0; https://herolab.usd.de/security-advisories/usd-2020-0052/
CVE: CVE-2020-24708
Published: 2020-10-28
Description: Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the Host field on the send profile form.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/gophish/gophish/commit/90fed5a575628b89eaf941e1627b49e0f3693812; https://herolab.usd.de/security-advisories/usd-2020-0048/; https://github.com/gophish/gophish/commit/90fed5a575628b89eaf941e1627b49e0f3693812
CVE: CVE-2020-24709
Published: 2020-10-28
Description: Cross Site Scripting (XSS) vulnerability in Gophish through 0.10.1 via a crafted landing page or email template.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://herolab.usd.de/security-advisories/usd-2020-0049/; https://herolab.usd.de/security-advisories/usd-2020-0049/
CVE: CVE-2020-24710
Published: 2020-10-28
Description: Gophish before 0.11.0 allows SSRF attacks.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918
References: https://github.com/gophish/gophish/commit/e3352f481e94054ffe08494c9225d3878347b005; https://github.com/gophish/gophish/releases/tag/v0.11.0; https://herolab.usd.de/security-advisories/usd-2020-0054/
CVE: CVE-2020-24711
Published: 2020-10-28
Description: The Reset button on the Account Settings page in Gophish before 0.11.0 allows attackers to cause a denial of service via a clickjacking attack
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1021
References: https://github.com/gophish/gophish/commit/6df62e85fd60f0931d3c8bfdb13b436a961bc9b6; https://github.com/gophish/gophish/releases/tag/v0.11.0; https://herolab.usd.de/security-advisories/usd-2020-0051/
CVE: CVE-2020-24712
Published: 2020-10-28
Description: Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the IMAP Host field on the account settings page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/gophish/gophish/commit/4e9b94b641755f359542b246cc0c555fa3bc6715; https://github.com/gophish/gophish/releases/tag/v0.11.0; https://herolab.usd.de/security-advisories/usd-2020-0050/
CVE: CVE-2020-24713
Published: 2020-10-28
Description: Gophish through 0.10.1 does not invalidate the gophish cookie upon logout.
CVSS Score: 7.5 (HIGH)
CWE: CWE-613
References: https://herolab.usd.de/security-advisories/usd-2020-0053/; https://herolab.usd.de/security-advisories/usd-2020-0053/
CVE: CVE-2020-25374
Published: 2020-10-28
Description: CyberArk Privileged Session Manager (PSM) 10.9.0.15 allows attackers to discover internal pathnames by reading an error popup message after two hours of idle time.
CVSS Score: 2.6 (LOW)
CWE: CWE-613
References: https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/Latest/en/Content/PAS%20SysReq/System%20Requirements%20-%20PSM.htm; https://medium.com/%40virajmota38/full-path-disclosure-8a9358e5a867; https://docs.cyberark.com/Product-Doc/OnlineHelp/PAS/Latest/en/Content/PAS%20SysReq/System%20Requirements%20-%20PSM.htm
CVE: CVE-2020-27981
Published: 2020-10-28
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2020-27986
Published: 2020-10-28
Description: SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/settings/values URI. NOTE: reportedly, the vendor's position for SMTP and SVN is "it is the administrator's responsibility to configure it.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-312, CWE-306, CWE-312
References: https://csl.com.co/sonarqube-auditando-al-auditor-parte-i/; https://csl.com.co/sonarqube-auditando-al-auditor-parte-i/
CVE: CVE-2020-11483
Published: 2020-10-29
Description: NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prior to 1.06.06, contains a vulnerability in the AMI BMC firmware in which the firmware includes hard-coded credentials, which may lead to elevation of privileges or information disclosure.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5010; https://nvidia.custhelp.com/app/answers/detail/a_id/5010
CVE: CVE-2020-11484
Published: 2020-10-29
Description: NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contains a vulnerability in the AMI BMC firmware in which an attacker with administrative privileges can obtain the hash of the BMC/IPMI user password, which may lead to information disclosure.
CVSS Score: 4.9 (MEDIUM)
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5010; https://nvidia.custhelp.com/app/answers/detail/a_id/5010
CVE: CVE-2020-11485
Published: 2020-10-29
Description: NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contains a Cross-Site Request Forgery (CSRF) vulnerability in the AMI BMC firmware in which the web application does not sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request, which can lead to information disclosure or code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5010; https://nvidia.custhelp.com/app/answers/detail/a_id/5010
CVE: CVE-2020-11486
Published: 2020-10-29
Description: NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in which software allows an attacker to upload or transfer files that can be automatically processed within the product's environment, which may lead to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5010; https://nvidia.custhelp.com/app/answers/detail/a_id/5010
CVE: CVE-2020-11487
Published: 2020-10-29
Description: NVIDIA DGX servers, DGX-1 with BMC firmware versions prior to 3.38.30. DGX-2 with BMC firmware versions prior to 1.06.06 and all DGX A100 Servers with all BMC firmware versions, contains a vulnerability in the AMI BMC firmware in which the use of a hard-coded RSA 1024 key with weak ciphers may lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5010; https://nvidia.custhelp.com/app/answers/detail/a_id/5010
CVE: CVE-2020-11488
Published: 2020-10-29
Description: NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prior to 1.06.06, contains a vulnerability in the AMI BMC firmware in which software does not validate the RSA 1024 public key used to verify the firmware signature, which may lead to information disclosure or code execution.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-347
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5010; https://nvidia.custhelp.com/app/answers/detail/a_id/5010
CVE: CVE-2020-11489
Published: 2020-10-29
Description: NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30 and all DGX-2 with BMC firmware versions prior to 1.06.06, contain a vulnerability in the AMI BMC firmware in which default SNMP community strings are used, which may lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1188
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5010; https://nvidia.custhelp.com/app/answers/detail/a_id/5010
CVE: CVE-2020-11615
Published: 2020-10-29
Description: NVIDIA DGX servers, all BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in which it uses a hard-coded RC4 cipher key, which may lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5010; https://nvidia.custhelp.com/app/answers/detail/a_id/5010
CVE: CVE-2020-11616
Published: 2020-10-29
Description: NVIDIA DGX servers, all BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in which the Pseudo-Random Number Generator (PRNG) algorithm used in the JSOL package that implements the IPMI protocol is not cryptographically strong, which may lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-338
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5010; https://nvidia.custhelp.com/app/answers/detail/a_id/5010
CVE: CVE-2020-7746
Published: 2020-10-29
Description: This affects the package chart.js before 2.9.4. The options parameter is not properly sanitized when it is processed. When the options are processed, the existing options (or the defaults options) are deeply merged with provided options. However, during this operation, the keys of the object being set are not checked, leading to a prototype pollution.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1321
References: https://github.com/chartjs/Chart.js/pull/7920; https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1019375; https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBCHARTJS-1019376
CVE: CVE-2020-27648
Published: 2020-10-29
Description: Improper certificate validation vulnerability in OpenVPN client in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 8.3 (HIGH)
CWE: CWE-295, CWE-295
References: https://www.synology.com/security/advisory/Synology_SA_20_18; https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1058; https://www.synology.com/security/advisory/Synology_SA_20_18
CVE: CVE-2020-27649
Published: 2020-10-29
Description: Improper certificate validation vulnerability in OpenVPN client in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 8.3 (HIGH)
CWE: CWE-295, CWE-295
References: https://www.synology.com/security/advisory/Synology_SA_20_14; https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1058; https://www.synology.com/security/advisory/Synology_SA_20_14
CVE: CVE-2020-27650
Published: 2020-10-29
Description: Synology DiskStation Manager (DSM) before 6.2.3-25426-2 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-614, CWE-311
References: https://www.synology.com/security/advisory/Synology_SA_20_18; https://www.synology.com/security/advisory/Synology_SA_20_18
CVE: CVE-2020-27651
Published: 2020-10-29
Description: Synology Router Manager (SRM) before 1.2.4-8081 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-614, CWE-311
References: https://www.synology.com/security/advisory/Synology_SA_20_14; https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1059; https://www.synology.com/security/advisory/Synology_SA_20_14
CVE: CVE-2020-27652
Published: 2020-10-29
Description: Algorithm downgrade vulnerability in QuickConnect in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via unspecified vectors.
CVSS Score: 8.3 (HIGH)
CWE: CWE-327, CWE-327
References: https://www.synology.com/security/advisory/Synology_SA_20_18; https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1061; https://www.synology.com/security/advisory/Synology_SA_20_18
CVE: CVE-2020-27653
Published: 2020-10-29
Description: Algorithm downgrade vulnerability in QuickConnect in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via unspecified vectors.
CVSS Score: 8.3 (HIGH)
CWE: CWE-327, CWE-327
References: https://www.synology.com/security/advisory/Synology_SA_20_14; https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1061; https://www.synology.com/security/advisory/Synology_SA_20_14
CVE: CVE-2020-27654
Published: 2020-10-29
Description: Improper access control vulnerability in lbd in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to execute arbitrary commands via port (1) 7786/tcp or (2) 7787/tcp.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269, CWE-269
References: https://www.synology.com/security/advisory/Synology_SA_20_14; https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1064; https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1065
CVE: CVE-2020-27655
Published: 2020-10-29
Description: Improper access control vulnerability in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to access restricted resources via inbound QuickConnect traffic.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269, CWE-269
References: https://www.synology.com/security/advisory/Synology_SA_20_14; https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1066; https://www.synology.com/security/advisory/Synology_SA_20_14
CVE: CVE-2020-27656
Published: 2020-10-29
Description: Cleartext transmission of sensitive information vulnerability in DDNS in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to eavesdrop authentication information of DNSExit via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-319, CWE-319
References: https://www.synology.com/security/advisory/Synology_SA_20_18; https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1071; https://www.synology.com/security/advisory/Synology_SA_20_18
CVE: CVE-2020-27657
Published: 2020-10-29
Description: Cleartext transmission of sensitive information vulnerability in DDNS in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to eavesdrop authentication information of DNSExit via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-319, CWE-319
References: https://www.synology.com/security/advisory/Synology_SA_20_14; https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1071; https://www.synology.com/security/advisory/Synology_SA_20_14