rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-27602 
BigBlueButton before 2.2.7 does not have a protection mechanism for separator injection in meetingId, userId, and authToken.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-21T14:07:37.000Z
CVE-2020-27603 
BigBlueButton before 2.2.27 has an unsafe JODConverter setting in which LibreOffice document conversions can access external files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-21T14:09:38.000Z
CVE-2020-27604 
BigBlueButton before 2.3 does not implement LibreOffice sandboxing. This might make it easier for remote authenticated users to read the API shared secret in the bigbluebutton.properties file. With the API shared secret, an attacker can (for example) use api/join to join an arbitrary meeting regardless of its guestPolicy setting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-21T14:09:11.000Z
CVE-2020-27605 
BigBlueButton through 2.2.28 uses Ghostscript for processing of uploaded EPS documents, and consequently may be subject to attacks related to a "schwache Sandbox."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-21T14:09:03.000Z
CVE-2020-27606 
BigBlueButton before 2.2.28 (or earlier) does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-21T14:07:44.000Z
CVE-2020-27607 
In BigBlueButton before 2.2.28 (or earlier), the client-side Mute button only signifies that the server should stop accepting audio data from the client. It does not directly configure the client to stop sending audio data to the server, and thus a modified server could store the audio data and/or transmit it to one or more meeting participants or other third parties.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-21T14:08:55.000Z
CVE-2020-27608 
In BigBlueButton before 2.2.28 (or earlier), uploaded presentations are sent to clients without a Content-Type header, which allows XSS, as demonstrated by a .png file extension for an HTML document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-21T14:07:51.000Z
CVE-2020-27609 
BigBlueButton through 2.2.28 records a video meeting despite the deactivation of video recording in the user interface. This may result in data storage beyond what is authorized for a specific meeting topic or participant.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-21T14:08:45.000Z
CVE-2020-27610 
The installation procedure in BigBlueButton before 2.2.28 (or earlier) exposes certain network services to external interfaces, and does not automatically set up a firewall configuration to block external access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-21T14:07:58.000Z
CVE-2020-27611 
BigBlueButton through 2.2.28 uses STUN/TURN resources from a third party, which may represent an unintended endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-21T14:08:35.000Z
CVE-2020-27612 
Greenlight in BigBlueButton through 2.2.28 places usernames in room URLs, which may represent an unintended information leak to users in a room, or an information leak to outsiders if any user publishes a screenshot of a browser window.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-21T14:08:05.000Z
CVE-2020-27613 
The installation procedure in BigBlueButton before 2.2.28 (or earlier) uses ClueCon as the FreeSWITCH password, which allows local users to achieve unintended FreeSWITCH access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-21T14:08:23.000Z
CVE-2020-27614 
AnyDesk for macOS versions 6.0.2 and older have a vulnerability in the XPC interface that does not properly validate client requests and allows local privilege escalation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-09T00:00:35.000Z
CVE-2020-27615 
The Loginizer plugin before 1.6.4 for WordPress allows SQL injection (with resultant XSS), related to loginizer_login_failed and lz_valid_ip.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-21T20:07:32.000Z
CVE-2020-27616 
ati_2d_blt in hw/display/ati_2d.c in QEMU 4.2.1 can encounter an outside-limits situation in a calculation. A guest can crash the QEMU process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-06T07:48:01.000Z
CVE-2020-27617 
eth_get_gso_type in net/eth.c in QEMU 4.2.1 allows guest OS users to trigger an assertion failure. A guest can crash the QEMU process via packet data that lacks a valid Layer 3 protocol.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-06T07:51:37.000Z
CVE-2020-27618 
The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance the input state, which could lead to an infinite loop in applications, resulting in a denial of service, a different vulnerability from CVE-2016-10228.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-26T00:00:00.000Z
CVE-2020-27619 
In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-22T00:00:00.000Z
CVE-2020-27620 
The Cosmos Skin for MediaWiki through 1.35.0 has stored XSS because MediaWiki messages were not being properly escaped. This is related to wfMessage and Html::rawElement, as demonstrated by CosmosSocialProfile::getUserGroups.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-22T03:05:10.000Z
CVE-2020-27621 
The FileImporter extension in MediaWiki through 1.35.0 was not properly attributing various user actions to a specific user's IP address. Instead, for various actions, it would report the IP address of an internal Wikimedia Foundation server by omitting X-Forwarded-For data. This resulted in an inability to properly audit and attribute various user actions performed via the FileImporter extension.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-22T03:04:57.000Z
CVE-2020-27622 
In JetBrains IntelliJ IDEA before 2020.2, the built-in web server could expose information about the IDE version.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-16T15:11:25.000Z
CVE-2020-27623 
JetBrains IdeaVim before version 0.58 might have caused an information leak in limited circumstances.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-16T15:12:05.000Z
CVE-2020-27624 
JetBrains YouTrack before 2020.3.888 was vulnerable to SSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-16T14:59:42.000Z
CVE-2020-27625 
In JetBrains YouTrack before 2020.3.888, notifications might have mentioned inaccessible issues.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-16T14:59:02.000Z
CVE-2020-27626 
JetBrains YouTrack before 2020.3.5333 was vulnerable to SSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-16T14:58:33.000Z
CVE-2020-27627 
JetBrains TeamCity before 2020.1.2 was vulnerable to URL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-16T15:08:17.000Z
CVE-2020-27628 
In JetBrains TeamCity before 2020.1.5, the Guest user had access to audit records.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-16T15:02:28.000Z
CVE-2020-27629 
In JetBrains TeamCity before 2020.1.5, secure dependency parameters could be not masked in depending builds when there are no internal artifacts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-16T15:01:52.000Z
CVE-2020-27630 
In Silicon Labs uC/TCP-IP 3.6.0, TCP ISNs are improperly random.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-10T00:00:00.000Z
CVE-2020-27631 
In Oryx CycloneTCP 1.9.6, TCP ISNs are improperly random.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-10T00:00:00.000Z
CVE-2020-27632 
In SIMATIC MV400 family versions prior to v7.0.6, the ISN generator is initialized with a constant value and has constant increments. An attacker could predict and hijack TCP sessions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-03-10T00:00:00.000Z
CVE-2020-27633 
In FNET 4.6.3, TCP ISNs are improperly random.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-10T00:00:00.000Z
CVE-2020-27634 
In Contiki 4.5, TCP ISNs are improperly random.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-10T00:00:00.000Z
CVE-2020-27635 
In PicoTCP 1.7.0, TCP ISNs are improperly random.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-10T00:00:00.000Z
CVE-2020-27636 
In Microchip MPLAB Net 3.6.1, TCP ISNs are improperly random.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-10-10T00:00:00.000Z
CVE-2020-27637 
The R programming language’s default package manager CRAN is affected by a path traversal vulnerability that can lead to server compromise. This vulnerability affects packages installed via the R CMD install cli command or the install.packages() function from the interpreter. Update to version 4.0.3
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-12T00:00:00.000Z
CVE-2020-27638 
receive.c in fastd before v21 allows denial of service (assertion failure) when receiving packets with an invalid type code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-22T12:27:04.000Z
CVE-2020-27639 
The Bluetooth handset of Mitel MiVoice 6873i, 6930, and 6940 SIP phones with firmware before 5.1.0.SP6 could allow an unauthenticated attacker within Bluetooth range to pair a rogue Bluetooth device when a phone handset loses connection, due to an improper pairing mechanism. A successful exploit could allow an attacker to eavesdrop on conversations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-18T07:17:52.000Z
CVE-2020-27640 
The Bluetooth handset of Mitel MiVoice 6940 and 6930 MiNet phones with firmware before 1.5.3 could allow an unauthenticated attacker within Bluetooth range to pair a rogue Bluetooth device when a phone handset loses connection, due to an improper pairing mechanism. A successful exploit could allow an attacker to eavesdrop on conversations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-18T07:19:04.000Z
CVE-2020-27642 
A cross-site scripting (XSS) vulnerability exists in the 'merge account' functionality in admins.js in BigBlueButton Greenlight 2.7.6.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-22T12:56:56.000Z
CVE-2020-27643 
The %PROGRAMDATA%\1E\Client directory in 1E Client 5.0.0.745 and 4.1.0.267 allows remote authenticated users and local users to create and modify files in protected directories (where they would not normally have access to create or modify files) via the creation of a junction point to a system directory. This leads to partial privilege escalation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-29T20:08:52.000Z
CVE-2020-27644 
The Inventory module of the 1E Client 5.0.0.745 doesn't handle an unquoted path when executing %PROGRAMFILES%\1E\Client\Tachyon.Performance.Metrics.exe. This may allow remote authenticated users and local users to gain elevated privileges by placing a malicious cryptbase.dll file in %WINDIR%\Temp\.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-29T20:10:36.000Z
CVE-2020-27645 
The Inventory module of the 1E Client 5.0.0.745 doesn't handle an unquoted path when executing %PROGRAMFILES%\1E\Client\Tachyon.Performance.Metrics.exe. This may allow remote authenticated users and local users to gain elevated privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-29T20:12:02.000Z
CVE-2020-27646 
Biscom Secure File Transfer (SFT) before 5.1.1082 and 6.x before 6.0.1011 allows user credential theft.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-22T13:27:29.000Z
CVE-2020-27648 
Improper certificate validation vulnerability in OpenVPN client in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: cwe_id: CWE-295
description: CWE-295: Improper Certificate Validation
Affected products: vendor: Synology
product: DiskStation Manager (DSM)
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Published: 2020-10-29T09:00:25.133Z
CVE-2020-27649 
Improper certificate validation vulnerability in OpenVPN client in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Problem types: cwe_id: CWE-295
description: CWE-295: Improper Certificate Validation
Affected products: vendor: Synology
product: Synology Router Manager (SRM)
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Published: 2020-10-29T08:55:20.493Z
CVE-2020-27650 
Synology DiskStation Manager (DSM) before 6.2.3-25426-2 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session.
Problem types: cwe_id: CWE-614
description: CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Affected products: vendor: Synology
product: DiskStation Manager (DSM)
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Published: 2020-10-29T09:00:25.555Z
CVE-2020-27651 
Synology Router Manager (SRM) before 1.2.4-8081 does not set the Secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session.
Problem types: cwe_id: CWE-614
description: CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Affected products: vendor: Synology
product: Synology Router Manager (SRM)
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Published: 2020-10-29T08:55:20.903Z
CVE-2020-27652 
Algorithm downgrade vulnerability in QuickConnect in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via unspecified vectors.
Problem types: cwe_id: CWE-327
description: CWE-327: Use of a Broken or Risky Cryptographic Algorithm
Affected products: vendor: Synology
product: DiskStation Manager (DSM)
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Published: 2020-10-29T09:00:26.029Z
CVE-2020-27653 
Algorithm downgrade vulnerability in QuickConnect in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via unspecified vectors.
Problem types: cwe_id: CWE-327
description: CWE-327: Use of a Broken or Risky Cryptographic Algorithm
Affected products: vendor: Synology
product: Synology Router Manager (SRM)
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Published: 2020-10-29T08:55:21.316Z
CVE-2020-27654 
Improper access control vulnerability in lbd in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to execute arbitrary commands via port (1) 7786/tcp or (2) 7787/tcp.
Problem types: cwe_id: CWE-269
description: CWE-269: Improper Privilege Management
Affected products: vendor: Synology
product: Synology Router Manager (SRM)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2020-10-29T08:55:21.725Z
CVE-2020-27655 
Improper access control vulnerability in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to access restricted resources via inbound QuickConnect traffic.
Problem types: cwe_id: CWE-269
description: CWE-269: Improper Privilege Management
Affected products: vendor: Synology
product: Synology Router Manager (SRM)
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
version: 3.1
Published: 2020-10-29T08:55:22.192Z
CVE-2020-27656 
Cleartext transmission of sensitive information vulnerability in DDNS in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to eavesdrop authentication information of DNSExit via unspecified vectors.
Problem types: cwe_id: CWE-319
description: CWE-319: Cleartext Transmission of Sensitive Information
Affected products: vendor: Synology
product: DiskStation Manager (DSM)
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
version: 3.1
Published: 2020-10-29T09:00:26.440Z
CVE-2020-27657 
Cleartext transmission of sensitive information vulnerability in DDNS in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to eavesdrop authentication information of DNSExit via unspecified vectors.
Problem types: cwe_id: CWE-319
description: CWE-319: Cleartext Transmission of Sensitive Information
Affected products: vendor: Synology
product: Synology Router Manager (SRM)
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
version: 3.1
Published: 2020-10-29T08:55:22.868Z
CVE-2020-27658 
Synology Router Manager (SRM) before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
Problem types: cwe_id: CWE-1004
description: CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag
Affected products: vendor: Synology
product: Synology Router Manager (SRM)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Published: 2020-10-29T08:55:23.280Z
CVE-2020-27659 
Multiple cross-site scripting (XSS) vulnerabilities in Synology SafeAccess before 1.2.3-0234 allow remote attackers to inject arbitrary web script or HTML via the (1) domain or (2) profile parameter.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Synology
product: Safe Access
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Published: 2020-11-30T09:30:15.481Z
CVE-2020-27660 
SQL injection vulnerability in request.cgi in Synology SafeAccess before 1.2.3-0234 allows remote attackers to execute arbitrary SQL commands via the domain parameter.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Synology
product: Safe Access
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 9.6
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2020-11-30T09:30:15.887Z
CVE-2020-27661 
A divide-by-zero issue was found in dwc2_handle_packet in hw/usb/hcd-dwc2.c in the hcd-dwc2 USB host controller emulation of QEMU. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-02T15:25:19.000Z
CVE-2020-27662 
In GLPI before 9.5.3, ajax/comments.php has an Insecure Direct Object Reference (IDOR) vulnerability that allows an attacker to read data from any database table (e.g., glpi_tickets, glpi_users, etc.).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-26T16:46:53.000Z
CVE-2020-27663 
In GLPI before 9.5.3, ajax/getDropdownValue.php has an Insecure Direct Object Reference (IDOR) vulnerability that allows an attacker to read data from any itemType (e.g., Ticket, Users, etc.).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-26T16:49:03.000Z
CVE-2020-27664 
admin/src/containers/InputModalStepperProvider/index.js in Strapi before 3.2.5 has unwanted /proxy?url= functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-22T18:19:44.000Z