rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-27665 
In Strapi before 3.2.5, there is no admin::hasPermissions restriction for CTB (aka content-type-builder) routes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-22T18:19:31.000Z
CVE-2020-27666 
Strapi before 3.2.5 has stored XSS in the wysiwyg editor's preview feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-22T18:19:19.000Z
CVE-2020-27670 
An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a denial of service (data corruption), cause a data leak, or possibly gain privileges because an AMD IOMMU page-table entry can be half-updated.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-22T20:34:22.000Z
CVE-2020-27671 
An issue was discovered in Xen through 4.14.x allowing x86 HVM and PVH guest OS users to cause a denial of service (data corruption), cause a data leak, or possibly gain privileges because coalescing of per-page IOMMU TLB flushes is mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-22T20:34:07.000Z
CVE-2020-27672 
An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a host OS denial of service, achieve data corruption, or possibly gain privileges by exploiting a race condition that leads to a use-after-free involving 2MiB and 1GiB superpages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-22T20:33:53.000Z
CVE-2020-27673 
An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. Guest OS users can cause a denial of service (host OS hang) via a high rate of events to dom0, aka CID-e99502f76271.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-22T20:33:26.000Z
CVE-2020-27674 
An issue was discovered in Xen through 4.14.x allowing x86 PV guest OS users to gain guest OS privileges by modifying kernel memory contents, because invalidation of TLB entries is mishandled during use of an INVLPG-like attack technique.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-22T20:33:07.000Z
CVE-2020-27675 
An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. drivers/xen/events/events_base.c allows event-channel removal during the event-handling loop (a race condition). This can cause a use-after-free or NULL pointer dereference, as demonstrated by a dom0 crash via events for an in-reconfiguration paravirtualized device, aka CID-073d0552ead5.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-22T20:32:49.000Z
CVE-2020-27678 
An issue was discovered in illumos before 2020-10-22, as used in OmniOS before r151030by, r151032ay, and r151034y and SmartOS before 20201022. There is a buffer overflow in parse_user_name in lib/libpam/pam_framework.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-23T20:25:17.000Z
CVE-2020-27687 
ThingsBoard before v3.2 is vulnerable to Host header injection in password-reset emails. This allows an attacker to send malicious links in password-reset emails to victims, pointing to an attacker-controlled server. Lack of validation of the Host header allows this to happen.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-18T18:27:23.000Z
CVE-2020-27688 
RVToolsPasswordEncryption.exe in RVTools 4.0.6 allows users to encrypt passwords to be used in the configuration files. This encryption used a static IV and key, and thus using the Decrypt() method from VISKD.cs from the RVTools.exe executable allows for decrypting the encrypted passwords. The accounts used in the configuration files have access to vSphere instances.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-05T14:59:51.000Z
CVE-2020-27689 
The Relish (Verve Connect) VH510 device with firmware before 1.0.1.6L0516 contains undocumented default admin credentials for the web management interface. A remote attacker could exploit this vulnerability to login and execute commands on the device, as well as upgrade the firmware image to a malicious version.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-04T20:01:38.000Z
CVE-2020-27690 
The Relish (Verve Connect) VH510 device with firmware before 1.0.1.6L0516 contains a buffer overflow within its web management portal. When a POST request is sent to /boaform/admin/formDOMAINBLK with a large blkDomain value, the Boa server crashes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-04T20:06:49.000Z
CVE-2020-27691 
The Relish (Verve Connect) VH510 device with firmware before 1.0.1.6L0516 allows XSS via URLBlocking Settings, SNMP Settings, and System Log Settings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-04T20:10:48.000Z
CVE-2020-27692 
The Relish (Verve Connect) VH510 device with firmware before 1.0.1.6L0516 contains multiple CSRF vulnerabilities within its web management portal. Attackers can, for example, use this to update the TR-069 configuration server settings (responsible for managing devices remotely). This makes it possible to remotely reboot the device or upload malicious firmware.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-04T20:14:21.000Z
CVE-2020-27693 
Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 stores administrative passwords using a hash that is considered outdated.
Problem types: description: Insufficient Password Storage
Affected products: vendor: Trend Micro
product: Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA)
Published: 2020-11-09T23:10:35.000Z
CVE-2020-27694 
Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 has updated a specific critical library that may vulnerable to attack.
Problem types: description: Outdated Library
Affected products: vendor: Trend Micro
product: Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA)
Published: 2020-11-09T23:10:35.000Z
CVE-2020-27695 
Trend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that could be exploited by placing a malicious DLL in a local directory which can lead to obtaining administrative privileges during the installation of the product.
Problem types: description: Local Privilege Escalation
Affected products: vendor: Trend Micro
product: Trend Micro Security (Consumer)
Published: 2020-11-18T18:45:37.000Z
CVE-2020-27696 
Trend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that could be exploited by placing a specific Windows system directory which can lead to obtaining administrative privileges during the installation of the product.
Problem types: description: Local Privilege Escalation
Affected products: vendor: Trend Micro
product: Trend Micro Security (Consumer)
Published: 2020-11-18T18:45:37.000Z
CVE-2020-27697 
Trend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that could be exploited by placing a malicious DLL in a non-protected location with high privileges (symlink attack) which can lead to obtaining administrative privileges during the installation of the product.
Problem types: description: Local Privilege Escalation
Affected products: vendor: Trend Micro
product: Trend Micro Security (Consumer)
Published: 2020-11-18T18:45:38.000Z
CVE-2020-27708 
A vulnerability exists in the Origin Client that could allow a non-Administrative user to elevate their access to either Administrator or System. Once the user has obtained elevated access, they may be able to take control of the system and perform actions otherwise reserved for high privileged users or system Administrators.
Problem types: description: Elevation of Privilege
Affected products: vendor: n/a
product: Origin
Published: 2020-10-30T16:23:56.000Z
CVE-2020-27713 
In certain configurations on version 13.1.3.4, when a BIG-IP AFM HTTP security profile is applied to a virtual server and the BIG-IP system receives a request with specific characteristics, the connection is reset and the Traffic Management Microkernel (TMM) leaks memory.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-12-11T19:00:15.000Z
CVE-2020-27714 
On the BIG-IP AFM version 15.1.0-15.1.0.5, 14.1.0-14.1.3, and 13.1.0-13.1.3.5, when a Protocol Inspection Profile is attached to a FastL4 virtual server with the protocol field configured to either Other or All Protocols, the TMM may experience a restart if the profile processes non-TCP traffic.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP AFM
Published: 2020-12-24T15:10:43.000Z
CVE-2020-27715 
On BIG-IP 15.1.0-15.1.0.5 and 14.1.0-14.1.3, crafted TLS request to the BIG-IP management interface via port 443 can cause high (~100%) CPU utilization by the httpd daemon.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-12-24T15:07:51.000Z
CVE-2020-27716 
On versions 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.5, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, when a BIG-IP APM virtual server processes traffic of an undisclosed nature, the Traffic Management Microkernel (TMM) stops responding and restarts.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP APM
Published: 2020-12-24T15:06:46.000Z
CVE-2020-27717 
On BIG-IP DNS 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.4, and 12.1.0-12.1.5.2, undisclosed series of DNS requests may cause TMM to restart and generate a core file.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP DNS
Published: 2020-12-24T15:11:59.000Z
CVE-2020-27718 
When a BIG-IP ASM or Advanced WAF system running version 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, or 11.6.1-11.6.5.2 processes requests with JSON payload, an unusually large number of parameters can cause excessive CPU usage in the BIG-IP ASM bd process.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP ASM & Advanced WAF
Published: 2020-12-24T14:57:33.000Z
CVE-2020-27719 
On BIG-IP 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.3, a cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility.
Problem types: description: XSS
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-12-24T15:16:36.000Z
CVE-2020-27720 
On BIG-IP LTM/CGNAT version 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, and 13.1.0-13.1.3.5, when processing NAT66 traffic with Port Block Allocation (PBA) mode and SP-DAG enabled, and dag-ipv6-prefix-len configured with a value less than the default of 128, an undisclosed traffic pattern may cause the Traffic Management Microkernel (TMM) to restart.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP LTM/CGNAT
Published: 2020-12-24T15:15:03.000Z
CVE-2020-27721 
In versions 16.0.0-16.0.0.1, 15.1.0-15.1.1, 14.1.0-14.1.3, 13.1.0-13.1.3.5, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, in a BIG-IP DNS / BIG-IP LTM GSLB deployment, under certain circumstances, the BIG-IP DNS system may stop using a BIG-IP LTM virtual server for DNS response.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP GTM & DNS
Published: 2020-12-24T14:52:59.000Z
CVE-2020-27722 
In BIG-IP APM versions 15.0.0-15.0.1.3, 14.1.0-14.1.3, and 13.1.0-13.1.3.4, under certain conditions, the VDI plugin does not observe plugin flow-control protocol causing excessive resource consumption.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP APM
Published: 2020-12-24T15:13:24.000Z
CVE-2020-27723 
In versions 14.1.0-14.1.3 and 13.1.0-13.1.3.4, a BIG-IP APM virtual server processing PingAccess requests may lead to a restart of the Traffic Management Microkernel (TMM) process.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP APM
Published: 2020-12-24T15:09:19.000Z
CVE-2020-27724 
In BIG-IP APM versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.4, 15.0.0-15.0.1.3, 14.1.0-14.1.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, on systems running more than one TMM instance, authenticated VPN users may consume excessive resources by sending specially-crafted malicious traffic over the tunnel.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP APM
Published: 2020-12-24T15:00:27.000Z
CVE-2020-27725 
In version 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2 of BIG-IP DNS, GTM, and Link Controller, zxfrd leaks memory when listing DNS zones. Zones can be listed via TMSH, iControl or SNMP; only users with access to those services can trigger this vulnerability.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP DNS, GTM, and Link Controller
Published: 2020-12-24T15:01:46.000Z
CVE-2020-27726 
In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.4, and 12.1.0-12.1.5.2, a reflected cross-site scripting (XSS) vulnerability exists in the resource information page for authenticated users when a full webtop is configured on the BIG-IP APM system.
Problem types: description: XSS
Affected products: vendor: n/a
product: BIG-IP APM
Published: 2020-12-24T15:05:03.000Z
CVE-2020-27727 
On BIG-IP version 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, and 13.1.0-13.1.3.4, when an authenticated administrative user installs RPMs using the iAppsLX REST installer, the BIG-IP system does not sufficiently validate user input, allowing the user read access to the filesystem.
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: BIG-IP
Published: 2020-12-24T15:03:09.000Z
CVE-2020-27728 
On BIG-IP ASM & Advanced WAF versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.3, under certain conditions, Analytics, Visibility, and Reporting daemon (AVRD) may generate a core file and restart on the BIG-IP system when processing requests sent from mobile devices.
Problem types: description: DoS
Affected products: vendor: n/a
product: BIG-IP ASM & Advanced WAF
Published: 2020-12-24T15:33:32.000Z
CVE-2020-27729 
In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, an undisclosed link on the BIG-IP APM virtual server allows a malicious user to build an open redirect URI.
Problem types: description: Malicious redirect
Affected products: vendor: n/a
product: BIG-IP APM
Published: 2020-12-24T15:17:55.000Z
CVE-2020-27730 
In versions 3.0.0-3.9.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller Agent does not use absolute paths when calling system utilities.
Problem types: description: privilege escalation
Affected products: vendor: n/a
product: NGINX Controller
Published: 2020-12-11T19:03:21.000Z
CVE-2020-27733 
Zoho ManageEngine Applications Manager before 14 build 14880 allows an authenticated SQL Injection via a crafted Alarmview request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-19T15:53:26.000Z
CVE-2020-27735 
An XSS issue was discovered in Wing FTP 6.4.4. An arbitrary IFRAME element can be included in the help pages via a crafted link, leading to the execution of (sandboxed) arbitrary HTML and JavaScript in the user's browser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-20T22:56:37.000Z
CVE-2020-27736 
A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.20), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.3), Nucleus ReadyStart V4 (All versions < V4.1.0), Nucleus Source Code (Versions including affected DNS modules), SIMOTICS CONNECT 400 (All versions < V0.5.0.0), TALON TC Compact (BACnet) (All versions < V3.5.5), TALON TC Modular (BACnet) (All versions < V3.5.5). The DNS domain name label parsing functionality does not properly validate the null-terminated name in DNS-responses. The parsing of malformed responses could result in a read past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to cause a denial-of-service condition or leak the read memory.
Problem types: cwe_id: CWE-170
description: CWE-170: Improper Null Termination
Affected products: vendor: Siemens
product: APOGEE PXC Compact (BACnet)
default_status: unknown
vendor: Siemens
product: APOGEE PXC Compact (P2 Ethernet)
default_status: unknown
vendor: Siemens
product: APOGEE PXC Modular (BACnet)
default_status: unknown
vendor: Siemens
product: APOGEE PXC Modular (P2 Ethernet)
default_status: unknown
vendor: Siemens
product: Nucleus NET
default_status: unknown
vendor: Siemens
product: Nucleus ReadyStart V3
default_status: unknown
vendor: Siemens
product: Nucleus ReadyStart V4
default_status: unknown
vendor: Siemens
product: Nucleus Source Code
default_status: unknown
vendor: Siemens
product: SIMOTICS CONNECT 400
default_status: unknown
vendor: Siemens
product: TALON TC Compact (BACnet)
default_status: unknown
vendor: Siemens
product: TALON TC Modular (BACnet)
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H/E:P/RL:O/RC:C
baseScore: 6.5
baseSeverity: MEDIUM
Published: 2021-04-22T20:42:19.000Z
CVE-2020-27737 
A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.20), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.3), Nucleus ReadyStart V4 (All versions < V4.1.0), Nucleus Source Code (Versions including affected DNS modules), SIMOTICS CONNECT 400 (All versions < V0.5.0.0), TALON TC Compact (BACnet) (All versions < V3.5.5), TALON TC Modular (BACnet) (All versions < V3.5.5). The DNS response parsing functionality does not properly validate various length and counts of the records. The parsing of malformed responses could result in a read past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to cause a denial-of-service condition  or leak the memory past the allocated structure.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: Siemens
product: APOGEE PXC Compact (BACnet)
default_status: unknown
vendor: Siemens
product: APOGEE PXC Compact (P2 Ethernet)
default_status: unknown
vendor: Siemens
product: APOGEE PXC Modular (BACnet)
default_status: unknown
vendor: Siemens
product: APOGEE PXC Modular (P2 Ethernet)
default_status: unknown
vendor: Siemens
product: Nucleus NET
default_status: unknown
vendor: Siemens
product: Nucleus ReadyStart V3
default_status: unknown
vendor: Siemens
product: Nucleus ReadyStart V4
default_status: unknown
vendor: Siemens
product: Nucleus Source Code
default_status: unknown
vendor: Siemens
product: SIMOTICS CONNECT 400
default_status: unknown
vendor: Siemens
product: TALON TC Compact (BACnet)
default_status: unknown
vendor: Siemens
product: TALON TC Modular (BACnet)
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H/E:P/RL:O/RC:C
baseScore: 6.5
baseSeverity: MEDIUM
Published: 2021-04-22T20:42:19.000Z
CVE-2020-27738 
A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.20), Nucleus NET (All versions), Nucleus ReadyStart V3 (All versions < V2017.02.3), Nucleus ReadyStart V4 (All versions < V4.1.0), Nucleus Source Code (Versions including affected DNS modules), SIMOTICS CONNECT 400 (All versions < V0.5.0.0), TALON TC Compact (BACnet) (All versions < V3.5.5), TALON TC Modular (BACnet) (All versions < V3.5.5). The DNS domain name record decompression functionality does not properly validate the pointer offset values. The parsing of malformed responses could result in a read access past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to cause a denial-of-service condition.
Problem types: cwe_id: CWE-788
description: CWE-788: Access of Memory Location After End of Buffer
Affected products: vendor: Siemens
product: APOGEE PXC Compact (BACnet)
default_status: unknown
vendor: Siemens
product: APOGEE PXC Compact (P2 Ethernet)
default_status: unknown
vendor: Siemens
product: APOGEE PXC Modular (BACnet)
default_status: unknown
vendor: Siemens
product: APOGEE PXC Modular (P2 Ethernet)
default_status: unknown
vendor: Siemens
product: Nucleus NET
default_status: unknown
vendor: Siemens
product: Nucleus ReadyStart V3
default_status: unknown
vendor: Siemens
product: Nucleus ReadyStart V4
default_status: unknown
vendor: Siemens
product: Nucleus Source Code
default_status: unknown
vendor: Siemens
product: SIMOTICS CONNECT 400
default_status: unknown
vendor: Siemens
product: TALON TC Compact (BACnet)
default_status: unknown
vendor: Siemens
product: TALON TC Modular (BACnet)
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H/E:P/RL:O/RC:C
baseScore: 6.5
baseSeverity: MEDIUM
Published: 2021-04-22T20:42:20.000Z
CVE-2020-27739 
A Weak Session Management vulnerability in Citadel WebCit through 926 allows unauthenticated remote attackers to hijack recently logged-in users' sessions. NOTE: this was reported to the vendor in a publicly archived "Multiple Security Vulnerabilities in WebCit 926" thread.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-28T18:44:39.000Z
CVE-2020-27740 
Citadel WebCit through 926 allows unauthenticated remote attackers to enumerate valid users within the platform. NOTE: this was reported to the vendor in a publicly archived "Multiple Security Vulnerabilities in WebCit 926" thread.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-28T18:44:30.000Z
CVE-2020-27741 
Multiple cross-site scripting (XSS) vulnerabilities in Citadel WebCit through 926 allow remote attackers to inject arbitrary web script or HTML via multiple pages and parameters. NOTE: this was reported to the vendor in a publicly archived "Multiple Security Vulnerabilities in WebCit 926" thread.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-28T18:44:34.000Z
CVE-2020-27742 
An Insecure Direct Object Reference vulnerability in Citadel WebCit through 926 allows authenticated remote attackers to read someone else's emails via the msg_confirm_move template. NOTE: this was reported to the vendor in a publicly archived "Multiple Security Vulnerabilities in WebCit 926" thread.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-28T18:44:36.000Z
CVE-2020-27743 
libtac in pam_tacplus through 1.5.1 lacks a check for a failure of RAND_bytes()/RAND_pseudo_bytes(). This could lead to use of a non-random/predictable session_id.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-26T21:40:19.000Z
CVE-2020-27744 
An issue was discovered on Western Digital My Cloud NAS devices before 5.04.114. They allow remote code execution with resultant escalation of privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-29T16:14:43.000Z
CVE-2020-27745 
Slurm before 19.05.8 and 20.x before 20.02.6 has an RPC Buffer Overflow in the PMIx MPI plugin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-27T17:01:00.000Z