rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-10934 
Acyba AcyMailing before 6.9.2 mishandles file uploads by admins.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-24T14:55:03.000Z
CVE-2020-10935 
Zulip Server before 2.1.3 allows XSS via a Markdown link, with resultant account takeover.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-20T19:47:17.000Z
CVE-2020-10936 
Sympa before 6.2.56 allows privilege escalation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-27T17:38:01.000Z
CVE-2020-10937 
An issue was discovered in IPFS (aka go-ipfs) 0.4.23. An attacker can generate ephemeral identities (Sybils) and leverage the IPFS connection management reputation system to poison other nodes' routing tables, eclipsing the nodes that are the target of the attack from the rest of the network. Later versions, in particular go-ipfs 0.7, mitigate this.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-02T16:53:10.000Z
CVE-2020-10938 
GraphicsMagick before 1.3.35 has an integer overflow and resultant heap-based buffer overflow in HuffmanDecodeImage in magick/compress.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-24T15:28:05.000Z
CVE-2020-10939 
Insecure, default path permissions in PHOENIX CONTACT PC WORX SRT through 1.14 allow for local privilege escalation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-27T19:57:07.000Z
CVE-2020-10940 
Local Privilege Escalation can occur in PHOENIX CONTACT PORTICO SERVER through 3.0.7 when installed to run as a service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-27T20:02:59.000Z
CVE-2020-10941 
Arm Mbed TLS before 2.16.5 allows attackers to obtain sensitive information (an RSA private key) by measuring cache usage during an import.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-24T00:00:00.000Z
CVE-2020-10942 
In the Linux kernel before 5.5.8, get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow attackers to trigger kernel stack corruption via crafted system calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-24T21:03:52.000Z
CVE-2020-10944 
HashiCorp Nomad and Nomad Enterprise up to 0.10.4 contained a cross-site scripting vulnerability such that files from a malicious workload could cause arbitrary JavaScript to execute in the web UI. Fixed in 0.10.5.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-28T13:29:50.000Z
CVE-2020-10945 
Centreon before 19.10.7 exposes Session IDs in server responses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-27T15:12:31.000Z
CVE-2020-10946 
Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the page parameter to service-monitoring/src/index.php. This vulnerability is fixed in versions 1.6.4, 18.10.3, 19.04.3, and 19.0.1 of the Centreon host-monitoring widget; 1.6.4, 18.10.5, 19.04.3, 19.10.2 of the Centreon service-monitoring widget; and 1.0.3, 18.10.1, 19.04.1, 19.10.1 of the Centreon tactical-overview widget.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-27T15:12:32.000Z
CVE-2020-10947 
Mac Endpoint for Sophos Central before 9.9.6 and Mac Endpoint for Sophos Home before 2.2.6 allow Privilege Escalation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-17T12:38:45.000Z
CVE-2020-10948 
Jon Hedley AlienForm2 (typically installed as af.cgi or alienform.cgi) 2.0.2 is vulnerable to Remote Command Execution via eval injection, a different issue than CVE-2002-0934. An unauthenticated, remote attacker can exploit this via a series of crafted requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-01T20:11:38.000Z
CVE-2020-10951 
Western Digital My Cloud Home and ibi devices before 2.2.0 allow clickjacking on sign-in pages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-15T19:48:38.000Z
CVE-2020-10952 
GitLab EE/CE 8.11 through 12.9.1 allows blocked users to pull/push docker images.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-27T18:55:16.000Z
CVE-2020-10953 
In GitLab EE 11.7 through 12.9, the NPM feature is vulnerable to a path traversal issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-27T18:52:05.000Z
CVE-2020-10954 
GitLab through 12.9 is affected by a potential DoS in repository archive download.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-27T18:50:15.000Z
CVE-2020-10955 
GitLab EE/CE 11.1 through 12.9 is vulnerable to parameter tampering on an upload feature that allows an unauthorized user to read content available under specific folders.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-27T18:48:49.000Z
CVE-2020-10956 
GitLab 8.10 and later through 12.9 is vulnerable to an SSRF in a project import note feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-27T18:25:52.000Z
CVE-2020-10957 
In Dovecot before 2.3.10.1, unauthenticated sending of malformed parameters to a NOOP command causes a NULL Pointer Dereference and crash in submission-login, submission, or lmtp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-18T13:56:25.000Z
CVE-2020-10958 
In Dovecot before 2.3.10.1, a crafted SMTP/LMTP message triggers an unauthenticated use-after-free bug in submission-login, submission, or lmtp, and can lead to a crash under circumstances involving many newlines after a command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-18T14:00:33.000Z
CVE-2020-10959 
resources/src/mediawiki.page.ready/ready.js in MediaWiki before 1.35 allows remote attackers to force a logout and external redirection via HTML content in a MediaWiki page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-02T13:52:22.000Z
CVE-2020-10960 
In MediaWiki before 1.34.1, users can add various Cascading Style Sheets (CSS) classes (which can affect what content is shown or hidden in the user interface) to arbitrary DOM nodes via HTML content within a MediaWiki page. This occurs because jquery.makeCollapsible allows applying an event handler to any Cascading Style Sheets (CSS) selector. There is no known way to exploit this for cross-site scripting (XSS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-03T14:13:52.000Z
CVE-2020-10962 
In PowerShell App Deployment Toolkit (aka PSAppDeployToolkit) through 3.8.0, an incorrect access control vulnerability in the default configuration may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-01T00:00:00.000Z
CVE-2020-10963 
FrozenNode Laravel-Administrator through 5.0.12 allows unrestricted file upload (and consequently Remote Code Execution) via admin/tips_image/image/file_upload image upload with PHP content within a GIF image that has the .php extension. NOTE: this product is discontinued.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-25T21:23:52.000Z
CVE-2020-10964 
Serendipity before 2.3.4 on Windows allows remote attackers to execute arbitrary code because the filename of a renamed file may end with a dot. This file may then be renamed to have a .php filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-25T21:53:01.000Z
CVE-2020-10965 
Teradici PCoIP Management Console 20.01.0 and 19.11.1 is vulnerable to unauthenticated password resets via login/resetadminpassword of the default admin account. This vulnerability only exists when the default admin account is not disabled. It is fixed in 20.01.1 and 19.11.2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-25T22:53:12.000Z
CVE-2020-10966 
In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account takeover because the victim receives a reset URL containing an attacker-controlled server name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-25T22:50:16.000Z
CVE-2020-10967 
In Dovecot before 2.3.10.1, remote unauthenticated attackers can crash the lmtp or submission process by sending mail with an empty localpart.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-18T14:02:55.000Z
CVE-2020-10968 
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-26T12:43:45.000Z
CVE-2020-10969 
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-26T12:43:34.000Z
CVE-2020-10971 
An issue was discovered on Wavlink Jetstream devices where a crafted POST request can be sent to adm.cgi that will result in the execution of the supplied command if there is an active session at the same time. The POST request itself is not validated to ensure it came from the active session. Affected devices are: Wavlink WN530HG4, Wavlink WN575A3, Wavlink WN579G3,Wavlink WN531G3, Wavlink WN533A8, Wavlink WN531A6, Wavlink WN551K1, Wavlink WN535G3, Wavlink WN530H4, Wavlink WN57X93, WN572HG3, Wavlink WN578A2, Wavlink WN579G3, Wavlink WN579X3, and Jetstream AC3000/ERAC3000
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-07T17:54:01.000Z
CVE-2020-10972 
An issue was discovered where a page is exposed that has the current administrator password in cleartext in the source code of the page. No authentication is required in order to reach the page (a certain live_?.shtml page with the variable syspasswd). Affected Devices: Wavlink WN530HG4, Wavlink WN531G3, and Wavlink WN572HG3
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-07T17:51:48.000Z
CVE-2020-10973 
An issue was discovered in Wavlink WN530HG4, Wavlink WN531G3, Wavlink WN533A8, and Wavlink WN551K1 affecting /cgi-bin/ExportAllSettings.sh where a crafted POST request returns the current configuration of the device, including the administrator password. No authentication is required. The attacker must perform a decryption step, but all decryption information is readily available.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-07T17:50:15.000Z
CVE-2020-10974 
An issue was discovered affecting a backup feature where a crafted POST request returns the current configuration of the device in cleartext, including the administrator password. No authentication is required. Affected devices: Wavlink WN575A3, Wavlink WN579G3, Wavlink WN531A6, Wavlink WN535G3, Wavlink WN530H4, Wavlink WN57X93, Wavlink WN572HG3, Wavlink WN575A4, Wavlink WN578A2, Wavlink WN579G3, Wavlink WN579X3, and Jetstream AC3000/ERAC3000
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-07T17:42:57.000Z
CVE-2020-10975 
GitLab EE/CE 10.8 to 12.9 is leaking metadata and comments on vulnerabilities to unauthorized users on the vulnerability feedback page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-08T18:11:48.000Z
CVE-2020-10976 
GitLab EE/CE 8.17 to 12.9 is vulnerable to information leakage when querying a merge request widget.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-08T18:10:59.000Z
CVE-2020-10977 
GitLab EE/CE 8.5 to 12.9 is vulnerable to a an path traversal when moving an issue between projects.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-08T18:09:59.000Z
CVE-2020-10978 
GitLab EE/CE 8.11 to 12.9 is leaking information on Issues opened in a public project and then moved to a private project through Web-UI and GraphQL API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-08T18:08:27.000Z
CVE-2020-10979 
GitLab EE/CE 11.10 to 12.9 is leaking information on restricted CI pipelines metrics to unauthorized users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-08T18:07:20.000Z
CVE-2020-10980 
GitLab EE/CE 8.0.rc1 to 12.9 is vulnerable to a blind SSRF in the FogBugz integration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-08T18:05:33.000Z
CVE-2020-10981 
GitLab EE/CE 9.0 to 12.9 allows a maintainer to modify other maintainers' pipeline trigger descriptions within the same project.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-08T18:04:33.000Z
CVE-2020-10982 
Gambio GX before 4.0.1.0 allows SQL Injection in admin/gv_mail.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-28T20:45:57.000Z
CVE-2020-10983 
Gambio GX before 4.0.1.0 allows SQL Injection in admin/mobile.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-28T20:44:36.000Z
CVE-2020-10984 
Gambio GX before 4.0.1.0 allows admin/admin.php CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-28T20:40:37.000Z
CVE-2020-10985 
Gambio GX before 4.0.1.0 allows XSS in admin/coupon_admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-28T20:36:59.000Z
CVE-2020-10986 
A CSRF issue in the /goform/SysToolReboot endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to reboot the device and cause denial of service via a payload hosted by an attacker-controlled web page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-13T17:59:19.000Z
CVE-2020-10987 
The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-13T18:46:12.000Z
CVE-2020-10988 
A hard-coded telnet credential in the tenda_login binary of Tenda AC15 AC1900 version 15.03.05.19 allows unauthenticated remote attackers to start a telnetd service on the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-13T18:01:55.000Z
CVE-2020-10989 
An XSS issue in the /goform/WifiBasicSet endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute malicious payloads via the WifiName POST parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-13T18:04:36.000Z
CVE-2020-10990 
An XXE issue exists in Accenture Mercury before 1.12.28 because of the platformlambda/core/serializers/SimpleXmlParser.java component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-26T23:42:28.000Z
CVE-2020-10991 
Mulesoft APIkit through 1.3.0 allows XXE because of validation/RestXmlSchemaValidator.java
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-26T23:42:13.000Z
CVE-2020-10992 
Azkaban through 3.84.0 allows XXE, related to validator/XmlValidatorManager.java and user/XmlUserManager.java.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-26T23:42:02.000Z
CVE-2020-10993 
Osmand through 2.0.0 allow XXE because of binary/BinaryMapIndexReader.java.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-26T23:41:53.000Z
CVE-2020-10994 
In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0, there are multiple out-of-bounds reads via a crafted JP2 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-25T18:26:30.000Z
CVE-2020-10995 
PowerDNS Recursor from 4.1.0 up to and including 4.3.0 does not sufficiently defend against amplification attacks. An issue in the DNS protocol has been found that allow malicious parties to use recursive DNS services to attack third party authoritative name servers. The attack uses a crafted reply by an authoritative name server to amplify the resulting traffic between the recursive and other authoritative name servers. Both types of service can suffer degraded performance as an effect. This is triggered by random subdomains in the NSDNAME in NS records. PowerDNS Recursor 4.1.16, 4.2.2 and 4.3.1 contain a mitigation to limit the impact of this DNS protocol issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-19T16:04:12.000Z
CVE-2020-10996 
An issue was discovered in Percona XtraDB Cluster before 5.7.28-31.41.2. A bundled script inadvertently sets a static transition_key for SST processes in place of the random key expected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-27T12:45:01.000Z
CVE-2020-10997 
Percona XtraBackup before 2.4.20 unintentionally writes the command line to any resulting backup file output. This may include sensitive arguments passed at run time. In addition, when --history is passed at run time, this command line is also written to the PERCONA_SCHEMA.xtrabackup_history table.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-27T12:38:25.000Z
CVE-2020-11000 Improper URL validation in GreenBrowser
GreenBrowser before version 1.2 has a vulnerability where apps that rely on URL Parsing to verify that a given URL is pointing to a trust server may be susceptible to many different ways to get URL parsing and verification wrong, which allows an attacker to circumvent the access control. This problem has been patched in version 1.2.
Problem types: cwe_id: CWE-939
description: CWE-939: Improper Authorization in Handler for Custom URL Scheme
Affected products: vendor: luchua-bc
product: GreenBrowser
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Published: 2020-04-08T16:30:15.000Z
CVE-2020-11001 Possible XSS attack in Wagtail
In Wagtail before versions 2.8.1 and 2.7.2, a cross-site scripting (XSS) vulnerability exists on the page revision
comparison view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail
admin could potentially craft a page revision history that, when viewed by a user with higher privileges, could perform
actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to
the Wagtail admin.

Patched versions have been released as Wagtail 2.7.2 (for the LTS 2.7 branch) and Wagtail 2.8.1 (for the current 2.8 branch).
Problem types: cwe_id: CWE-80
description: CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: wagtail
product: wagtail
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N
version: 3.1
Published: 2020-04-14T23:05:14.000Z
CVE-2020-11002 Remote Code Execution (RCE) vulnerability in dropwizard-validation
dropwizard-validation before versions 2.0.3 and 1.3.21 has a remote code execution vulnerability. A server-side template injection was identified in the self-validating feature enabling attackers to inject arbitrary Java EL expressions, leading to Remote Code Execution (RCE) vulnerability. If you are using a self-validating bean an upgrade to Dropwizard 1.3.21/2.0.3 or later is strongly recommended. The changes introduced in Dropwizard 1.3.19 and 2.0.2 for CVE-2020-5245 unfortunately did not fix the underlying issue completely. The issue has been fixed in dropwizard-validation 1.3.21 and 2.0.3 or later. We strongly recommend upgrading to one of these versions.
Problem types: cwe_id: CWE-74
description: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Affected products: vendor: dropwizard
product: dropwizard
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Published: 2020-04-10T18:35:18.000Z
CVE-2020-11003 CSRF and DNS Rebinding in Oasis
Oasis before version 2.15.0 has a potential DNS rebinding or CSRF vulnerability. If you're running a vulnerable application on your computer and an attacker can trick you into visiting a malicious website, they could use DNS rebinding and CSRF attacks to read/write to vulnerable applications. This has been patched in 2.15.0.
Problem types: cwe_id: CWE-352
description: CWE-352: Cross-Site Request Forgery (CSRF)
Affected products: vendor: fraction
product: oasis
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Published: 2020-04-14T23:10:12.000Z
CVE-2020-11004 SQL Injection in Admidio
SQL Injection was discovered in Admidio before version 3.3.13. The main cookie parameter is concatenated into a SQL query without any input validation/sanitization, thus an attacker without logging in, can send a GET request with arbitrary SQL queries appended to the cookie parameter and execute SQL queries. The vulnerability impacts the confidentiality of the system. This has been patched in version 3.3.13.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Admidio
product: admidio
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
version: 3.1
Published: 2020-04-24T20:25:14.000Z