rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-11919 
An issue was discovered in Siime Eye 14.1.00000001.3.330.0.0.3.14. There is no CSRF protection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-07T00:00:00.000Z
CVE-2020-11920 
An issue was discovered in Svakom Siime Eye 14.1.00000001.3.330.0.0.3.14. A command injection vulnerability resides in the HOST/IP section of the NFS settings menu in the webserver running on the device. By injecting Bash commands via shell metacharacters here, the device executes arbitrary code with root privileges (all of the device's services are running as root).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-08T01:43:04.000Z
CVE-2020-11921 
An issue was discovered in Lush 2 through 2020-02-25. Due to the lack of Bluetooth traffic encryption, it is possible to hijack an ongoing Bluetooth connection between the Lush 2 and a mobile phone. This allows an attacker to gain full control over the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-07T00:00:00.000Z
CVE-2020-11922 
An issue was discovered in WiZ Colors A60 1.14.0. The device sends unnecessary information to the cloud controller server. Although this information is sent encrypted and has low risk in isolation, it decreases the privacy of the end user. The information sent includes the local IP address being used and the SSID of the Wi-Fi network the device is connected to. (Various resources such as wigle.net can be use for mapping of SSIDs to physical locations.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-02T15:47:01.000Z
CVE-2020-11923 
An issue was discovered in WiZ Colors A60 1.14.0. API credentials are locally logged.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-02T18:08:57.000Z
CVE-2020-11924 
An issue was discovered in WiZ Colors A60 1.14.0. Wi-Fi credentials are stored in cleartext in flash memory, which presents an information-disclosure risk for a discarded or resold device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-02T18:11:07.000Z
CVE-2020-11925 
An issue was discovered in Luvion Grand Elite 3 Connect through 2020-02-25. Authentication to the device is based on a username and password. The root credentials are the same across all devices of this model.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-02T15:41:46.000Z
CVE-2020-11926 
An issue was discovered in Luvion Grand Elite 3 Connect through 2020-02-25. Clients can authenticate themselves to the device using a username and password. These credentials can be obtained through an unauthenticated web request, e.g., for a JavaScript file. Also, the disclosed information includes the SSID and WPA2 key for the Wi-Fi network the device is connected to.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-07T00:00:00.000Z
CVE-2020-11928 
In the media-library-assistant plugin before 2.82 for WordPress, Remote Code Execution can occur via the tax_query, meta_query, or date_query parameter in mla_gallery via an admin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-19T23:16:50.000Z
CVE-2020-11930 
The GTranslate plugin before 2.8.52 for WordPress has Reflected XSS via a crafted link. This requires use of the hreflang tags feature within a sub-domain or sub-directory paid option.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-20T00:07:28.000Z
CVE-2020-11931 Ubuntu modifications to pulseaudio to provide snap security enforcement could be unloaded
An Ubuntu-specific modification to Pulseaudio to provide security mediation for Snap-packaged applications was found to have a bypass of intended access restriction for snaps which plugs any of pulseaudio, audio-playback or audio-record via unloading the pulseaudio snap policy module. This issue affects: pulseaudio 1:8.0 versions prior to 1:8.0-0ubuntu3.12; 1:11.1 versions prior to 1:11.1-1ubuntu7.7; 1:13.0 versions prior to 1:13.0-1ubuntu1.2; 1:13.99.1 versions prior to 1:13.99.1-1ubuntu3.2;
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Canonical
product: pulseaudio
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: James Henstridge
Published: 2020-05-15T03:25:11.587Z
CVE-2020-11932 Subiquity server installer logged LUKS full disk encryption password
It was discovered that the Subiquity installer for Ubuntu Server logged the LUKS full disk encryption password if one was entered.
Problem types: cwe_id: CWE-532
description: CWE-532 Information Exposure Through Log Files
Affected products: vendor: Canonical
product: Subiquity
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 2.3
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Moritz Naumann from Alice&Bob.Company GmbH
Published: 2020-05-13T00:20:13.011Z
CVE-2020-11933 local snapd exploit through cloud-init
cloud-init as managed by snapd on Ubuntu Core 16 and Ubuntu Core 18 devices was run without restrictions on every boot, which a physical attacker could exploit by crafting cloud-init user-data/meta-data via external media to perform arbitrary changes on the device to bypass intended security mechanisms such as full disk encryption. This issue did not affect traditional Ubuntu systems. Fixed in snapd version 2.45.2, revision 8539 and core version 2.45.2, revision 9659.
Problem types: cwe_id: CWE-264
description: CWE-264 Permissions, Privileges, and Access Controls
Affected products: vendor: Canonical
product: snapd
vendor: Canonical
product: core
CVSS v3.1: attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: NONE
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Ian Johnson
Published: 2020-07-29T16:25:25.690Z
CVE-2020-11934 Sandbox escape vulnerability via snapctl user-open (xdg-open)
It was discovered that snapctl user-open allowed altering the $XDG_DATA_DIRS environment variable when calling the system xdg-open. OpenURL() in usersession/userd/launcher.go would alter $XDG_DATA_DIRS to append a path to a directory controlled by the calling snap. A malicious snap could exploit this to bypass intended access restrictions to control how the host system xdg-open script opens the URL and, for example, execute a script shipped with the snap without confinement. This issue did not affect Ubuntu Core systems. Fixed in snapd versions 2.45.1ubuntu0.2, 2.45.1+18.04.2 and 2.45.1+20.04.2.
Problem types: description: Sandbox escape vulnerability
Affected products: vendor: Canonical
product: snapd
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
version: 3.1
Credits: lang: en
value: James Henstridge
Published: 2020-07-29T16:25:26.118Z
CVE-2020-11935 aufs: improperly managed inode reference counts in the vfsub_dentry_open() method
It was discovered that aufs improperly managed inode reference counts in the vfsub_dentry_open() method. A local attacker could use this vulnerability to cause a denial of service attack.
Problem types: cwe_id: CWE-911
description: CWE-911 Improper Update of Reference Count
Affected products: vendor: Ubuntu
product: Linux kernel (aufs filesystem module)
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 4.4
baseSeverity: MEDIUM
Credits: lang: en
value: Mauricio Faria de Oliveira discovered that the aufs implementation in the Linux kernel improperly managed inode reference counts in the vfsub_dentry_open() method. A local attacker could use this vulnerability to cause a denial of service.
Published: 2023-04-07T00:00:00.000Z
CVE-2020-11936 
gdbus setgid privilege escalation
Affected products: vendor: Canonical Ltd.
product: Apport
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseSeverity: LOW
baseScore: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Credits: lang: en
value: Ryota Shiga
Published: 2025-01-31T01:18:21.509Z
CVE-2020-11937 Resource exhaustion vulnerability in whoopsie
In whoopsie, parse_report() from whoopsie.c allows a local attacker to cause a denial of service via a crafted file. The DoS is caused by resource exhaustion due to a memory leak. Fixed in 0.2.52.5ubuntu0.5, 0.2.62ubuntu0.5 and 0.2.69ubuntu0.1.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: Canonical
product: whoopsie
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Seong-Joong Kim
Published: 2020-08-06T22:50:21.967Z
CVE-2020-11938 
In JetBrains TeamCity 2018.2 through 2019.2.1, a project administrator was able to see scrambled password parameters used in a project. The issue was resolved in 2019.2.2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-22T13:52:52.000Z
CVE-2020-11939 
In nDPI through 3.2 Stable, the SSH protocol dissector has multiple KEXINIT integer overflows that result in a controlled remote heap overflow in concat_hash_string in ssh.c. Due to the granular nature of the overflow primitive and the ability to control both the contents and layout of the nDPI library's heap memory through remote input, this vulnerability may be abused to achieve full Remote Code Execution against any network inspection stack that is linked against nDPI and uses it to perform network traffic analysis.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-23T14:18:36.000Z
CVE-2020-11940 
In nDPI through 3.2 Stable, an out-of-bounds read in concat_hash_string in ssh.c can be exploited by a network-positioned attacker that can send malformed SSH protocol messages on a network segment monitored by nDPI's library.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-23T14:20:31.000Z
CVE-2020-11941 
An issue was discovered in Open-AudIT 3.2.2. There is OS Command injection in Discovery.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-27T16:46:19.000Z
CVE-2020-11942 
An issue was discovered in Open-AudIT 3.2.2. There are Multiple SQL Injections.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-29T21:16:31.000Z
CVE-2020-11943 
An issue was discovered in Open-AudIT 3.2.2. There is Arbitrary file upload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-29T21:17:27.000Z
CVE-2020-11944 
Abe (aka bitcoin-abe) through 0.7.2, and 0.8pre, allows XSS in __call__ in abe.py because the PATH_INFO environment variable is mishandled during a PageNotFound exception.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-20T21:49:33.000Z
CVE-2020-11945 
An issue was discovered in Squid before 5.0.2. A remote attacker can replay a sniffed Digest Authentication nonce to gain access to resources that are otherwise forbidden. This occurs because the attacker can overflow the nonce reference counter (a short integer). Remote code execution may occur if the pooled token credentials are freed (instead of replayed as valid credentials).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-23T14:16:55.000Z
CVE-2020-11946 
Zoho ManageEngine OpManager before 125120 allows an unauthenticated user to retrieve an API key via a servlet call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-20T20:18:32.000Z
CVE-2020-11947 
iscsi_aio_ioctl_cb in block/iscsi.c in QEMU 4.1.0 has a heap-based buffer over-read that may disclose unrelated information from process memory to an attacker.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-12-31T00:13:30.000Z
CVE-2020-11949 
testserver.cgi of the web service on VIVOTEK Network Cameras before XXXXX-VVTK-2.2002.xx.01x (and before XXXXX-VVTK-0XXXX_Beta2) allows an authenticated user to obtain arbitrary files from a camera's local filesystem. For example, this affects IT9388-HT devices.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-28T12:43:32.000Z
CVE-2020-11950 
VIVOTEK Network Cameras before XXXXX-VVTK-2.2002.xx.01x (and before XXXXX-VVTK-0XXXX_Beta2) allows an authenticated user to upload and execute a script (with resultant execution of OS commands). For example, this affects IT9388-HT devices.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-28T12:44:36.000Z
CVE-2020-11951 
An issue was discovered on Rittal PDU-3C002DEC through 5.17.10 and CMCIII-PU-9333E0FB through 3.17.10 devices. There is a Backdoor root account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-14T13:00:40.000Z
CVE-2020-11952 
An issue was discovered on Rittal PDU-3C002DEC through 5.17.10 and CMCIII-PU-9333E0FB through 3.17.10 devices. Attackers can bypass the CLI menu.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-14T13:01:31.000Z
CVE-2020-11953 
An issue was discovered on Rittal PDU-3C002DEC through 5.15.40 and CMCIII-PU-9333E0FB through 3.15.70_4 devices. Attackers can execute code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-14T13:02:40.000Z
CVE-2020-11955 
An issue was discovered on Rittal PDU-3C002DEC through 5.15.70 and CMCIII-PU-9333E0FB through 3.15.70 devices. There are insecure permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-14T13:03:51.000Z
CVE-2020-11956 
An issue was discovered on Rittal PDU-3C002DEC through 5.17.10 and CMCIII-PU-9333E0FB through 3.17.10 devices. There is a least privilege violation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-14T13:05:39.000Z
CVE-2020-11957 
The Bluetooth Low Energy implementation in Cypress PSoC Creator BLE 4.2 component versions before 3.64 generates a random number (Pairing Random) with significantly less entropy than the specified 128 bits during BLE pairing. This is the case for both authenticated and unauthenticated pairing with both LE Secure Connections as well as LE Legacy Pairing. A predictable or brute-forceable random number allows an attacker (in radio range) to perform a MITM attack during BLE pairing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-09T18:26:54.000Z
CVE-2020-11958 
re2c 1.3 has a heap-based buffer overflow in Scanner::fill in parse/scanner.cc via a long lexeme.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-21T00:37:45.000Z
CVE-2020-11959 
An unsafe configuration of nginx lead to information leak in Xiaomi router R3600 ROM before 1.0.50.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-24T16:19:05.000Z
CVE-2020-11960 
Xiaomi router R3600 ROM before 1.0.50 is affected by a vulnerability when checking backup file in c_upload interface let attacker able to extract malicious file under any location in /tmp, lead to possible RCE and DoS
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-24T16:23:54.000Z
CVE-2020-11961 
Xiaomi router R3600 ROM before 1.0.50 is affected by a sensitive information leakage caused by an insecure interface get_config_result without authentication
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-24T16:28:06.000Z
CVE-2020-11963 
IQrouter through 3.3.1, when unconfigured, has multiple remote code execution vulnerabilities in the web-panel because of Bash Shell Metacharacter Injection. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration (which has a required step for setting a secure password on the system), makes this CVE invalid. This vulnerability is “true for any unconfigured release of OpenWRT, and true of many other new Linux distros prior to being configured for the first time”
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-21T12:04:45.000Z
CVE-2020-11964 
In IQrouter through 3.3.1, the Lua function diag_set_password in the web-panel allows remote attackers to change the root password arbitrarily. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration (which has a required step for setting a secure password on the system), makes this CVE invalid. This vulnerability is “true for any unconfigured release of OpenWRT, and true of many other new Linux distros prior to being configured for the first time”
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-21T12:05:27.000Z
CVE-2020-11965 
In IQrouter through 3.3.1, there is a root user without a password, which allows attackers to gain full remote access via SSH. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration (which has a required step for setting a secure password on the system), makes this CVE invalid. This vulnerability is “true for any unconfigured release of OpenWRT, and true of many other new Linux distros prior to being configured for the first time”
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-21T12:05:49.000Z
CVE-2020-11966 
In IQrouter through 3.3.1, the Lua function reset_password in the web-panel allows remote attackers to change the root password arbitrarily. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration (which has a required step for setting a secure password on the system), makes this CVE invalid. This vulnerability is “true for any unconfigured release of OpenWRT, and true of many other new Linux distros prior to being configured for the first time”
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-21T12:06:12.000Z
CVE-2020-11967 
In IQrouter through 3.3.1, remote attackers can control the device (restart network, reboot, upgrade, reset) because of Incorrect Access Control. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration (which has a required step for setting a secure password on the system), makes this CVE invalid. This vulnerability is “true for any unconfigured release of OpenWRT, and true of many other new Linux distros prior to being configured for the first time”
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-21T12:08:11.000Z
CVE-2020-11968 
In the web-panel in IQrouter through 3.3.1, remote attackers can read system logs because of Incorrect Access Control. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration (which has a required step for setting a secure password on the system), makes this CVE invalid. This vulnerability is “true for any unconfigured release of OpenWRT, and true of many other new Linux distros prior to being configured for the first time”
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-21T12:07:43.000Z
CVE-2020-11969 
If Apache TomEE is configured to use the embedded ActiveMQ broker, and the broker URI includes the useJMX=true parameter, a JMX port is opened on TCP port 1099, which does not include authentication. This affects Apache TomEE 8.0.0-M1 - 8.0.1, Apache TomEE 7.1.0 - 7.1.2, Apache TomEE 7.0.0-M1 - 7.0.7, Apache TomEE 1.0.0 - 1.7.5.
Problem types: description: Information Disclosure
Affected products: vendor: n/a
product: Apache TomEE
Published: 2020-06-15T19:03:49.000Z
CVE-2020-11971 
Apache Camel's JMX is vulnerable to Rebind Flaw. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.x, 3.0.0 up to 3.1.0 is affected. Users should upgrade to 3.2.0.
Problem types: description: Rebind Flaw
Affected products: vendor: n/a
product: Apache Camel
Published: 2020-05-14T16:18:41.000Z
CVE-2020-11972 
Apache Camel RabbitMQ enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.
Problem types: description: Java deserialization
Affected products: vendor: n/a
product: Apache Camel
Published: 2020-05-14T16:26:03.000Z
CVE-2020-11973 
Apache Camel Netty enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.
Problem types: description: Java deserialization
Affected products: vendor: n/a
product: Apache Camel
Published: 2020-05-14T16:22:23.000Z
CVE-2020-11974 
In DolphinScheduler 1.2.0 and 1.2.1, with mysql connectorj a remote code execution vulnerability exists when choosing mysql as database.
Problem types: description: Remote Code execution vulnerability
Affected products: vendor: n/a
product: Apache DolphinScheduler(Incubating)
Published: 2020-12-18T00:00:00.000Z
CVE-2020-11975 
Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process.
Problem types: description: Remote Code Execution
Affected products: vendor: n/a
product: Apache Unomi
Published: 2020-06-05T14:10:57.000Z
CVE-2020-11976 
By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker to see possibly sensitive information inside a HTML template that is usually removed during rendering. Affected are Apache Wicket versions 7.16.0, 8.8.0 and 9.0.0-M5
Problem types: description: Information Disclosure
Affected products: vendor: n/a
product: Apache Wicket
Published: 2020-08-11T18:15:51.000Z
CVE-2020-11977 
In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow entitlements can use Shell Service Tasks to perform malicious operations, including but not limited to file read, file write, and code execution.
Problem types: description: Apache Syncope: Remote Code Execution via Flowable workflow definition
Affected products: vendor: n/a
product: Apache Syncope
Published: 2020-09-15T19:02:51.000Z