CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-22682
https://notcve.org/view.php?id=CVE-2022-22682
Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Event Management in Synology Calendar before 2.4.5-10930 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. Una neutralización inapropiada de la entrada durante la generación de páginas web ("Cross-site Scripting") es una vulnerabilidad en la administración de eventos en Synology Calendar versiones anteriores a 2.4.5-10930, que permite a usuarios remotos autenticados inyectar scripts web o HTML arbitrarios por medio de vectores no especificados • https://www.synology.com/security/advisory/Synology_SA_22_07 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 3.3EPSS: 0%CPEs: 1EXPL: 0CVE-2022-33705
https://notcve.org/view.php?id=CVE-2022-33705
Information exposure in Calendar prior to version 12.3.05.10000 allows attacker to access calendar schedule without READ_CALENDAR permission. Una exposición de información en Calendar versiones anteriores a 12.3.05.10000, permite a un atacante acceder a la programación del calendario sin el permiso READ_CALENDAR • https://security.samsungmobile.com/serviceWeb.smsb?year==2022&month=07 • CWE-285: Improper Authorization •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-24838 – Command Injection in Appointment Emails for Nextcloud Calendar
https://notcve.org/view.php?id=CVE-2022-24838
Nextcloud Calendar is a calendar application for the nextcloud framework. SMTP Command Injection in Appointment Emails via Newlines: as newlines and special characters are not sanitized in the email value in the JSON request, a malicious attacker can inject newlines to break out of the `RCPT TO:<BOOKING USER'S EMAIL> ` SMTP command and begin injecting arbitrary SMTP commands. It is recommended that Calendar is upgraded to 3.2.2. There are no workaround available. Nextcloud Calendar es una aplicación de calendario para el framework nextcloud. • https://github.com/nextcloud/calendar/commit/7b70edfb8a0fcf0926f613ababcbd56c6ecd9f35 https://github.com/nextcloud/calendar/pull/4073 https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8xv5-4855-24qf • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-34812
https://notcve.org/view.php?id=CVE-2021-34812
Use of hard-coded credentials vulnerability in php component in Synology Calendar before 2.4.0-0761 allows remote attackers to obtain sensitive information via unspecified vectors. La vulnerabilidad del uso de credenciales codificadas en el componente php de Synology Calendar anterior a la versión 2.4.0-0761 permite a los atacantes remotos obtener información confidencial a través de vectores no especificados • https://www.synology.com/security/advisory/Synology_SA_21_12 • CWE-798: Use of Hard-coded Credentials •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-11829
https://notcve.org/view.php?id=CVE-2019-11829
OS command injection vulnerability in drivers_syno_import_user.php in Synology Calendar before 2.3.1-0617 allows remote attackers to execute arbitrary commands via the crafted 'X-Real-IP' header. Una vulnerabilidad de inyección de comandos del sistema operativo en el archivo drivers_syno_import_user.php en Synology Calendar anterior a versión 2.3.1-0617, permite a los atacantes remotos ejecutar comandos arbitrarios por medio del encabezado “X-Real-IP” creado. • https://www.synology.com/security/advisory/Synology_SA_19_12 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •