Calendar
Vendor:
First CVE: Dec 8, 2017 · Active for 8 years
11
Total CVEs
More Total CVEs than 90% of tracked products
2.2
Avg CVEs / Year
Higher CVE frequency than 76% of tracked products
6.4
Avg CVSS
Higher Avg CVSS than 32% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Calendar over time
Volume of CVEsAvg CVSS Base Score
First CVE
Dec 8, 2017
8 years ago
Most Recent CVE
Aug 3, 2022
1,455 days ago
CVE Severity & Scoring
Calendar11 CVEs
73%
18%
9%
All CVEs353,240 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local1 (9.1%)
Network10 (90.9%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low11 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None7 (63.6%)
Unknown0 (0.0%)
Required4 (36.4%)
Privileges Required
Low9 (81.8%)
High0 (0.0%)
None2 (18.2%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (11 CVEs).
11 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2019-11829CRITICAL OS command injection vulnerability in drivers_syno_import_user.php in Synology Calendar before 2.3.1-0617 allows remote attackers to execute arbitrary commands via the crafted 'X-R | Jun 30, 2019 | 9.8 | 30 | NO | NO |
CVE-2022-22686HIGH Cross-Site Request Forgery (CSRF) vulnerability in webapi component in Synology Calendar before 2.3.4-0631 allows remote authenticated users to hijack the authentication of adminis | Jul 26, 2022 | 8.0 | 26 | NO | NO |
CVE-2021-34812HIGH Use of hard-coded credentials vulnerability in php component in Synology Calendar before 2.4.0-0761 allows remote attackers to obtain sensitive information via unspecified vectors. | Jun 18, 2021 | 7.5 | 23 | NO | NO |
CVE-2018-13299MEDIUM Relative path traversal vulnerability in Attachment Uploader in Synology Calendar before 2.2.2-0532 allows remote authenticated users to upload arbitrary files via the filename par | Apr 1, 2019 | 6.5 | 22 | NO | NO |
CVE-2017-15891MEDIUM Improper access control vulnerability in SYNO.Cal.EventBase in Synology Calendar before 2.0.1-0242 allows remote authenticated users to modify calendar event via unspecified vector | Dec 8, 2017 | 6.5 | 21 | NO | NO |
CVE-2019-11825MEDIUM Cross-site scripting (XSS) vulnerability in Event Editor in Synology Calendar before 2.3.0-0615 allows remote attackers to inject arbitrary web script or HTML via the title paramet | Jun 30, 2019 | 5.4 | 20 | NO | NO |
CVE-2019-11820MEDIUM Information exposure through process environment vulnerability in Synology Calendar before 2.3.3-0620 allows local users to obtain credentials via cmdline. | May 9, 2019 | 5.5 | 20 | NO | NO |
CVE-2018-8927MEDIUM Improper authorization vulnerability in SYNO.Cal.Event in Calendar before 2.1.2-0511 allows remote authenticated users to create arbitrary events via the (1) cal_id or (2) original | Jun 14, 2018 | 6.5 | 20 | NO | NO |
CVE-2018-8915MEDIUM Cross-site scripting (XSS) vulnerability in Notification Center in Synology Calendar before 2.1.1-0502 allows remote authenticated users to inject arbitrary web script or HTML via | May 10, 2018 | 5.4 | 19 | NO | NO |
CVE-2022-27617MEDIUM Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in webapi component in Synology Calendar before 2.3.4-0631 allows remote authenticated | Aug 3, 2022 | 4.3 | 18 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (11 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (11 CVEs).
Media Mentions
Signals from CVEs in this product scope (11 CVEs).
Top CNAs Publishing CVEs For Calendar
Top CWEs
Versions
No cataloged versions.