CVE-2020-35242

Flamingo (aka FlamingoIM) prior to 2020-09-29 contains a SQL injection in UserManager::updateUserTeamInfoInDbAndMemory. The CVE entry lists impacted product as Flamingo/FlamingoIM with a vulnerability that enables database/memory info manipulation via user-team info updates. From the initial data...

CVE-2020-35245

CVE-2020-35245 affects Flamingo (FlamingoIM) up to 2020-09-29 with a SQL injection vulnerability in UserManager::addUser. Documented risk scores: CVSS2 base 7.5 (HIGH) and CVSS3.1 base 9.8 (CRITICAL). Exploit details are not provided in the connected documents; no remediation or patch version is ...

CVE-2020-35243

Flamingo (aka FlamingoIM) through 2020-09-29 contains a SQL injection vulnerability in UserManager::updateUserInfoInDb. The CVE is supported by multiple sources (NVD entry and Red Hat PR) showing high/severe impact: CVSSv2 base 7.5 (Partial confidentiality/integrity/availability impact) and CVSSv...

CVE-2020-35244

The CVE-2020-35244 entry identifies Flamingo (aka FlamingoIM) as affected through 2020-09-29 due to a SQL injection in UserManager::addGroup. The connected records confirm the component and the underlying flaw (SQL injection), but do not provide a concrete list of affected versions, affected conf...