Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (2746 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2020-26214 1 Alerta Project 1 Alerta 2024-11-21 9.1 Critical
In Alerta before version 8.1.0, users may be able to bypass LDAP authentication if they provide an empty password when Alerta server is configure to use LDAP as the authorization provider. Only deployments where LDAP servers are configured to allow unauthenticated authentication mechanism for anonymous authorization are affected. A fix has been implemented in version 8.1.0 that returns HTTP 401 Unauthorized response for any authentication attempts where the password field is empty. As a workaround LDAP administrators can disallow unauthenticated bind requests by clients.
CVE-2020-26124 1 Openmediavault 1 Openmediavault 2024-11-21 8.8 High
openmediavault before 4.1.36 and 5.x before 5.5.12 allows authenticated PHP code injection attacks, via the sortfield POST parameter of rpc.php, because json_encode_safe is not used in config/databasebackend.inc. Successful exploitation allows arbitrary command execution on the underlying operating system as root.
CVE-2020-25540 1 Thinkadmin 1 Thinkadmin 2024-11-21 7.5 High
ThinkAdmin v6 is affected by a directory traversal vulnerability. An unauthorized attacker can read arbitrarily file on a remote server via GET request encode parameter.
CVE-2020-24949 1 Php-fusion 1 Php-fusion 2024-11-21 8.8 High
Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a crafted request to the server and perform remote command execution (RCE).
CVE-2020-24881 1 Osticket 1 Osticket 2024-11-21 9.8 Critical
SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning.
CVE-2020-24589 1 Wso2 2 Api Manager, Api Microgateway 2024-11-21 9.1 Critical
The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML External Entity injection (XXE) attacks.
CVE-2020-24581 1 Dlink 2 Dsl2888a, Dsl2888a Firmware 2024-11-21 8.0 High
An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. It contains an execute_cmd.cgi feature (that is not reachable via the web user interface) that lets an authenticated user execute Operating System commands.
CVE-2020-24579 1 Dlink 2 Dsl2888a, Dsl2888a Firmware 2024-11-21 8.8 High
An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. An unauthenticated attacker could bypass authentication to access authenticated pages and functionality.
CVE-2020-24571 1 Nexusdb 1 Nexusdb 2024-11-21 7.5 High
NexusQA NexusDB before 4.50.23 allows the reading of files via ../ directory traversal.
CVE-2020-24391 1 Mongo-express Project 1 Mongo-express 2024-11-21 9.8 Critical
mongo-express before 1.0.0 offers support for certain advanced syntax but implements this in an unsafe way. NOTE: this may overlap CVE-2019-10769.
CVE-2020-24186 1 Gvectors 1 Wpdiscuz 2024-11-21 10 Critical
A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthenticated users to upload any type of file, including PHP files via the wmuUploadFiles AJAX action.
CVE-2020-24148 1 Mooveagency 1 Import Xml And Rss Feeds 2024-11-21 9.1 Critical
Server-side request forgery (SSRF) in the Import XML and RSS Feeds (import-xml-feed) plugin 2.0.1 for WordPress via the data parameter in a moove_read_xml action.
CVE-2020-23575 1 Kyocera 2 D-copia253mf Plus, D-copia253mf Plus Firmware 2024-11-21 7.5 High
A directory traversal vulnerability exists in Kyocera Printer d-COPIA253MF plus. Successful exploitation of this vulnerability could allow an attacker to retrieve or view arbitrary files from the affected server.
CVE-2020-21224 1 Inspur 1 Clusterengine 2024-11-21 9.8 Critical
A Remote Code Execution vulnerability has been found in Inspur ClusterEngine V4.0. A remote attacker can send a malicious login packet to the control server
CVE-2020-1957 2 Apache, Debian 2 Shiro, Debian Linux 2024-11-21 9.8 Critical
Apache Shiro before 1.5.2, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass.
CVE-2020-1947 1 Apache 1 Shardingsphere 2024-11-21 9.8 Critical
In Apache ShardingSphere(incubator) 4.0.0-RC3 and 4.0.0, the ShardingSphere's web console uses the SnakeYAML library for parsing YAML inputs to load datasource configuration. SnakeYAML allows to unmarshal data to a Java type By using the YAML tag. Unmarshalling untrusted data can lead to security flaws of RCE.
CVE-2020-1943 1 Apache 1 Ofbiz 2024-11-21 6.1 Medium
Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07.
CVE-2020-1313 1 Microsoft 2 Windows 10, Windows Server 2016 2024-11-21 7.8 High
An elevation of privilege vulnerability exists when the Windows Update Orchestrator Service improperly handles file operations, aka 'Windows Update Orchestrator Service Elevation of Privilege Vulnerability'.
CVE-2020-19625 1 Gridx Project 1 Gridx 2024-11-21 9.8 Critical
Remote Code Execution Vulnerability in tests/support/stores/test_grid_filter.php in oria gridx 1.3, allows remote attackers to execute arbitrary code, via crafted value to the $query parameter.
CVE-2020-19360 1 Fhem 1 Fhem 2024-11-21 7.5 High
Local file inclusion in FHEM 6.0 allows in fhem/FileLog_logWrapper file parameter can allow an attacker to include a file, which can lead to sensitive information disclosure.