Export limit exceeded: 398992 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 398992 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 398992 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (42613 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2020-25283 | 1 Google | 1 Android | 2024-11-21 | 9.8 Critical |
| An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9.0, and 10 software. BT manager allows attackers to bypass intended access restrictions on a certain mode. The LG ID is LVE-SMP-200021 (September 2020). | ||||
| CVE-2020-25282 | 1 Google | 1 Android | 2024-11-21 | 9.8 Critical |
| An issue was discovered on LG mobile devices with Android OS 10 software. The lguicc software (for the LG Universal Integrated Circuit Card) allows attackers to bypass intended access restrictions on property values. The LG ID is LVE-SMP-200020 (September 2020). | ||||
| CVE-2020-25273 | 1 Online Bus Booking System Project | 1 Online Bus Booking System | 2024-11-21 | 9.8 Critical |
| In SourceCodester Online Bus Booking System 1.0, there is Authentication bypass on the Admin Login screen in admin.php via username or password SQL injection. | ||||
| CVE-2020-25268 | 1 Ilias | 1 Ilias | 2024-11-21 | 8.8 High |
| Remote Code Execution can occur via the external news feed in ILIAS 6.4 because of incorrect parameter sanitization for Magpie RSS data. | ||||
| CVE-2020-25254 | 1 Hyland | 1 Onbase | 2024-11-21 | 9.8 Critical |
| An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. It allows SQL injection, as demonstrated by TestConnection_LocalOrLinkedServer, CreateFilterFriendlyView, or AddWorkViewLinkedServer. | ||||
| CVE-2020-25253 | 1 Hyland | 1 Onbase | 2024-11-21 | 9.8 Critical |
| An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. It allows SQL injection, as demonstrated by the TableName, ColumnName, Name, UserId, or Password parameter. | ||||
| CVE-2020-25240 | 1 Siemens | 1 Sinema Remote Connect Server | 2024-11-21 | 8.8 High |
| A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0). Unpriviledged users can access services when guessing the url. An attacker could impact availability, integrity and gain information from logs and templates of the service. | ||||
| CVE-2020-25239 | 1 Siemens | 1 Sinema Remote Connect Server | 2024-11-21 | 8.8 High |
| A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0). The webserver could allow unauthorized actions via special urls for unpriviledged users. The settings of the UMC authorization server could be changed to add a rogue server by an attacker authenticating with unprivilege user rights. | ||||
| CVE-2020-25157 | 1 Advantech | 1 R-seenet | 2024-11-21 | 7.5 High |
| The R-SeeNet webpage (1.5.1 through 2.4.10) suffers from SQL injection, which allows a remote attacker to invoke queries on the database and retrieve sensitive information. | ||||
| CVE-2020-25147 | 1 Observium | 1 Observium | 2024-11-21 | 9.8 Critical |
| An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to SQL Injection due to the fact that it is possible to inject malicious SQL statements in malformed parameter types. This can occur via username[0] to the default URI, because of includes/authenticate.inc.php. | ||||
| CVE-2020-25143 | 1 Observium | 1 Observium | 2024-11-21 | 8.8 High |
| An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to SQL Injection due to the fact that it is possible to inject malicious SQL statements in malformed parameter types. This can occur via /ajax/device_entities.php?entity_type=netscalervsvr&device_id[]= because of /ajax/device_entities.php. | ||||
| CVE-2020-25132 | 1 Observium | 1 Observium | 2024-11-21 | 9.8 Critical |
| An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to SQL Injection due to the fact that it is possible to inject malicious SQL statements in malformed parameter types. Sending the improper variable type Array allows a bypass of core SQL Injection sanitization. Users are able to inject malicious statements in multiple functions. This vulnerability leads to full authentication bypass: any unauthorized user with access to the application is able to exploit this vulnerability. This can occur via the Cookie header to the default URI, within includes/authenticate.inc.php. | ||||
| CVE-2020-25130 | 1 Observium | 1 Observium | 2024-11-21 | 6.5 Medium |
| An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to SQL Injection due to the fact that it is possible to inject malicious SQL statements in malformed parameter types. Sending an improper variable type of Array allows a bypass of core SQL Injection sanitization. Authenticated users are able to inject malicious SQL queries. This vulnerability leads to full database leak including ckeys that can be used in the authentication process without knowing the username and cleartext password. This can occur via the ajax/actions.php group_id field. | ||||
| CVE-2020-25055 | 1 Google | 1 Android | 2024-11-21 | 9.8 Critical |
| An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. The persona service allows attackers (who control an unprivileged SecureFolder process) to bypass admin restrictions in KnoxContainer. The Samsung ID is SVE-2020-18133 (August 2020). | ||||
| CVE-2020-25034 | 1 Fireeye | 2 Email Malware Protection System, Ex 3500 | 2024-11-21 | 6.5 Medium |
| eMPS prior to eMPS 9.0 FireEye EX 3500 devices allows remote authenticated users to conduct SQL injection attacks via the sort, sort_by, search{URL], or search[attachment] parameter to the email search feature. | ||||
| CVE-2020-25025 | 1 Localization Manager Project | 1 Localization Manager | 2024-11-21 | 4.3 Medium |
| The l10nmgr (aka Localization Manager) extension before 7.4.0, 8.x before 8.7.0, and 9.x before 9.2.0 for TYPO3 allows Information Disclosure (translatable fields). | ||||
| CVE-2020-25016 | 1 Rgb-rust Project | 1 Rgb-rust | 2024-11-21 | 9.1 Critical |
| A safety violation was discovered in the rgb crate before 0.8.20 for Rust, leading to (for example) dereferencing of arbitrary pointers or disclosure of uninitialized memory. This occurs because structs can be treated as bytes for read and write operations. | ||||
| CVE-2020-25006 | 1 Heybbs Project | 1 Heybbs | 2024-11-21 | 9.8 Critical |
| Heybbs v1.2 has a SQL injection vulnerability in login.php file via the username parameter which may allow a remote attacker to execute arbitrary code. | ||||
| CVE-2020-25005 | 1 Heybbs Project | 1 Heybbs | 2024-11-21 | 9.8 Critical |
| Heybbs v1.2 has a SQL injection vulnerability in msg.php file via the ID parameter which may allow a remote attacker to execute arbitrary code. | ||||
| CVE-2020-25004 | 1 Heybbs Project | 1 Heybbs | 2024-11-21 | 9.8 Critical |
| Heybbs v1.2 has a SQL injection vulnerability in user.php file via the ID parameter which may allow a remote attacker to execute arbitrary code. | ||||