Export limit exceeded: 418560 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (94097 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2020-9374 | 1 Tp-link | 2 Tl-wr849n, Tl-wr849n Firmware | 2024-11-21 | 9.8 Critical |
| On TP-Link TL-WR849N 0.9.1 4.16 devices, a remote command execution vulnerability in the diagnostics area can be exploited when an attacker sends specific shell metacharacters to the panel's traceroute feature. | ||||
| CVE-2020-9371 | 1 Codepeople | 1 Appointment Booking Calendar | 2024-11-21 | 4.8 Medium |
| Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress. In the cpabc_appointments.php file, the Calendar Name input could allow attackers to inject arbitrary JavaScript or HTML. | ||||
| CVE-2020-9366 | 1 Gnu | 1 Screen | 2024-11-21 | 9.8 Critical |
| A buffer overflow was found in the way GNU Screen before 4.8.0 treated the special escape OSC 49. Specially crafted output, or a special program, could corrupt memory and crash Screen or possibly have unspecified other impact. | ||||
| CVE-2020-9350 | 1 Sas | 1 Visual Analytics | 2024-11-21 | 5.4 Medium |
| Graph Builder in SAS Visual Analytics 8.5 allows XSS via a graph template that is accessed directly. | ||||
| CVE-2020-9345 | 2 Microsoft, Signotec | 2 Windows, Signopad-api\/web | 2024-11-21 | 6.5 Medium |
| An issue was discovered in signotec signoPAD-API/Web (formerly Websocket Pad Server) before 3.1.1 on Windows. It is possible to perform a Denial of Service attack because the application doesn't limit the number of opened WebSocket sockets. If a victim visits an attacker-controlled website, this vulnerability can be exploited. | ||||
| CVE-2020-9344 | 1 Atlassian | 1 Subversion Application Lifecycle Management | 2024-11-21 | 6.1 Medium |
| Subversion ALM for the enterprise before 8.8.2 allows reflected XSS at multiple locations. | ||||
| CVE-2020-9339 | 1 Soplanning | 1 Soplanning | 2024-11-21 | 5.4 Medium |
| SOPlanning 1.45 allows XSS via the Name or Comment to status.php. | ||||
| CVE-2020-9338 | 1 Soplanning | 1 Soplanning | 2024-11-21 | 5.4 Medium |
| SOPlanning 1.45 allows XSS via the "Your SoPlanning url" field. | ||||
| CVE-2020-9336 | 1 Fauzantrif Election Project | 1 Fauzantrif Election | 2024-11-21 | 5.4 Medium |
| fauzantrif eLection 2.0 has XSS via the Admin Dashboard -> Settings -> Election -> "message if election is closed" field. | ||||
| CVE-2020-9335 | 1 10web | 1 Photo Gallery | 2024-11-21 | 4.8 Medium |
| Multiple stored XSS vulnerabilities exist in the 10Web Photo Gallery plugin before 1.5.46 WordPress. Successful exploitation of this vulnerability would allow a authenticated admin user to inject arbitrary JavaScript code that is viewed by other users. | ||||
| CVE-2020-9334 | 1 Enviragallery | 1 Envira Gallery | 2024-11-21 | 5.4 Medium |
| A stored XSS vulnerability exists in the Envira Photo Gallery plugin through 1.7.6 for WordPress. Successful exploitation of this vulnerability would allow a authenticated low-privileged user to inject arbitrary JavaScript code that is viewed by other users. | ||||
| CVE-2020-9314 | 1 Oracle | 1 Iplanet Web Server | 2024-11-21 | 4.8 Medium |
| ** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** Oracle iPlanet Web Server 7.0.x allows image injection in the Administration console via the productNameSrc parameter to an admingui URI. This issue exists because of an incomplete fix for CVE-2012-0516. NOTE: a related support policy can be found in the www.oracle.com references attached to this CVE. | ||||
| CVE-2020-9311 | 1 Silverstripe | 1 Silverstripe | 2024-11-21 | 5.4 Medium |
| In SilverStripe through 4.5, malicious users with a valid Silverstripe CMS login (usually CMS access) can craft profile information which can lead to XSS for other users through specially crafted login form URLs. | ||||
| CVE-2020-9308 | 3 Canonical, Fedoraproject, Libarchive | 3 Ubuntu Linux, Fedora, Libarchive | 2024-11-21 | 8.8 High |
| archive_read_support_format_rar5.c in libarchive before 3.4.2 attempts to unpack a RAR5 file with an invalid or corrupted header (such as a header size of zero), leading to a SIGSEGV or possibly unspecified other impact. | ||||
| CVE-2020-9306 | 1 Tesla | 1 Solarcity Solar Monitoring Gateway | 2024-11-21 | 8.8 High |
| Tesla SolarCity Solar Monitoring Gateway through 5.46.43 has a "Use of Hard-coded Credentials" issue because Digi ConnectPort X2e uses a .pyc file to store the cleartext password for the python user account. | ||||
| CVE-2020-9299 | 1 Netflix | 1 Dispatch | 2024-11-21 | 5.4 Medium |
| There were XSS vulnerabilities discovered and reported in the Dispatch application, affecting name and description parameters of Incident Priority, Incident Type, Tag Type, and Incident Filter. This vulnerability can be exploited by an authenticated user. | ||||
| CVE-2020-9289 | 1 Fortinet | 2 Fortianalyzer, Fortimanager | 2024-11-21 | 7.5 High |
| Use of a hard-coded cryptographic key to encrypt password data in CLI configuration in FortiManager 6.2.3 and below, FortiAnalyzer 6.2.3 and below may allow an attacker with access to the CLI configuration or the CLI backup file to decrypt the sensitive data, via knowledge of the hard-coded key. | ||||
| CVE-2020-9288 | 1 Fortinet | 1 Fortiwlc | 2024-11-21 | 5.4 Medium |
| An improper neutralization of input vulnerability in FortiWLC 8.5.1 allows a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the ESS profile or the Radius Profile. | ||||
| CVE-2020-9279 | 1 Dlink | 2 Dsl-2640b, Dsl-2640b Firmware | 2024-11-21 | 9.8 Critical |
| An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devices. A hard-coded account allows management-interface login with high privileges. The logged-in user can perform critical tasks and take full control of the device. | ||||
| CVE-2020-9276 | 1 Dlink | 2 Dsl-2640b, Dsl-2640b Firmware | 2024-11-21 | 8.8 High |
| An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devices. The function do_cgi(), which processes cgi requests supplied to the device's web servers, is vulnerable to a remotely exploitable stack-based buffer overflow. Unauthenticated exploitation is possible by combining this vulnerability with CVE-2020-9277. | ||||