Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (94090 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2020-9027 1 Eltex-co 4 Ntp-2, Ntp-2 Firmware, Ntp-rg-1402g and 1 more 2024-11-21 9.8 Critical
ELTEX NTP-RG-1402G 1v10 3.25.3.32 devices allow OS command injection via the TRACE field of the resource ping.cmd. The NTP-2 device is also affected.
CVE-2020-9026 1 Eltex-co 4 Ntp-2, Ntp-2 Firmware, Ntp-rg-1402g and 1 more 2024-11-21 9.8 Critical
ELTEX NTP-RG-1402G 1v10 3.25.3.32 devices allow OS command injection via the PING field of the resource ping.cmd. The NTP-2 device is also affected.
CVE-2020-9025 1 Iteris 2 Vantage Velocity, Vantage Velocity Firmware 2024-11-21 6.1 Medium
Iteris Vantage Velocity Field Unit 2.4.2 devices have multiple stored XSS issues in all parameters of the Start Data Viewer feature of the /cgi-bin/loaddata.py script.
CVE-2020-9024 1 Iteris 2 Vantage Velocity, Vantage Velocity Firmware 2024-11-21 9.8 Critical
Iteris Vantage Velocity Field Unit 2.3.1 and 2.4.2 devices have world-writable permissions for the /root/cleardata.pl (executed as root by crond) and /root/loadperl.sh (executed as root at boot time) scripts.
CVE-2020-9022 1 Cambiumnetworks 8 Xh2-120, Xh2-120 Firmware, Xr2436 and 5 more 2024-11-21 6.1 Medium
An issue was discovered on Xirrus XR520, XR620, XR2436, and XH2-120 devices. The cgi-bin/ViewPage.cgi user parameter allows XSS.
CVE-2020-9021 1 Postoaktraffic 2 Awam Bluetooth Field Device, Awam Bluetooth Field Device Firmware 2024-11-21 9.8 Critical
Post Oak AWAM Bluetooth Field Device 7400v2.08.21.2018, 7800SD.2015.1.16, 2011.3, 7400v2.02.01.2019, and 7800SD.2012.12.5 is vulnerable to injections of operating system commands through timeconfig.py via shell metacharacters in the htmlNtpServer parameter.
CVE-2020-9020 1 Iteris 2 Vantage Velocity, Vantage Velocity Firmware 2024-11-21 9.8 Critical
Iteris Vantage Velocity Field Unit 2.3.1, 2.4.2, and 3.0 devices allow the injection of OS commands into cgi-bin/timeconfig.py via shell metacharacters in the NTP Server field.
CVE-2020-9019 1 Wpjobboard 1 Wpjobboard 2024-11-21 6.1 Medium
The WPJobBoard plugin 5.5.3 for WordPress allows Persistent XSS via the Add Job form, as demonstrated by title and Description.
CVE-2020-9016 1 Dolibarr 1 Dolibarr Erp\/crm 2024-11-21 5.4 Medium
Dolibarr 11.0 allows XSS via the joinfiles, topic, or code parameter, or the HTTP Referer header.
CVE-2020-9012 1 Gluu 1 Gluu Server 2024-11-21 6.1 Medium
A cross-site scripting (XSS) vulnerability in the Import People functionality in Gluu Identity Configuration 4.0 allows remote attackers to inject arbitrary web script or HTML via the filename parameter.
CVE-2020-9008 1 Blackboard 1 Blackboard Learn 2024-11-21 5.4 Medium
Stored Cross-site scripting (XSS) vulnerability in Blackboard Learn/PeopleTool v9.1 allows users to inject arbitrary web script via the Tile widget in the People Tool profile editor.
CVE-2020-9007 1 Codologic 1 Codoforum 2024-11-21 5.4 Medium
Codoforum 4.8.8 allows self-XSS via the title of a new topic.
CVE-2020-9005 1 Valvesoftware 1 Dota 2 2024-11-21 7.8 High
meshsystem.dll in Valve Dota 2 through 2020-02-17 allows remote attackers to achieve code execution or denial of service by creating a gaming server with a crafted map, and inviting a victim to this server. A GetValue call is mishandled.
CVE-2020-8997 1 Abbott 2 Freestyle Libre, Freestyle Libre Firmware 2024-11-21 8.8 High
Older generation Abbott FreeStyle Libre sensors allow remote attackers within close proximity to enable write access to memory via a specific NFC unlock command. NOTE: The vulnerability is not present in the FreeStyle Libre 14-day in the U.S (announced in August 2018) and FreeStyle Libre 2 outside the U.S (announced in October 2018).
CVE-2020-8995 1 Bilanc 1 Bilanc 2024-11-21 9.8 Critical
Programi Bilanc Build 007 Release 014 31.01.2020 supplies a .exe file containing several hardcoded credentials to different servers that allow remote attackers to gain access to the complete infrastructure including the website, update server, and external issue tracking tools.
CVE-2020-8991 1 Redhat 1 Lvm2 2024-11-21 2.3 Low
vg_lookup in daemons/lvmetad/lvmetad-core.c in LVM2 2.02 mismanages memory, leading to an lvmetad memory leak, as demonstrated by running pvs. NOTE: RedHat disputes CVE-2020-8991 as not being a vulnerability since there’s no apparent route to either privilege escalation or to denial of service through the bug
CVE-2020-8986 1 Zend 1 Zendto 2024-11-21 9.8 Critical
lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta failed to properly check for equality when validating the session cookie, allowing an attacker to gain administrative access with a large number of requests.
CVE-2020-8985 1 Zend 1 Zendto 2024-11-21 8.8 High
ZendTo prior to 5.22-2 Beta allowed reflected XSS and CSRF via the unlock.tpl unlock user functionality.
CVE-2020-8981 1 Mantisbt 1 Source Integration 2024-11-21 6.1 Medium
A cross-site scripting (XSS) vulnerability was discovered in the Source Integration plugin before 1.6.2 and 2.x before 2.3.1 for MantisBT. The repo_delete.php Delete Repository page allows execution of arbitrary code via a repo name (if CSP settings permit it). This is related to CVE-2018-16362.
CVE-2020-8966 1 Tiki 1 Tikiwiki Cms\/groupware 2024-11-21 6.5 Medium
There is an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in php webpages of Tiki-Wiki Groupware. Tiki-Wiki CMS all versions through 20.0 allows malicious users to cause the injection of malicious code fragments (scripts) into a legitimate web page.