Export limit exceeded: 418341 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 418341 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 94040 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (94040 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2020-8090 1 A1 2 Wlan Box Adb Vv2220, Wlan Box Adb Vv2220 Firmware 2024-11-21 4.8 Medium
The Username field in the Storage Service settings of A1 WLAN Box ADB VV2220v2 devices allows stored XSS (after a successful Administrator login).
CVE-2020-8089 1 Piwigo 1 Piwigo 2024-11-21 5.4 Medium
Piwigo 2.10.1 is affected by stored XSS via the Group Name Field to the group_list page.
CVE-2020-8037 5 Apple, Debian, Fedoraproject and 2 more 6 Mac Os X, Macos, Debian Linux and 3 more 2024-11-21 7.5 High
The ppp decapsulator in tcpdump 4.9.3 can be convinced to allocate a large amount of memory.
CVE-2020-8035 1 Horde 1 Groupware 2024-11-21 6.1 Medium
The image view functionality in Horde Groupware Webmail Edition before 5.2.22 is affected by a stored Cross-Site Scripting (XSS) vulnerability via an SVG image upload containing a JavaScript payload. An attacker can obtain access to a victim's webmail account by making them visit a malicious URL.
CVE-2020-8034 1 Horde 2 Gollem, Groupware 2024-11-21 6.1 Medium
Gollem before 3.0.13, as used in Horde Groupware Webmail Edition 5.2.22 and other products, is affected by a reflected Cross-Site Scripting (XSS) vulnerability via the HTTP GET dir parameter in the browser functionality, affecting breadcrumb output. An attacker can obtain access to a victim's webmail account by making them visit a malicious URL.
CVE-2020-8033 1 Commscope 2 Ruckus Zoneflex R500, Ruckus Zoneflex R500 Firmware 2024-11-21 6.1 Medium
Ruckus R500 3.4.2.0.384 devices allow XSS via the index.asp Device Name field.
CVE-2020-8031 1 Opensuse 1 Open Build Service 2024-11-21 6.3 Medium
A Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Open Build Service allows remote attackers to store JS code in markdown that is not properly escaped, impacting confidentiality and integrity. This issue affects: Open Build Service versions prior to 2.10.8.
CVE-2020-8029 1 Suse 1 Caas Platform 2024-11-21 2.9 Low
A Incorrect Permission Assignment for Critical Resource vulnerability in skuba of SUSE CaaS Platform 4.5 allows local attackers to gain access to the kublet key. This issue affects: SUSE CaaS Platform 4.5 skuba versions prior to https://github.com/SUSE/skuba/pull/1416.
CVE-2020-8020 2 Debian, Opensuse 2 Debian Linux, Open Build Service 2024-11-21 6.5 Medium
A Improper Neutralization of Input During Web Page Generation vulnerability in open-build-service allows remote attackers to store arbitrary JS code to cause XSS. This issue affects: openSUSE open-build-service versions prior to 7cc32c8e2ff7290698e101d9a80a9dc29a5500fb.
CVE-2020-8001 1 Intelliantech 1 Aptus 2024-11-21 9.8 Critical
The Intellian Aptus application 1.0.2 for Android has a hardcoded password of intellian for the masteruser FTP account.
CVE-2020-8000 1 Intelliantech 1 Aptus Web 2024-11-21 9.8 Critical
Intellian Aptus Web 1.24 has a hardcoded password of 12345678 for the intellian account.
CVE-2020-7999 1 Intelliantech 1 Aptus 2024-11-21 9.8 Critical
The Intellian Aptus application 1.0.2 for Android has hardcoded values for DOWNLOAD_API_KEY and FILE_DOWNLOAD_API_KEY.
CVE-2020-7997 1 Asus 2 Rt-ac66u, Rt-ac66u Firmware 2024-11-21 6.1 Medium
ASUS WRT-AC66U 3 RT 3.0.0.4.372_67 devices allow XSS via the Client Name field to the Parental Control feature.
CVE-2020-7996 1 Dolibarr 1 Dolibarr Erp\/crm 2024-11-21 6.1 Medium
htdocs/user/passwordforgotten.php in Dolibarr 10.0.6 allows XSS via the Referer HTTP header.
CVE-2020-7994 1 Dolibarr 1 Dolibarr Erp\/crm 2024-11-21 6.1 Medium
Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 10.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) label[libelle] parameter to the /htdocs/admin/dict.php?id=3 page; the (2) name[constname] parameter to the /htdocs/admin/const.php?mainmenu=home page; the (3) note[note] parameter to the /htdocs/admin/dict.php?id=10 page; the (4) zip[MAIN_INFO_SOCIETE_ZIP] or email[mail] parameter to the /htdocs/admin/company.php page; the (5) url[defaulturl], field[defaultkey], or value[defaultvalue] parameter to the /htdocs/admin/defaultvalues.php page; the (6) key[transkey] or key[transvalue] parameter to the /htdocs/admin/translation.php page; or the (7) [main_motd] or [main_home] parameter to the /htdocs/admin/ihm.php page.
CVE-2020-7990 1 Adive 1 Framework 2024-11-21 6.1 Medium
Adive Framework 2.0.8 has admin/user/add userName XSS.
CVE-2020-7989 1 Adive 1 Framework 2024-11-21 6.1 Medium
Adive Framework 2.0.8 has admin/user/add userUsername XSS.
CVE-2020-7982 1 Openwrt 2 Lede, Openwrt 2024-11-21 8.1 High
An issue was discovered in OpenWrt 18.06.0 to 18.06.6 and 19.07.0, and LEDE 17.01.0 to 17.01.7. A bug in the fork of the opkg package manager before 2020-01-25 prevents correct parsing of embedded checksums in the signed repository index, allowing a man-in-the-middle attacker to inject arbitrary package payloads (which are installed without verification).
CVE-2020-7980 1 Intelliantech 1 Aptus Web 2024-11-21 9.8 Critical
Intellian Aptus Web 1.24 allows remote attackers to execute arbitrary OS commands via the Q field within JSON data to the cgi-bin/libagent.cgi URI. NOTE: a valid sid cookie for a login to the intellian default account might be needed.
CVE-2020-7973 1 Gitlab 1 Gitlab 2024-11-21 6.1 Medium
GitLab through 12.7.2 allows XSS.