Export limit exceeded: 418308 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 418308 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 94033 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (94033 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2020-7735 | 1 Ng-packagr Project | 1 Ng-packagr | 2024-11-21 | 6.6 Medium |
| The package ng-packagr before 10.1.1 are vulnerable to Command Injection via the styleIncludePaths option. | ||||
| CVE-2020-7734 | 1 Arachnys | 1 Cabot | 2024-11-21 | 8.2 High |
| All versions of package cabot are vulnerable to Cross-site Scripting (XSS) via the Endpoint column. | ||||
| CVE-2020-7730 | 1 Bestzip Project | 1 Bestzip | 2024-11-21 | 9.8 Critical |
| The package bestzip before 2.1.7 are vulnerable to Command Injection via the options param. | ||||
| CVE-2020-7712 | 2 Joyent, Oracle | 5 Json, Commerce Guided Search, Financial Services Crime And Compliance Management Studio and 2 more | 2024-11-21 | 7.2 High |
| This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function. | ||||
| CVE-2020-7698 | 1 Gerapy | 1 Gerapy | 2024-11-21 | 8.1 High |
| This affects the package Gerapy from 0 and before 0.9.3. The input being passed to Popen, via the project_configure endpoint, isn’t being sanitized. | ||||
| CVE-2020-7697 | 1 Mock2easy Project | 1 Mock2easy | 2024-11-21 | 9.8 Critical |
| This affects all versions of package mock2easy. a malicious user could inject commands through the _data variable: Affected Area require('../server/getJsonByCurl')(mock2easy, function (error, stdout) { if (error) { return res.json(500, error); } res.json(JSON.parse(stdout)); }, '', _data.interfaceUrl, query, _data.cookie,_data.interfaceType); | ||||
| CVE-2020-7695 | 1 Encode | 1 Uvicorn | 2024-11-21 | 5.3 Medium |
| Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers. | ||||
| CVE-2020-7693 | 1 Sockjs Project | 1 Sockjs | 2024-11-21 | 5.3 Medium |
| Incorrect handling of Upgrade header with the value websocket leads in crashing of containers hosting sockjs apps. This affects the package sockjs before 0.3.20. | ||||
| CVE-2020-7691 | 1 Parall | 1 Jspdf | 2024-11-21 | 6.3 Medium |
| In all versions of the package jspdf, it is possible to use <<script>script> in order to go over the filtering regex. | ||||
| CVE-2020-7690 | 1 Parall | 1 Jspdf | 2024-11-21 | 6.1 Medium |
| All affected versions <2.0.0 of package jspdf are vulnerable to Cross-site Scripting (XSS). It is possible to inject JavaScript code via the html method. | ||||
| CVE-2020-7688 | 1 Mversion Project | 1 Mversion | 2024-11-21 | 8.4 High |
| The issue occurs because tagName user input is formatted inside the exec function is executed without any checks. | ||||
| CVE-2020-7680 | 1 Docsifyjs | 1 Docsify | 2024-11-21 | 6.1 Medium |
| docsify prior to 4.11.4 is susceptible to Cross-site Scripting (XSS). Docsify.js uses fragment identifiers (parameters after # sign) to load resources from server-side .md files. Due to lack of validation here, it is possible to provide external URLs after the /#/ (domain.com/#//attacker.com) and render arbitrary JavaScript/HTML inside docsify page. | ||||
| CVE-2020-7677 | 3 Debian, Fedoraproject, Thenify Project | 3 Debian Linux, Fedora, Thenify | 2024-11-21 | 8.6 High |
| This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provided to the eval function without any sanitization. | ||||
| CVE-2020-7656 | 5 Jquery, Juniper, Netapp and 2 more | 9 Jquery, Junos, Active Iq Unified Manager and 6 more | 2024-11-21 | 6.1 Medium |
| jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed. | ||||
| CVE-2020-7646 | 1 Curlrequest Project | 1 Curlrequest | 2024-11-21 | 9.8 Critical |
| curlrequest through 1.0.1 allows reading any file by populating the file parameter with user input. | ||||
| CVE-2020-7645 | 1 Google | 1 Chrome-launcher | 2024-11-21 | 9.8 Critical |
| All versions of chrome-launcher allow execution of arbitrary commands, by controlling the $HOME environment variable in Linux operating systems. | ||||
| CVE-2020-7642 | 1 Lazysizes Project | 1 Lazysizes | 2024-11-21 | 5.4 Medium |
| lazysizes through 5.2.0 allows execution of malicious JavaScript. The following attributes are not sanitized by the video-embed plugin: data-vimeo, data-vimeoparams, data-youtube and data-ytparams which can be abused to inject malicious JavaScript. | ||||
| CVE-2020-7640 | 1 Pixlcore | 1 Pixl-class | 2024-11-21 | 9.8 Critical |
| pixl-class prior to 1.0.3 allows execution of arbitrary commands. The members argument of the create function can be controlled by users without any sanitization. | ||||
| CVE-2020-7636 | 1 Adb-driver Project | 1 Adb-driver | 2024-11-21 | 9.8 Critical |
| adb-driver through 0.1.8 is vulnerable to Command Injection.It allows execution of arbitrary commands via the command function. | ||||
| CVE-2020-7635 | 1 Compass-compile Project | 1 Compass-compile | 2024-11-21 | 9.8 Critical |
| compass-compile through 0.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via tha options argument. | ||||