Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (359539 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2020-25507 1 3ds 1 Teamwork Cloud 2024-11-21 7.8 High
An incorrect permission assignment during the installation script of TeamworkCloud 18.0 thru 19.0 allows a local unprivileged attacker to execute arbitrary code as root. During installation, the user is instructed to set the system enviroment file with world writable permissions (0777 /etc/environment). Any local unprivileged user can execute arbitrary code simply by writing to /etc/environment, which will force all users, including root, to execute arbitrary code during the next login or reboot. In addition, the entire home directory of the twcloud user at /home/twcloud is recursively given world writable permissions. This allows any local unprivileged attacker to execute arbitrary code, as twcloud. This product was previous named Cameo Enterprise Data Warehouse (CEDW).
CVE-2020-25499 1 Totolink 26 A3002r, A3002r Firmware, A3002ru-v1 and 23 more 2024-11-21 8.8 High
TOTOLINK A3002RU-V2.0.0 B20190814.1034 allows authenticated remote users to modify the system's 'Run Command'. An attacker can use this functionality to execute arbitrary OS commands on the router.
CVE-2020-25498 1 Beetel 2 777vr1, 777vr1 Firmware 2024-11-21 4.8 Medium
Cross Site Scripting (XSS) vulnerability in Beetel router 777VR1 can be exploited via the NTP server name in System Time and "Keyword" in URL Filter.
CVE-2020-25495 1 Xinuos 1 Openserver 2024-11-21 6.1 Medium
A reflected Cross-site scripting (XSS) vulnerability in Xinuo (formerly SCO) Openserver version 5 and 6 allows remote attackers to inject arbitrary web script or HTML tag via the parameter 'section'.
CVE-2020-25494 1 Xinuos 1 Openserver 2024-11-21 9.8 Critical
Xinuos (formerly SCO) Openserver v5 and v6 allows attackers to execute arbitrary commands via shell metacharacters in outputform or toclevels parameter to cgi-bin/printbook.
CVE-2020-25493 1 Oclean 1 Oclean 2024-11-21 7.5 High
Oclean Mobile Application 2.1.2 communicates with an external website using HTTP so it is possible to eavesdrop the network traffic. The content of HTTP payload is encrypted using XOR with a hardcoded key, which allows for the possibility to decode the traffic.
CVE-2020-25491 1 6kare 1 Emakin 2024-11-21 6.1 Medium
6Kare Emakin 5.0.341.0 is affected by Cross Site Scripting (XSS) via the /rpc/membership/setProfile DisplayName field, which is mishandled when rendering the Activity Stream page.
CVE-2020-25490 1 Sqreen 1 Php Microagent 2024-11-21 7.3 High
Lack of cryptographic signature verification in the Sqreen PHP agent daemon before 1.16.0 makes it easier for remote attackers to inject rules for execution inside the virtual machine.
CVE-2020-25489 1 Sqreen 1 Python Mini Racer 2024-11-21 9.8 Critical
A heap overflow in Sqreen PyMiniRacer (aka Python Mini Racer) before 0.3.0 allows remote attackers to potentially exploit heap corruption.
CVE-2020-25487 1 Phpgurukul 1 Zoo Management System 2024-11-21 7.8 High
PHPGURUKUL Zoo Management System Using PHP and MySQL version 1.0 is affected by: SQL Injection via zms/animal-detail.php.
CVE-2020-25483 1 Ucms Project 1 Ucms 2024-11-21 9.8 Critical
An arbitrary command execution vulnerability exists in the fopen() function of file writes of UCMS v1.4.8, where an attacker can gain access to the server.
CVE-2020-25476 1 Liferay 1 Liferay Portal 2024-11-21 6.1 Medium
Liferay CMS Portal version 7.1.3 and 7.2.1 have a blind persistent cross-site scripting (XSS) vulnerability in the user name parameter to Calendar. An attacker can insert the malicious payload on the username, lastname or surname fields of its own profile, and the malicious payload will be injected and reflected in the calendar of the user who submitted the payload. An attacker could escalate its privileges in case an admin visits the calendar that injected the payload.
CVE-2020-25475 1 Newsscriptphp 1 News Script Php Pro 2024-11-21 9.8 Critical
SimplePHPscripts News Script PHP Pro 2.3 is affected by a SQL Injection via the id parameter in an editNews action.
CVE-2020-25474 1 Newsscriptphp 1 News Script Php Pro 2024-11-21 6.1 Medium
SimplePHPscripts News Script PHP Pro 2.3 is affected by a Cross Site Scripting (XSS) vulnerability via the editor_name parameter.
CVE-2020-25473 1 Newsscriptphp 1 News Script Php Pro 2024-11-21 6.5 Medium
SimplePHPscripts News Script PHP Pro 2.3 does not properly set the HttpOnly Flag from Session Cookies.
CVE-2020-25472 1 Newsscriptphp 1 News Script Php Pro 2024-11-21 6.5 Medium
SimplePHPscripts News Script PHP Pro 2.3 is affected by a Cross Site Request Forgery (CSRF) vulnerability, which allows attackers to add new users.
CVE-2020-25470 1 Antsword Project 1 Antsword 2024-11-21 6.1 Medium
AntSword 2.1.8.1 contains a cross-site scripting (XSS) vulnerability in the View Site funtion. When viewing an added site, an XSS payload can be injected in cookies view which can lead to remote code execution.
CVE-2020-25467 2 Debian, Long Range Zip Project 2 Debian Linux, Long Range Zip 2024-11-21 5.5 Medium
A null pointer dereference was discovered lzo_decompress_buf in stream.c in Irzip 0.621 which allows an attacker to cause a denial of service (DOS) via a crafted compressed file.
CVE-2020-25466 1 Crmeb 1 Crmeb 2024-11-21 9.8 Critical
A SSRF vulnerability exists in the downloadimage interface of CRMEB 3.0, which can remotely download arbitrary files on the server and remotely execute arbitrary code.
CVE-2020-25465 1 Moddable 1 Moddable 2024-11-21 7.5 High
Null Pointer Dereference. in xObjectBindingFromExpression at moddable/xs/sources/xsSyntaxical.c:3419 in Moddable SDK before OS200908 causes a denial of service (SEGV).