Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (356038 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2020-24872 1 Lepton-cms 1 Leptoncms 2024-11-21 6.1 Medium
Cross Site Scripting (XSS) vulnerability in backend/pages/modify.php in Lepton-CMS version 4.7.0, allows remote attackers to execute arbitrary code.
CVE-2020-24870 2 Libraw, Redhat 2 Libraw, Enterprise Linux 2024-11-21 8.8 High
Libraw before 0.20.1 has a stack buffer overflow via LibRaw::identify_process_dng_fields in identify.cpp.
CVE-2020-24863 2 Freebsd, Midnightbsd 2 Freebsd, Midnightbsd 2024-11-21 5.5 Medium
A memory corruption vulnerability was found in the kernel function kern_getfsstat in MidnightBSD before 1.2.7 and 1.3 through 2020-08-19, and FreeBSD through 11.4, that allows an attacker to trigger an invalid free and crash the system via a crafted size value in conjunction with an invalid mode.
CVE-2020-24862 1 Pharmacy Medical Store And Sale Point Project 1 Pharmacy Medical Store And Sale Point 2024-11-21 7.5 High
The catID parameter in Pharmacy Medical Store and Sale Point v1.0 has been found to be vulnerable to a Time-Based blind SQL injection via the /medical/inventories.php path which allows attackers to retrieve all databases.
CVE-2020-24861 1 Get-simple 1 Getsimple Cms 2024-11-21 5.4 Medium
GetSimple CMS 3.3.16 allows in parameter 'permalink' on the Settings page persistent Cross Site Scripting which is executed when you create and open a new page
CVE-2020-24860 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 5.4 Medium
CMS Made Simple 2.2.14 allows an authenticated user with access to the Content Manager to edit content and put persistent XSS payload in the affected text fields. The user can get cookies from every authenticated user who visits the website.
CVE-2020-24849 1 Fruitywifi Project 1 Fruitywifi 2024-11-21 8.8 High
A remote code execution vulnerability is identified in FruityWifi through 2.4. Due to improperly escaped shell metacharacters obtained from the POST request at the page_config_adv.php page, it is possible to perform remote code execution by an authenticated attacker. This is similar to CVE-2018-17317.
CVE-2020-24848 1 Fruitywifi Project 1 Fruitywifi 2024-11-21 7.8 High
FruityWifi through 2.4 has an unsafe Sudo configuration [(ALL : ALL) NOPASSWD: ALL]. This allows an attacker to perform a system-level (root) local privilege escalation, allowing an attacker to gain complete persistent access to the local system.
CVE-2020-24847 1 Fruitywifi Project 1 Fruitywifi 2024-11-21 4.3 Medium
A Cross-Site Request Forgery (CSRF) vulnerability is identified in FruityWifi through 2.4. Due to a lack of CSRF protection in page_config_adv.php, an unauthenticated attacker can lure the victim to visit his website by social engineering or another attack vector. Due to this issue, an unauthenticated attacker can change the newSSID and hostapd_wpa_passphrase.
CVE-2020-24842 1 Sdgc 1 Pnpscada 2024-11-21 6.1 Medium
PNPSCADA 2.200816204020 allows cross-site scripting (XSS), which can execute arbitrary JavaScript in the victim's browser.
CVE-2020-24841 1 Sdg 1 Pnpscada 2024-11-21 9.8 Critical
PNPSCADA 2.200816204020 allows SQL injection via parameter 'interf' in /browse.jsp. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
CVE-2020-24838 1 Issuer Project 1 Issuer 2024-11-21 7.5 High
An integer overflow has been found in the the latest version of Issuer. The total issuedCount can be zero if the parameter is overly large. An attacker can obtain the private key of the owner issued with a certain 'amount', and the issuedCount can be zero if there is an overflow.
CVE-2020-24837 1 Zcfees Project 1 Zcfees 2024-11-21 7.5 High
An integer underflow has been found in the latest version of ZCFees. The variables 'currPeriodIdx' and 'lastPeriodExecIdx' are both unsigned integers, and the result of the minus operation may be a negative integer which leads to an underflow. The attackers can modify the current timestamp of the transaction somehow and block the execution of the process function.
CVE-2020-24827 1 Libelfin Project 1 Libelfin 2024-11-21 5.5 Medium
A vulnerability in the dwarf::cursor::skip_form function of Libelfin v0.3 allows attackers to cause a denial of service (DOS) through a segmentation fault via a crafted ELF file.
CVE-2020-24826 1 Libelfin Project 1 Libelfin 2024-11-21 5.5 Medium
A vulnerability in the elf::section::as_strtab function of Libelfin v0.3 allows attackers to cause a denial of service (DOS) through a segmentation fault via a crafted ELF file.
CVE-2020-24825 1 Libelfin Project 1 Libelfin 2024-11-21 5.5 Medium
A vulnerability in the line_table::line_table function of Libelfin v0.3 allows attackers to cause a denial of service (DOS) through a segmentation fault via a crafted ELF file.
CVE-2020-24824 1 Libelfin Project 1 Libelfin 2024-11-21 5.5 Medium
A global buffer overflow issue in the dwarf::line_table::line_table function of Libelfin v0.3 allows attackers to cause a denial of service (DOS).
CVE-2020-24823 1 Libelfin Project 1 Libelfin 2024-11-21 5.5 Medium
A vulnerability in the dwarf::to_string function of Libelfin v0.3 allows attackers to cause a denial of service (DOS) through a segmentation fault via a crafted ELF file.
CVE-2020-24822 1 Libelfin Project 1 Libelfin 2024-11-21 5.5 Medium
A vulnerability in the dwarf::cursor::uleb function of Libelfin v0.3 allows attackers to cause a denial of service (DOS) through a segmentation fault via a crafted ELF file.
CVE-2020-24821 1 Libelfin Project 1 Libelfin 2024-11-21 5.5 Medium
A vulnerability in the dwarf::cursor::skip_form function of Libelfin v0.3 allows attackers to cause a denial of service (DOS) through a segmentation fault via a crafted ELF file.