Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (323529 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2020-14223 1 Hcltech 1 Digital Experience 2024-11-21 6.1 Medium
HCL Digital Experience 8.5, 9.0, 9.5 is susceptible to cross-site scripting (XSS). The vulnerability could be employed in a reflected or non-persistent XSS attack.
CVE-2020-14222 1 Hcltech 1 Hcl Digital Experience 2024-11-21 6.1 Medium
HCL Digital Experience 8.5, 9.0, 9.5 is susceptible to cross site scripting (XSS). One subcomponent is vulnerable to reflected XSS. In reflected XSS, an attacker must induce a victim to click on a crafted URL from some delivery mechanism (email, other web site).
CVE-2020-14221 1 Hcltech 1 Digital Experience 2024-11-21 4.9 Medium
HCL Digital Experience 8.5, 9.0, and 9.5 exposes information about the server to unauthorized users.
CVE-2020-14215 1 Zulip 1 Zulip Server 2024-11-21 7.5 High
Zulip Server before 2.1.5 has Incorrect Access Control because 0198_preregistrationuser_invited_as adds the administrator role to invitations.
CVE-2020-14214 1 Zammad 1 Zammad 2024-11-21 6.5 Medium
Zammad before 3.3.1, when Domain Based Assignment is enabled, relies on a claimed e-mail address for authorization decisions. An attacker can register a new account that will have access to all tickets of an arbitrary Organization.
CVE-2020-14213 1 Zammad 1 Zammad 2024-11-21 5.4 Medium
In Zammad before 3.3.1, a Customer has ticket access that should only be available to an Agent (e.g., read internal data, split, or merge).
CVE-2020-14212 1 Ffmpeg 1 Ffmpeg 2024-11-21 8.8 High
FFmpeg through 4.3 has a heap-based buffer overflow in avio_get_str in libavformat/aviobuf.c because dnn_backend_native.c calls ff_dnn_load_model_native and a certain index check is omitted.
CVE-2020-14210 1 Monitorapp 2 Application Insight Web Application, Web Application Firewall 2024-11-21 6.1 Medium
Reflected Cross-Site Scripting (XSS) vulnerability in MONITORAPP WAF in which script can be executed when responding to Request URL information. It provides a function to response to Request URL information when blocking.
CVE-2020-14209 1 Dolibarr 1 Dolibarr 2024-11-21 8.8 High
Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types, leading to arbitrary code execution. This occurs because .pht and .phar files can be uploaded. Also, a .htaccess file can be uploaded to reconfigure access control (e.g., to let .noexe files be executed as PHP code to defeat the .noexe protection mechanism).
CVE-2020-14208 1 Salesagility 1 Suitecrm 2024-11-21 5.4 Medium
SuiteCRM 7.11.13 is affected by stored Cross-Site Scripting (XSS) in the Documents preview functionality. This vulnerability could allow remote authenticated attackers to inject arbitrary web script or HTML.
CVE-2020-14207 1 Divebook Project 1 Divebook 2024-11-21 5.3 Medium
The DiveBook plugin 1.1.4 for WordPress was prone to a SQL injection within divelog.php, allowing unauthenticated users to retrieve data from the database via the divelog.php filter_diver parameter.
CVE-2020-14206 1 Divebook Project 1 Divebook 2024-11-21 6.1 Medium
The DiveBook plugin 1.1.4 for WordPress is prone to unauthenticated XSS within the filter function (via an arbitrary parameter).
CVE-2020-14205 1 Divebook Project 1 Divebook 2024-11-21 5.3 Medium
The DiveBook plugin 1.1.4 for WordPress is prone to improper access control in the Log Dive form because it fails to perform authorization checks. An attacker may leverage this issue to manipulate the integrity of dive logs.
CVE-2020-14204 1 Ibi 1 Webfocus Business Intelligence 2024-11-21 8.2 High
In WebFOCUS Business Intelligence 8.0 (SP6), the administration portal allows remote attackers to read arbitrary local files or forge server-side HTTP requests via a crafted HTTP request to /ibi_apps/WFServlet.cfg because XML external entity injection is possible. This is related to making changes to the application repository configuration.
CVE-2020-14203 1 Ibi 1 Webfocus Business Intelligence 2024-11-21 8.8 High
WebFOCUS Business Intelligence 8.0 (SP6) allows a Cross-Site Request Forgery (CSRF) attack against administrative users within the /ibi_apps/WFServlet(.ibfs) endpoint. The impact may be creation of an administrative user. It can also be exploited in conjunction with CVE-2016-9044.
CVE-2020-14202 1 Ibi 1 Webfocus Business Intelligence 2024-11-21 6.1 Medium
WebFOCUS Business Intelligence 8.0 (SP6) was prone to XSS via arbitrary URL parameters.
CVE-2020-14201 1 Dolibarr 1 Dolibarr 2024-11-21 6.5 Medium
Dolibarr CRM before 11.0.5 allows privilege escalation. This could allow remote authenticated attackers to upload arbitrary files via societe/document.php in which "disabled" is changed to "enabled" in the HTML source code.
CVE-2020-14199 1 Satoshilabs 4 Trezor Model T, Trezor Model T Firmware, Trezor One and 1 more 2024-11-21 6.5 Medium
BIP-143 in the Bitcoin protocol specification mishandles the signing of a Segwit transaction, which allows attackers to trick a user into making two signatures in certain cases, potentially leading to a huge transaction fee. NOTE: this affects all hardware wallets. It was fixed in 1.9.1 for the Trezor One and 2.3.1 for the Trezor Model T.
CVE-2020-14198 1 Bitcoin 1 Bitcoin Core 2024-11-21 7.5 High
Bitcoin Core 0.20.0 allows remote denial of service.
CVE-2020-14196 1 Powerdns 1 Recursor 2024-11-21 5.3 Medium
In PowerDNS Recursor versions up to and including 4.3.1, 4.2.2 and 4.1.16, the ACL restricting access to the internal web server is not properly enforced.