Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (338427 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2020-28433 1 Node-latex-pdf Project 1 Node-latex-pdf 2024-11-21 7.3 High
This affects all versions of package node-latex-pdf.
CVE-2020-28429 1 Geojson2kml Project 1 Geojson2kml 2024-11-21 7.3 High
All versions of package geojson2kml are vulnerable to Command Injection via the index.js file. PoC: var a =require("geojson2kml"); a("./","& touch JHU",function(){})
CVE-2020-28426 1 Kill-process-on-port Project 1 Kill-process-on-port 2024-11-21 7.3 High
All versions of package kill-process-on-port are vulnerable to Command Injection via a.getProcessPortId.
CVE-2020-28425 1 Curljs Project 1 Curljs 2024-11-21 7.3 High
This affects all versions of package curljs.
CVE-2020-28424 1 S3-kilatstorage Project 1 S3-kilatstorage 2024-11-21 7.2 High
This affects all versions of package s3-kilatstorage.
CVE-2020-28423 1 Monorepo-build Project 1 Monorepo-build 2024-11-21 9.8 Critical
This affects all versions of package monorepo-build.
CVE-2020-28422 1 Git-archive Project 1 Git-archive 2024-11-21 6.4 Medium
All versions of package git-archive are vulnerable to Command Injection via the exports function.
CVE-2020-28421 2 Broadcom, Microsoft 2 Unified Infrastructure Management, Windows 2024-11-21 7.8 High
CA Unified Infrastructure Management 20.1 and earlier contains a vulnerability in the robot (controller) component that allows local attackers to elevate privileges.
CVE-2020-28419 1 Hp 1503 Laserjet Managed Mfp E62665 3gy14a, Laserjet Managed Mfp E62665 3gy15a, Laserjet Managed Mfp E62665 3gy16a and 1500 more 2024-11-21 8.8 High
During installation with certain driver software or application packages an arbitrary code execution could occur.
CVE-2020-28416 1 Hp 310 Officejet 250 Cz992a, Officejet 250 Cz992a Firmware, Officejet 250c L9d57a and 307 more 2024-11-21 7.8 High
HP has identified a security vulnerability with the I.R.I.S. OCR (Optical Character Recognition) software available with HP PageWide and OfficeJet printer software installations that could potentially allow unauthorized local code execution.
CVE-2020-28415 1 Tranzware Payment Gateway Project 1 Tranzware Payment Gateway 2024-11-21 6.1 Medium
A reflected cross-site scripting (XSS) vulnerability exists in the TranzWare Payment Gateway 3.1.12.3.2. A remote unauthenticated attacker is able to execute arbitrary HTML code via crafted url (different vector than CVE-2020-28414).
CVE-2020-28414 1 Tranzware Payment Gateway Project 1 Tranzware Payment Gateway 2024-11-21 6.1 Medium
A reflected cross-site scripting (XSS) vulnerability exists in the TranzWare Payment Gateway 3.1.12.3.2. A remote unauthenticated attacker is able to execute arbitrary HTML code via crafted url (different vector than CVE-2020-28415).
CVE-2020-28413 1 Mantisbt 1 Mantisbt 2024-11-21 5.3 Medium
In MantisBT 2.24.3, SQL Injection can occur in the parameter "access" of the mc_project_get_users function through the API SOAP.
CVE-2020-28409 1 Dundas 1 Dundas Bi 2024-11-21 5.4 Medium
The server in Dundas BI through 8.0.0.1001 allows XSS via addition of a Component (e.g., a button) when events such as click, hover, etc. occur.
CVE-2020-28408 1 Dundas 1 Dundas Bi 2024-11-21 5.4 Medium
The server in Dundas BI through 8.0.0.1001 allows XSS via an HTML label when creating or editing a dashboard.
CVE-2020-28407 1 Swtpm Project 1 Swtpm 2024-11-21 7.1 High
In swtpm before 0.4.2 and 0.5.x before 0.5.1, a local attacker may be able to overwrite arbitrary files via a symlink attack against a temporary file such as TMP2-00.permall.
CVE-2020-28397 1 Siemens 111 Cpu1510sp F-1, Cpu1510sp F-1 Firmware, Cpu 1211c and 108 more 2024-11-21 5.3 Medium
A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions < V21.9), SIMATIC S7 PLCSIM Advanced (All versions > V2 < V4), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (Version V4.4), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions > V2.5 < V2.9.2), SIMATIC S7-1500 Software Controller (All versions > V2.5 < V21.9), TIM 1531 IRC (incl. SIPLUS NET variants) (Version V2.1). Due to an incorrect authorization check in the affected component, an attacker could extract information about access protected PLC program variables over port 102/tcp from an affected device when reading multiple attributes at once.
CVE-2020-28396 1 Siemens 6 Sicam A8000 Cp-8000, Sicam A8000 Cp-8000 Firmware, Sicam A8000 Cp-8021 and 3 more 2024-11-21 7.3 High
A vulnerability has been identified in SICAM A8000 CP-8000 (All versions < V16), SICAM A8000 CP-8021 (All versions < V16), SICAM A8000 CP-8022 (All versions < V16). A web server misconfiguration of the affected device can cause insecure ciphers usage by a user´s browser. An attacker in a privileged position could decrypt the communication and compromise confidentiality and integrity of the transmitted information.
CVE-2020-28395 1 Siemens 16 Scalance Xr324-12m, Scalance Xr324-12m Firmware, Scalance Xr324-12m Ts and 13 more 2024-11-21 5.9 Medium
A vulnerability has been identified in SCALANCE X-200RNA switch family (All versions < V3.2.7), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (All versions < V4.1.0). Devices do not create a new unique private key after factory reset. An attacker could leverage this situation to a man-in-the-middle situation and decrypt previously captured traffic.
CVE-2020-28394 1 Siemens 2 Jt2go, Teamcenter Visualization 2024-11-21 5.5 Medium
A vulnerability has been identified in JT2Go (All versions < V13.1.0.1), Teamcenter Visualization (All versions < V13.1.0.1). Affected applications lack proper validation of user-supplied data when parsing of RAS files. This could result in a memory access past the end of an allocated buffer. An attacker could leverage this vulnerability to access data in the context of the current process. (ZDI-CAN-12283)