Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (337207 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2020-24916 3 Canonical, Debian, Yaws 3 Ubuntu Linux, Debian Linux, Yaws 2024-11-21 9.8 Critical
CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection.
CVE-2020-24914 1 Qcubed 1 Qcubed 2024-11-21 9.8 Critical
A PHP object injection bug in profile.php in qcubed (all versions including 3.1.1) unserializes the untrusted data of the POST-variable "strProfileData" and allows an unauthenticated attacker to execute code via a crafted POST request.
CVE-2020-24913 1 Qcubed 1 Qcubed 2024-11-21 9.8 Critical
A SQL injection vulnerability in qcubed (all versions including 3.1.1) in profile.php via the strQuery parameter allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request.
CVE-2020-24912 1 Qcubed 1 Qcubed 2024-11-21 6.1 Medium
A reflected cross-site scripting (XSS) vulnerability in qcubed (all versions including 3.1.1) in profile.php via the stQuery-parameter allows unauthenticated attackers to steal sessions of authenticated users.
CVE-2020-24908 1 Checkmk 1 Checkmk 2024-11-21 7.8 High
Checkmk before 1.6.0p17 allows local users to obtain SYSTEM privileges via a Trojan horse shell script in the %PROGRAMDATA%\checkmk\agent\local directory.
CVE-2020-24904 1 Davesteele 1 Gnome-gmail 2024-11-21 6.5 Medium
An issue was discovered in attach parameter in GNOME Gmail version 2.5.4, allows remote attackers to gain sensitive information via crafted "mailto" link.
CVE-2020-24903 1 Cutesoft 1 Cute Editor 2024-11-21 6.1 Medium
Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting (XSS) caused by improper validation of user supplied input. A remote attacker could exploit this vulnerability using a specially crafted URL to execute a script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
CVE-2020-24902 1 Quixplorer Project 1 Quixplorer 2024-11-21 4.7 Medium
Quixplorer <=2.4.1 is vulnerable to reflected cross-site scripting (XSS) caused by improper validation of user supplied input. A remote attacker could exploit this vulnerability using a specially crafted URL to execute a script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
CVE-2020-24900 1 Krpano 1 Krpano 2024-11-21 6.1 Medium
The default installation of Krpano Panorama Viewer version <=1.20.8 is prone to Reflected XSS due to insecure XML load in file /viewer/krpano.html, parameter xml.
CVE-2020-24899 1 Nagios 1 Nagios Xi 2024-11-21 8.8 High
Nagios XI 5.7.2 is affected by a remote code execution (RCE) vulnerability. An authenticated user can inject additional commands into normal webapp query.
CVE-2020-24898 1 Stiltsoft 1 Table Filter And Charts For Confluence Server 2024-11-21 7.6 High
The Table Filter and Charts for Confluence Server app before 5.3.26 (for Atlassian Confluence) allows SSRF via the "Table from CSV" macro (URL parameter).
CVE-2020-24897 1 Stiltsoft 1 Table Filter And Charts For Confluence Server 2024-11-21 8.9 High
The Table Filter and Charts for Confluence Server app before 5.3.25 (for Atlassian Confluence) allow remote attackers to inject arbitrary HTML or JavaScript via cross site scripting (XSS) through the provided Markdown markup to the "Table from CSV" macro.
CVE-2020-24890 1 Libraw 1 Libraw 2024-11-21 5.5 Medium
libraw 20.0 has a null pointer dereference vulnerability in parse_tiff_ifd in src/metadata/tiff.cpp, which may result in context-dependent arbitrary code execution. Note: this vulnerability occurs only if you compile the software in a certain way
CVE-2020-24889 1 Libraw 1 Libraw 2024-11-21 7.8 High
A buffer overflow vulnerability in LibRaw version < 20.0 LibRaw::GetNormalizedModel in src/metadata/normalize_model.cpp may lead to context-dependent arbitrary code execution.
CVE-2020-24881 1 Osticket 1 Osticket 2024-11-21 9.8 Critical
SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning.
CVE-2020-24877 1 Zzzcms 1 Zzzphp 2024-11-21 9.8 Critical
A SQL injection vulnerability in zzzphp v1.8.0 through /form/index.php?module=getjson may lead to a possible access restriction bypass.
CVE-2020-24876 1 Pancakeapp 1 Pancake 2024-11-21 9.8 Critical
Use of a hard-coded cryptographic key in Pancake versions < 4.13.29 allows an attacker to forge session cookies, which may lead to remote privilege escalation.
CVE-2020-24872 1 Lepton-cms 1 Leptoncms 2024-11-21 6.1 Medium
Cross Site Scripting (XSS) vulnerability in backend/pages/modify.php in Lepton-CMS version 4.7.0, allows remote attackers to execute arbitrary code.
CVE-2020-24870 2 Libraw, Redhat 2 Libraw, Enterprise Linux 2024-11-21 8.8 High
Libraw before 0.20.1 has a stack buffer overflow via LibRaw::identify_process_dng_fields in identify.cpp.
CVE-2020-24863 2 Freebsd, Midnightbsd 2 Freebsd, Midnightbsd 2024-11-21 5.5 Medium
A memory corruption vulnerability was found in the kernel function kern_getfsstat in MidnightBSD before 1.2.7 and 1.3 through 2020-08-19, and FreeBSD through 11.4, that allows an attacker to trigger an invalid free and crash the system via a crafted size value in conjunction with an invalid mode.