Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (36731 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2020-28397 1 Siemens 111 Cpu1510sp F-1, Cpu1510sp F-1 Firmware, Cpu 1211c and 108 more 2024-11-21 5.3 Medium
A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions < V21.9), SIMATIC S7 PLCSIM Advanced (All versions > V2 < V4), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (Version V4.4), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions > V2.5 < V2.9.2), SIMATIC S7-1500 Software Controller (All versions > V2.5 < V21.9), TIM 1531 IRC (incl. SIPLUS NET variants) (Version V2.1). Due to an incorrect authorization check in the affected component, an attacker could extract information about access protected PLC program variables over port 102/tcp from an affected device when reading multiple attributes at once.
CVE-2020-28368 3 Debian, Fedoraproject, Xen 3 Debian Linux, Fedora, Xen 2024-11-21 4.4 Medium
Xen through 4.14.x allows guest OS administrators to obtain sensitive information (such as AES keys from outside the guest) via a side-channel attack on a power/energy monitoring interface, aka a "Platypus" attack. NOTE: there is only one logically independent fix: to change the access control for each such interface in Xen.
CVE-2020-28215 1 Schneider-electric 2 Easergy T300, Easergy T300 Firmware 2024-11-21 9.8 Critical
A CWE-862: Missing Authorization vulnerability exists in Easergy T300 (firmware 2.7 and older), that could cause a wide range of problems, including information exposures, denial of service, and arbitrary code execution when access control checks are not applied consistently.
CVE-2020-28211 1 Schneider-electric 1 Ecostruxure Control Expert 2024-11-21 7.8 High
A CWE-863: Incorrect Authorization vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) that could cause bypass of authentication when overwriting memory using a debugger.
CVE-2020-28183 1 Water Billing System Project 1 Water Billing System 2024-11-21 9.8 Critical
SQL injection vulnerability in SourceCodester Water Billing System 1.0 via the username and password parameters to process.php.
CVE-2020-28172 1 Simple College Project 1 Simple College 2024-11-21 9.8 Critical
A SQL injection vulnerability in Simple College Website 1.0 allows remote unauthenticated attackers to bypass the admin authentication mechanism in college_website/admin/ajax.php?action=login, thus gaining access to the website administrative panel.
CVE-2020-28138 1 Online Clothing Store Project 1 Online Clothing Store 2024-11-21 9.8 Critical
SourceCodester Online Clothing Store 1.0 is affected by a SQL Injection via the txtUserName parameter to login.php.
CVE-2020-28133 1 Simple Grocery Store Sales And Inventory Sales Project 1 Simple Grocery Store Sales And Inventory System 2024-11-21 9.8 Critical
An issue was discovered in SourceCodester Simple Grocery Store Sales And Inventory System 1.0. There was authentication bypass in web login functionality allows an attacker to gain client privileges via SQL injection in sales_inventory/login.php.
CVE-2020-28115 1 Web-audimex 1 Audimexee 2024-11-21 8.8 High
SQL Injection vulnerability in "Documents component" found in AudimexEE version 14.1.0 allows an attacker to execute arbitrary SQL commands via the object_path parameter.
CVE-2020-28103 1 Chshcms 1 Cscms 2024-11-21 9.8 Critical
cscms v4.1 allows for SQL injection via the "page_del" function.
CVE-2020-28102 1 Chshcms 1 Cscms 2024-11-21 9.8 Critical
cscms v4.1 allows for SQL injection via the "js_del" function.
CVE-2020-28091 1 Cxuu 1 Cxuucms 2024-11-21 7.5 High
cxuucms v3 has a SQL injection vulnerability, which can lead to the leakage of all database data via the keywords parameter via search.php.
CVE-2020-28087 1 Jeecg 1 Jeecg Boot 2024-11-21 7.5 High
A SQL injection vulnerability in /jeecg boot/sys/dict/loadtreedata of jeecg-boot CMS 2.3 allows attackers to access sensitive database information.
CVE-2020-28074 1 Online Health Care System Project 1 Online Health Care System 2024-11-21 9.8 Critical
SourceCodester Online Health Care System 1.0 is affected by SQL Injection which allows a potential attacker to bypass the authentication system and become an admin.
CVE-2020-28073 1 Library Management System Project 1 Library Management System 2024-11-21 9.8 Critical
SourceCodester Library Management System 1.0 is affected by SQL Injection allowing an attacker to bypass the user authentication and impersonate any user on the system.
CVE-2020-28070 1 Alumni Management System Project 1 Alumni Management System 2024-11-21 9.8 Critical
SourceCodester Alumni Management System 1.0 is affected by SQL injection causing arbitrary remote code execution from GET input in view_event.php via the 'id' parameter.
CVE-2020-28053 1 Hashicorp 1 Consul 2024-11-21 6.5 Medium
HashiCorp Consul and Consul Enterprise 1.2.0 up to 1.8.5 allowed operators with operator:read ACL permissions to read the Connect CA private key configuration. Fixed in 1.6.10, 1.7.10, and 1.8.6.
CVE-2020-28036 3 Debian, Fedoraproject, Wordpress 3 Debian Linux, Fedora, Wordpress 2024-11-21 9.8 Critical
wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post.
CVE-2020-28030 3 Debian, Fedoraproject, Wireshark 3 Debian Linux, Fedora, Wireshark 2024-11-21 7.5 High
In Wireshark 3.2.0 to 3.2.7, the GQUIC dissector could crash. This was addressed in epan/dissectors/packet-gquic.c by correcting the implementation of offset advancement.
CVE-2020-27998 1 Fast-report 1 Fastreport 2024-11-21 9.8 Critical
An issue was discovered in FastReport before 2020.4.0. It lacks a ScriptSecurity feature and therefore may mishandle (for example) GetType, typeof, TypeOf, DllImport, LoadLibrary, and GetProcAddress.