Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (756 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2020-2099 2 Jenkins, Redhat 2 Jenkins, Openshift 2024-11-21 8.6 High
Jenkins 2.213 and earlier, LTS 2.204.1 and earlier improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized attackers with knowledge of agent names to obtain the connection secrets for those agents, which can be used to connect to Jenkins, impersonating those agents.
CVE-2020-29508 2 Dell, Oracle 6 Bsafe Crypto-c-micro-edition, Bsafe Micro-edition-suite, Database and 3 more 2024-11-21 5.3 Medium
Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.6, contain an Improper Input Validation Vulnerability.
CVE-2020-29505 2 Dell, Oracle 3 Bsafe Crypto-c-micro-edition, Bsafe Micro-edition-suite, Retail Customer Insights 2024-11-21 7.1 High
Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain a Key Management Error Vulnerability.
CVE-2020-28924 2 Fedoraproject, Rclone 2 Fedora, Rclone 2024-11-21 7.5 High
An issue was discovered in Rclone before 1.53.3. Due to the use of a weak random number generator, the password generator has been producing weak passwords with much less entropy than advertised. The suggested passwords depend deterministically on the time the second rclone was started. This limits the entropy of the passwords enormously. These passwords are often used in the crypt backend for encryption of data. It would be possible to make a dictionary of all possible passwords with about 38 million entries per password length. This would make decryption of secret material possible with a plausible amount of effort. NOTE: all passwords generated by affected versions should be changed.
CVE-2020-28642 1 Infinitewp 1 Infinitewp 2024-11-21 9.8 Critical
In InfiniteWP Admin Panel before 3.1.12.3, resetPasswordSendMail generates a weak password-reset code, which makes it easier for remote attackers to conduct admin Account Takeover attacks.
CVE-2020-28597 1 Epignosishq 1 Efront 2024-11-21 7.5 High
A predictable seed vulnerability exists in the password reset functionality of Epignosis EfrontPro 5.2.21. By predicting the seed it is possible to generate the correct password reset 1-time token. An attacker can visit the password reset supplying the password reset token to reset the password of an account of their choice.
CVE-2020-27743 1 Pam Tacplus Project 1 Pam Tacplus 2024-11-21 9.8 Critical
libtac in pam_tacplus through 1.5.1 lacks a check for a failure of RAND_bytes()/RAND_pseudo_bytes(). This could lead to use of a non-random/predictable session_id.
CVE-2020-27636 1 Microchip 1 Mplab Network Creator 2024-11-21 9.1 Critical
In Microchip MPLAB Net 3.6.1, TCP ISNs are improperly random.
CVE-2020-27635 1 Capgemini 1 Picotcp 2024-11-21 9.1 Critical
In PicoTCP 1.7.0, TCP ISNs are improperly random.
CVE-2020-27634 1 Contiki-ng 1 Contiki-ng 2024-11-21 9.1 Critical
In Contiki 4.5, TCP ISNs are improperly random.
CVE-2020-27633 1 Butok 1 Fnet 2024-11-21 9.1 Critical
In FNET 4.6.3, TCP ISNs are improperly random.
CVE-2020-27631 1 Oryx-embedded 1 Cyclonetcp 2024-11-21 9.8 Critical
In Oryx CycloneTCP 1.9.6, TCP ISNs are improperly random.
CVE-2020-27630 1 Silabs 1 Uc\/tcp-ip 2024-11-21 9.8 Critical
In Silicon Labs uC/TCP-IP 3.6.0, TCP ISNs are improperly random.
CVE-2020-27556 1 Basetech 2 Ge-131 Bt-1837836, Ge-131 Bt-1837836 Firmware 2024-11-21 5.3 Medium
A predictable device ID in BASETech GE-131 BT-1837836 firmware 20180921 allows unauthenticated remote attackers to connect to the device.
CVE-2020-27264 1 Sooil 6 Anydana-a, Anydana-a Firmware, Anydana-i and 3 more 2024-11-21 8.8 High
In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, the communication protocol of the insulin pump and its AnyDana-i and AnyDana-A mobile applications use deterministic keys, which allows unauthenticated, physically proximate attackers to brute-force the keys via Bluetooth Low Energy.
CVE-2020-27213 1 Ethernut 1 Nut\/os 2024-11-21 7.5 High
An issue was discovered in Ethernut Nut/OS 5.1. The code that generates Initial Sequence Numbers (ISNs) for TCP connections derives the ISN from an insufficiently random source. As a result, an attacker may be able to determine the ISN of current and future TCP connections and either hijack existing ones or spoof future ones. While the ISN generator seems to adhere to RFC 793 (where a global 32-bit counter is incremented roughly every 4 microseconds), proper ISN generation should aim to follow at least the specifications outlined in RFC 6528.
CVE-2020-27180 1 Konzept-ix 1 Publixone 2024-11-21 7.5 High
konzept-ix publiXone before 2020.015 allows attackers to download files by iterating over the IXCopy fileID parameter.
CVE-2020-26556 1 Bluetooth 2 Bluetooth Core Specification, Mesh Profile 2024-11-21 7.5 High
Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device, able to conduct a successful brute-force attack on an insufficiently random AuthValue before the provisioning procedure times out, to complete authentication by leveraging Malleable Commitment.
CVE-2020-26550 1 Aviatrix 1 Controller 2024-11-21 7.5 High
An issue was discovered in Aviatrix Controller before R5.3.1151. An encrypted file containing credentials to unrelated systems is protected by a three-character key.
CVE-2020-26107 1 Cpanel 1 Cpanel 2024-11-21 7.5 High
cPanel before 88.0.3, upon an upgrade, establishes predictable PowerDNS API keys (SEC-561).