Search

Expected end of text, found ':' (at char 29), (line:1, col:30)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (363654 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2020-18048 1 Bertanddip 1 Craigms 2024-11-21 9.8 Critical
An issue in craigms/main.php of CraigMS 1.0 allows attackers to execute arbitrary commands via a crafted input entered into the DB Name field.
CVE-2020-18035 1 Jeesns 1 Jeesns 2024-11-21 6.1 Medium
Cross Site Scripting (XSS) in Jeesns v1.4.2 allows remote attackers to execute arbitrary code by injecting commands into the "CKEditorFuncNum" parameter in the component "CkeditorUploadController.java".
CVE-2020-18032 4 Debian, Fedoraproject, Graphviz and 1 more 4 Debian Linux, Fedora, Graphviz and 1 more 2024-11-21 7.8 High
Buffer Overflow in Graphviz Graph Visualization Tools from commit ID f8b9e035 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by loading a crafted file into the "lib/common/shapes.c" component.
CVE-2020-18022 1 Qibosoft 1 Qibocms 2024-11-21 6.1 Medium
Cross Site Scripting (XSS) in Qibosoft QiboCMS v7 and earlier allows remote attackers to execute arbitrary code or obtain sensitive information by injecting arbitrary commands in a HTTP request to the "ewebeditor\3.1.1\kindeditor.js" component.
CVE-2020-18020 1 Phpshe 1 Mall System 2024-11-21 9.8 Critical
SQL Injection in PHPSHE Mall System v1.7 allows remote attackers to execute arbitrary code by injecting SQL commands into the "user_phone" parameter of a crafted HTTP request to the "admin.php" component.
CVE-2020-18019 1 Xinfu 1 Oa System 2024-11-21 7.5 High
SQL Injection in Xinhu OA System v1.8.3 allows remote attackers to obtain sensitive information by injecting arbitrary commands into the "typeid" variable of the "createfolderAjax" function in the "mode_worcAction.php" component.
CVE-2020-18013 1 Whatsns 1 Whatsns 2024-11-21 9.8 Critical
SQL Injextion vulnerability exists in Whatsns 4.0 via the ip parameter in index.php?admin_banned/add.htm.
CVE-2020-17999 1 1234n 1 Minicms 2024-11-21 6.1 Medium
Cross Site Scripting (XSS) in MiniCMS v1.10 allows remote attackers to execute arbitrary code by injecting commands via a crafted HTTP request to the component "/mc-admin/post-edit.php".
CVE-2020-17952 1 Twothink Project 1 Twothink 2024-11-21 9.8 Critical
A remote code execution (RCE) vulnerability in /library/think/App.php of Twothink v2.0 allows attackers to execute arbitrary PHP code.
CVE-2020-17901 1 Pbootcms 1 Pbootcms 2024-11-21 6.5 Medium
Cross-site request forgery (CSRF) in PbootCMS 1.3.2 allows attackers to change the password of a user.
CVE-2020-17891 1 Tp-link 2 Archer C1200, Archer C1200 Firmware 2024-11-21 6.1 Medium
TP-Link Archer C1200 firmware version 1.13 Build 2018/01/24 rel.52299 EU has a XSS vulnerability allowing a remote attacker to execute arbitrary code.
CVE-2020-17759 2 Evernote, Microsoft 4 Evernote, Windows 10, Windows 7 and 1 more 2024-11-21 8.8 High
An issue was found in the Evernote client for Windows 10, 7, and 2008 in the protocol handler. This enables attackers for arbitrary command execution if the user clicks on a specially crafted URL. AKA: WINNOTE-19941.
CVE-2020-17753 2 Rc Project, Rcpro Project 2 Rc, Rcpro 2024-11-21 6.5 Medium
An issue was discovered in function addMeByRC in the smart contract implementation for RC, an Ethereum token, allows attackers to transfer an arbitrary amount of tokens to an arbitrary address.
CVE-2020-17752 1 Mon Project 1 Mon 2024-11-21 9.8 Critical
Integer overflow vulnerability in payable function of a smart contract implementation for an Ethereum token, as demonstrated by the smart contract implemented at address 0xB49E984A83d7A638E7F2889fc8328952BA951AbE, an implementation for MillionCoin (MON).
CVE-2020-17564 1 Feifeicms 1 Feifeicms 2024-11-21 9.1 Critical
Path Traversal in FeiFeiCMS v4.0 allows remote attackers to delete arbitrary files by sending a crafted HTTP request to the " Admin/DataAction.class.php" component.
CVE-2020-17563 1 Feifeicms 1 Feifeicms 2024-11-21 9.1 Critical
Path Traversal in FeiFeiCMS v4.0 allows remote attackers to delete arbitrary files by sending a crafted HTTP request to " /index.php?s=/admin-tpl-del&id=".
CVE-2020-17551 1 Impresscms 1 Impresscms 2024-11-21 4.8 Medium
ImpressCMS 1.4.0 is affected by XSS in modules/system/admin.php which may result in arbitrary remote code execution.
CVE-2020-17542 1 Dotcms 1 Dotcms 2024-11-21 5.4 Medium
Cross Site Scripting (XSS) in dotCMS v5.1.5 allows remote attackers to execute arbitrary code by injecting a malicious payload into the "Task Detail" comment window of the "/dotAdmin/#/c/workflow" component.
CVE-2020-17541 2 Libjpeg-turbo, Redhat 2 Libjpeg-turbo, Enterprise Linux 2024-11-21 8.8 High
Libjpeg-turbo all version have a stack-based buffer overflow in the "transform" component. A remote attacker can send a malformed jpeg file to the service and cause arbitrary code execution or denial of service of the target service.
CVE-2020-17534 1 Apache 1 Html\/java Api 2024-11-21 7.0 High
There exists a race condition between the deletion of the temporary file and the creation of the temporary directory in `webkit` subproject of HTML/Java API version 1.7. A similar vulnerability has recently been disclosed in other Java projects and the fix in HTML/Java API version 1.7.1 follows theirs: To avoid local privilege escalation version 1.7.1 creates the temporary directory atomically without dealing with the temporary file: https://github.com/apache/netbeans-html4j/commit/fa70e507e5555e1adb4f6518479fc408a7abd0e6