Export limit exceeded: 375437 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (40340 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2020-14159 | 1 Connectwise | 1 Automate Api | 2024-11-21 | 8.8 High |
| By using an Automate API in ConnectWise Automate before 2020.5.178, a remote authenticated user could execute commands and/or modifications within an individual Automate instance by triggering an SQL injection vulnerability in /LabTech/agent.aspx. This affects versions before 2019.12.337, 2020 before 2020.1.53, 2020.2 before 2020.2.85, 2020.3 before 2020.3.114, 2020.4 before 2020.4.143, and 2020.5 before 2020.5.178. | ||||
| CVE-2020-14121 | 1 Mi | 1 Mi App Store | 2024-11-21 | 5.5 Medium |
| A business logic vulnerability exists in Mi App Store. The vulnerability is caused by incomplete permission checks of the products being bypassed, and an attacker can exploit the vulnerability to perform a local silent installation. | ||||
| CVE-2020-14110 | 1 Mi | 2 Ax3600, Ax3600 Firmware | 2024-11-21 | 7.8 High |
| AX3600 router sensitive information leaked.There is an unauthorized interface through luci to obtain sensitive information and log in to the web background. | ||||
| CVE-2020-14106 | 1 Mi | 1 Miui | 2024-11-21 | 5.5 Medium |
| The application in the mobile phone can unauthorized access to the list of running processes in the mobile phone, Xiaomi Mobile Phone MIUI < 2021.01.26. | ||||
| CVE-2020-14092 | 1 Ithemes | 1 Paypal Pro | 2024-11-21 | 9.8 Critical |
| The CodePeople Payment Form for PayPal Pro plugin before 1.1.65 for WordPress allows SQL Injection. | ||||
| CVE-2020-14069 | 1 Mk-auth | 1 Mk-auth | 2024-11-21 | 6.8 Medium |
| An issue was discovered in MK-AUTH 19.01. There are SQL injection issues in mkt/ PHP scripts, as demonstrated by arp.php, dhcp.php, hotspot.php, ip.php, pgaviso.php, pgcorte.php, pppoe.php, queues.php, and wifi.php. | ||||
| CVE-2020-14068 | 1 Mk-auth | 1 Mk-auth | 2024-11-21 | 9.8 Critical |
| An issue was discovered in MK-AUTH 19.01. The web login functionality allows an attacker to bypass authentication and gain client privileges via SQL injection in central/executar_login.php. | ||||
| CVE-2020-14054 | 1 Sokkia | 2 Gnr5 Vanguard, Gnr5 Vanguard Firmware | 2024-11-21 | 9.8 Critical |
| SOKKIA GNR5 Vanguard WEB version 1.2 (build: 91f2b2c3a04d203d79862f87e2440cb7cefc3cd3) and hardware version 212 allows remote attackers to bypass admin authentication via a SQL injection attack that uses the User Name or Password field on the login page. | ||||
| CVE-2020-14049 | 1 Rakuten | 1 Viber | 2024-11-21 | 7.5 High |
| Viber for Windows up to 13.2.0.39 does not properly quote its custom URI handler. A malicious website could launch Viber with arbitrary parameters, forcing a victim to send an NTLM authentication request, and either relay the request or capture the hash for offline password cracking. NOTE: this issue exists because of an incomplete fix for CVE-2019-12569. | ||||
| CVE-2020-14040 | 3 Fedoraproject, Golang, Redhat | 16 Fedora, Text, 3scale Amp and 13 more | 2024-11-21 | 7.5 High |
| The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String. | ||||
| CVE-2020-14027 | 1 Ozeki | 1 Ozeki Ng Sms Gateway | 2024-11-21 | 5.3 Medium |
| An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The database connection strings accept custom unsafe arguments, such as ENABLE_LOCAL_INFILE, that can be leveraged by attackers to enable MySQL Load Data Local (rogue MySQL server) attacks. | ||||
| CVE-2020-14001 | 4 Canonical, Debian, Fedoraproject and 1 more | 4 Ubuntu Linux, Debian Linux, Fedora and 1 more | 2024-11-21 | 9.8 Critical |
| The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as template="/etc/passwd") or unintended embedded Ruby code execution (such as a string that begins with template="string://<%= `). NOTE: kramdown is used in Jekyll, GitLab Pages, GitHub Pages, and Thredded Forum. | ||||
| CVE-2020-13996 | 1 J2store | 1 J2store | 2024-11-21 | 8.8 High |
| The J2Store plugin before 3.3.13 for Joomla! allows a SQL injection attack by a trusted store manager. | ||||
| CVE-2020-13993 | 1 Mods-for-hesk | 1 Mods For Hesk | 2024-11-21 | 7.5 High |
| An issue was discovered in Mods for HESK 3.1.0 through 2019.1.0. A blind time-based SQL injection issue allows remote unauthenticated attackers to retrieve information from the database via a ticket. | ||||
| CVE-2020-13987 | 5 Contiki-os, Open-iscsi Project, Redhat and 2 more | 12 Contiki, Open-iscsi, Enterprise Linux and 9 more | 2024-11-21 | 7.5 High |
| An issue was discovered in Contiki through 3.0. An Out-of-Bounds Read vulnerability exists in the uIP TCP/IP Stack component when calculating the checksums for IP packets in upper_layer_chksum in net/ipv4/uip.c. | ||||
| CVE-2020-13986 | 1 Contiki-os | 1 Contiki | 2024-11-21 | 7.5 High |
| An issue was discovered in Contiki through 3.0. An infinite loop exists in the uIP TCP/IP stack component when handling RPL extension headers of IPv6 network packets in rpl_remove_header in net/rpl/rpl-ext-header.c. | ||||
| CVE-2020-13984 | 1 Contiki-os | 1 Contiki | 2024-11-21 | 7.5 High |
| An issue was discovered in Contiki through 3.0. An infinite loop exists in the uIP TCP/IP stack component when processing IPv6 extension headers in ext_hdr_options_process in net/ipv6/uip6.c. | ||||
| CVE-2020-13977 | 2 Fedoraproject, Nagios | 2 Fedora, Nagios | 2024-11-21 | 4.9 Medium |
| Nagios 4.4.5 allows an attacker, who already has administrative access to change the "URL for JSON CGIs" configuration setting, to modify the Alert Histogram and Trends code via crafted versions of the archivejson.cgi, objectjson.cgi, and statusjson.cgi files. NOTE: this vulnerability has been mistakenly associated with CVE-2020-1408. | ||||
| CVE-2020-13968 | 1 Crk | 1 Business Platform | 2024-11-21 | 9.8 Critical |
| CRK Business Platform <= 2019.1 allows can inject SQL statements against the DB on any path using the 'strSessao' parameter. | ||||
| CVE-2020-13957 | 1 Apache | 1 Solr | 2024-11-21 | 9.8 Critical |
| Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code execution) to be configured in a ConfigSet that's uploaded via API without authentication/authorization. The checks in place to prevent such features can be circumvented by using a combination of UPLOAD/CREATE actions. | ||||