Export limit exceeded: 88023 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (88023 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2020-28964 | 1 Tonec | 1 Internet Download Manager | 2024-11-21 | 6.7 Medium |
| Internet Download Manager 6.37.11.1 was discovered to contain a stack buffer overflow in the Search function. This vulnerability allows attackers to escalate local process privileges via unspecified vectors. | ||||
| CVE-2020-28961 | 1 Perfexcrm | 1 Perfex Crm | 2024-11-21 | 5.4 Medium |
| Perfex CRM v2.4.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component ./clients/client via the company name parameter. | ||||
| CVE-2020-28957 | 1 Froxlor | 1 Froxlor | 2024-11-21 | 5.4 Medium |
| Multiple cross-site scripting (XSS) vulnerabilities in the Customer Add module of Foxlor v0.10.16 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the name, firstname, or username input fields. | ||||
| CVE-2020-28956 | 1 Sugarcrm | 1 Sugarcrm | 2024-11-21 | 5.4 Medium |
| Multiple cross-site scripting (XSS) vulnerabilities in the Sales module of SugarCRM v6.5.18 allows attackers to execute arbitrary web scripts or HTML via crafted payloads entered into the primary address state or alternate address state input fields. | ||||
| CVE-2020-28955 | 1 Sugarcrm | 1 Sugarcrm | 2024-11-21 | 5.4 Medium |
| SugarCRM v6.5.18 was discovered to contain a cross-site scripting (XSS) vulnerability in the Create Employee module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the First Name or Last Name input fields. | ||||
| CVE-2020-28952 | 1 Homey | 4 Homey, Homey Firmware, Homey Pro and 1 more | 2024-11-21 | 7.5 High |
| An issue was discovered on Athom Homey and Homey Pro devices before 5.0.0. ZigBee hub devices should generate a unique Standard Network Key that is then exchanged with all enrolled devices so that all inter-device communication is encrypted. However, the cited Athom products use another widely known key that is designed for testing purposes: "01030507090b0d0f00020406080a0c0d" (the decimal equivalent of 1 3 5 7 9 11 13 15 0 2 4 6 8 10 12 13), which is human generated and static across all issued devices. | ||||
| CVE-2020-28947 | 1 Misp-project | 1 Misp | 2024-11-21 | 6.1 Medium |
| In MISP 2.4.134, XSS exists in the template element index view because the id parameter is mishandled. | ||||
| CVE-2020-28945 | 1 Open-xchange | 1 Open-xchange Appsuite | 2024-11-21 | 6.1 Medium |
| OX App Suite 7.10.4 and earlier allows XSS via crafted content to reach an undocumented feature, such as  issue in the 'update user' and 'delete user' functionalities in settings/users.php in EPSON EPS TSE Server 8 (21.0.11) allows an authenticated attacker to inject a JavaScript payload in the user management page that is executed by an administrator. | ||||
| CVE-2020-28928 | 4 Debian, Fedoraproject, Musl-libc and 1 more | 4 Debian Linux, Fedora, Musl and 1 more | 2024-11-21 | 5.5 Medium |
| In musl libc through 1.2.1, wcsnrtombs mishandles particular combinations of destination buffer size and source character limit, as demonstrated by an invalid write access (buffer overflow). | ||||
| CVE-2020-28927 | 1 Magicpin | 1 Magicpin | 2024-11-21 | 6.1 Medium |
| There is a Stored XSS in Magicpin v2.1 in the User Registration section. Each time an admin visits the manage user section from the admin panel, the XSS triggers and the attacker can able to steal the cookie according to the crafted payload. | ||||
| CVE-2020-28919 | 1 Checkmk | 1 Checkmk | 2024-11-21 | 5.4 Medium |
| A stored cross site scripting (XSS) vulnerability in Checkmk 1.6.0x prior to 1.6.0p19 allows an authenticated remote attacker to inject arbitrary JavaScript via a javascript: URL in a view title. | ||||
| CVE-2020-28914 | 1 Katacontainers | 1 Kata-containers | 2024-11-21 | 7.1 High |
| An improper file permissions vulnerability affects Kata Containers prior to 1.11.5. When using a Kubernetes hostPath volume and mounting either a file or directory into a container as readonly, the file/directory is mounted as readOnly inside the container, but is still writable inside the guest. For a container breakout situation, a malicious guest can potentially modify or delete files/directories expected to be read-only. | ||||
| CVE-2020-28910 | 1 Nagios | 1 Nagios Xi | 2024-11-21 | 9.8 Critical |
| Creation of a Temporary Directory with Insecure Permissions in Nagios XI 5.7.5 and earlier allows for Privilege Escalation via creation of symlinks, which are mishandled in getprofile.sh. | ||||
| CVE-2020-28909 | 1 Nagios | 1 Fusion | 2024-11-21 | 8.8 High |
| Incorrect File Permissions in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to root via modification of scripts. Low-privileges users are able to modify files that can be executed by sudo. | ||||
| CVE-2020-28908 | 1 Nagios | 1 Fusion | 2024-11-21 | 9.8 Critical |
| Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to nagios. | ||||
| CVE-2020-28903 | 1 Nagios | 1 Fusion | 2024-11-21 | 6.1 Medium |
| Improper input validation in Nagios Fusion 4.1.8 and earlier allows a remote attacker with control over a fused server to inject arbitrary HTML, aka XSS. | ||||
| CVE-2020-28902 | 1 Nagios | 1 Fusion | 2024-11-21 | 9.8 Critical |
| Command Injection in Nagios Fusion 4.1.8 and earlier allows Privilege Escalation from apache to root in cmd_subsys.php. | ||||
| CVE-2020-28901 | 1 Nagios | 1 Fusion | 2024-11-21 | 9.8 Critical |
| Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation or Code Execution as root via vectors related to corrupt component installation in cmd_subsys.php. | ||||