Export limit exceeded: 94786 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (94786 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2020-26835 | 1 Sap | 1 Netweaver Application Server Abap | 2024-11-21 | 6.1 Medium |
| SAP NetWeaver AS ABAP, versions - 740, 750, 751, 752, 753, 754 , does not sufficiently encode URL which allows an attacker to input malicious java script in the URL which could be executed in the browser resulting in Reflected Cross-Site Scripting (XSS) vulnerability. | ||||
| CVE-2020-26825 | 1 Sap | 1 Fiori Launchpad \(news Tile Application\) | 2024-11-21 | 6.1 Medium |
| SAP Fiori Launchpad (News tile Application), versions - 750,751,752,753,754,755, allows an unauthorized attacker to use SAP Fiori Launchpad News tile Application to send malicious code, to a different end user (victim), because News tile does not sufficiently encode user controlled inputs, resulting in Reflected Cross-Site Scripting (XSS) vulnerability. Information maintained in the victim's web browser can be read, modified, and sent to the attacker. The malicious code cannot significantly impact the victim's browser and the victim can easily close the browser tab to terminate it. | ||||
| CVE-2020-26817 | 1 Sap | 1 3d Visual Enterprise Viewer | 2024-11-21 | 7.8 High |
| SAP 3D Visual Enterprise Viewer, version - 9, allows an user to open manipulated HPGL file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation. | ||||
| CVE-2020-26801 | 1 Tripplite | 2 Su2200rtxl2ua, Su2200rtxl2ua Firmware | 2024-11-21 | 5.4 Medium |
| A stored cross-site scripting (XSS) vulnerability was discovered in /Forms/device_vars_1 on TrippLite SU2200RTXL2Ua with firmware version 12.04.0055. This vulnerability allows authenticated attackers to obtain other users' information via a crafted POST request. | ||||
| CVE-2020-26800 | 1 Ethereum | 1 Aleth | 2024-11-21 | 5.5 Medium |
| A stack overflow vulnerability in Aleth Ethereum C++ client version <= 1.8.0 using a specially crafted a config.json file may result in a denial of service. | ||||
| CVE-2020-26797 | 2 Fedoraproject, Mediaarea | 2 Fedora, Mediainfo | 2024-11-21 | 7.5 High |
| Mediainfo before version 20.08 has a heap buffer overflow vulnerability via MediaInfoLib::File_Gxf::ChooseParser_ChannelGrouping. | ||||
| CVE-2020-26772 | 1 Ppgo Jobs Project | 1 Ppgo Jobs | 2024-11-21 | 9.8 Critical |
| Command Injection in PPGo_Jobs v2.8.0 allows remote attackers to execute arbitrary code via the 'AjaxRun()' function. | ||||
| CVE-2020-26768 | 1 Formstone | 1 Formstone | 2024-11-21 | 6.1 Medium |
| Formstone <=1.4.16 is vulnerable to a Reflected Cross-Site Scripting (XSS) vulnerability caused by improper validation of user supplied input in the upload-target.php and upload-chunked.php files. A remote attacker could exploit this vulnerability using a specially crafted URL to execute a script in a victim's Web browser within the security context of the hosting Web site once the URL is clicked or visited. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials, force malware execution, user redirection and others. | ||||
| CVE-2020-26762 | 1 Edimax | 4 Ic-3116w, Ic-3116w Firmware, Ic-3140w and 1 more | 2024-11-21 | 9.8 Critical |
| A stack-based buffer-overflow exists in Edimax IP-Camera IC-3116W (v3.06) and IC-3140W (v3.07), which allows an unauthenticated, unauthorized attacker to perform remote-code-execution due to a crafted GET-Request. The overflow occurs in binary ipcam_cgi due to a missing type check in function doGetSysteminfo(). This has been fixed in version: IC-3116W v3.08. | ||||
| CVE-2020-26733 | 1 Skyworth | 2 Gn542vf, Gn542vf Firmware | 2024-11-21 | 5.4 Medium |
| Cross Site Scripting (XSS) in Configuration page in SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 allows authenticated attacker to inject their own script into the page via DDNS Configuration Section. | ||||
| CVE-2020-26713 | 1 Vanderbilt | 1 Redcap | 2024-11-21 | 6.1 Medium |
| REDCap 10.3.4 contains a XSS vulnerability in the ToDoList function with parameter sort. The information submitted by the user is immediately returned in the response and not escaped leading to the reflected XSS vulnerability. Attackers can exploit vulnerabilities to steal login session information or borrow user rights to perform unauthorized acts. | ||||
| CVE-2020-26707 | 1 Aaptjs Project | 1 Aaptjs | 2024-11-21 | 9.8 Critical |
| An issue was discovered in the add function in Shenzhim AAPTJS 1.3.1 which allows attackers to execute arbitrary code via the filePath parameter. | ||||
| CVE-2020-26701 | 1 Kaaproject | 1 Kaa | 2024-11-21 | 5.4 Medium |
| Cross-site scripting (XSS) vulnerability in Dashboards section in Kaa IoT Platform v1.2.0 allows remote attackers to inject malicious web scripts or HTML Injection payloads via the Description parameter. | ||||
| CVE-2020-26693 | 1 Pfsense | 1 Pfsense | 2024-11-21 | 5.4 Medium |
| A stored cross-site scripting (XSS) vulnerability was discovered in pfSense 2.4.5-p1 which allows an authenticated attacker to execute arbitrary web scripts via exploitation of the load_balancer_monitor.php function. | ||||
| CVE-2020-26680 | 1 Vfairs | 1 Vfairs | 2024-11-21 | 5.4 Medium |
| In vFairs 3.3, any user logged in to a vFairs virtual conference or event can modify any other users profile information to include a cross-site scripting payload. The user data stored by the database includes HTML tags that are intentionally rendered out onto the page, and this can be abused to perform XSS attacks. | ||||
| CVE-2020-26672 | 1 Testimonial Rotator Project | 1 Testimonial Rotator | 2024-11-21 | 5.4 Medium |
| Testimonial Rotator Wordpress Plugin 3.0.2 is affected by Cross Site Scripting (XSS) in /wp-admin/post.php. If a user intercepts a request and inserts a payload in "cite" parameter, the payload will be stored in the database. | ||||
| CVE-2020-26670 | 1 Bigtreecms | 1 Bigtree Cms | 2024-11-21 | 8.8 High |
| A vulnerability has been discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary commands through a crafted request sent to the server via the 'Create a New Setting' function. | ||||
| CVE-2020-26669 | 1 Bigtreecms | 1 Bigtree Cms | 2024-11-21 | 5.4 Medium |
| A stored cross-site scripting (XSS) vulnerability was discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary web scripts or HTML via the page content to site/index.php/admin/pages/update. | ||||
| CVE-2020-26642 | 1 Seacms | 1 Seacms | 2024-11-21 | 6.1 Medium |
| A cross-site scripting (XSS) vulnerability has been discovered in the login page of SeaCMS version 11 which allows an attacker to inject arbitrary web script or HTML. | ||||
| CVE-2020-26609 | 1 Fastadmin | 1 Fastadmin | 2024-11-21 | 5.4 Medium |
| fastadmin V1.0.0.20200506_beta contains a cross-site scripting (XSS) vulnerability which may allow an attacker to obtain administrator credentials to log in to the background. | ||||