Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (76144 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2020-12790 1 Nystudio107 1 Seomatic 2024-11-21 7.5 High
In the SEOmatic plugin before 3.2.49 for Craft CMS, helpers/DynamicMeta.php does not properly sanitize the URL. This leads to Server-Side Template Injection and credentials disclosure via a crafted Twig template after a semicolon.
CVE-2020-12789 1 Microchip 152 Atsama5d21c-cu, Atsama5d21c-cu Firmware, Atsama5d21c-cur and 149 more 2024-11-21 7.5 High
The Secure Monitor in Microchip Atmel ATSAMA5 products use a hardcoded key to encrypt and authenticate secure applets.
CVE-2020-12788 1 Microchip 152 Atsama5d21c-cu, Atsama5d21c-cu Firmware, Atsama5d21c-cur and 149 more 2024-11-21 7.5 High
CMAC verification functionality in Microchip Atmel ATSAMA5 products is vulnerable to vulnerable to timing and power analysis attacks.
CVE-2020-12787 1 Microchip 152 Atsama5d21c-cu, Atsama5d21c-cu Firmware, Atsama5d21c-cur and 149 more 2024-11-21 7.5 High
Microchip Atmel ATSAMA5 products in Secure Mode allow an attacker to bypass existing security mechanisms related to applet handling.
CVE-2020-12785 1 Cpanel 1 Cpanel 2024-11-21 8.1 High
cPanel before 86.0.14 allows attackers to obtain access to the current working directory via the account backup feature (SEC-540).
CVE-2020-12783 4 Canonical, Debian, Exim and 1 more 4 Ubuntu Linux, Debian Linux, Exim and 1 more 2024-11-21 7.5 High
Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and auths/auth-spa.c.
CVE-2020-12780 1 Combodo 1 Itop 2024-11-21 7.5 High
A security misconfiguration exists in Combodo iTop, which can expose sensitive information.
CVE-2020-12778 1 Combodo 1 Itop 2024-11-21 7.4 High
Combodo iTop does not validate inputted parameters, attackers can inject malicious commands and launch XSS attack.
CVE-2020-12777 1 Combodo 1 Itop 2024-11-21 7.5 High
A function in Combodo iTop contains a vulnerability of Broken Access Control, which allows unauthorized attacker to inject command and disclose system information.
CVE-2020-12774 1 Dlink 2 Dsl-7740c, Dsl-7740c Firmware 2024-11-21 8.2 High
D-Link DSL-7740C does not properly validate user input, which allows an authenticated LAN user to inject arbitrary command.
CVE-2020-12772 2 Igniterealtime, Microsoft 2 Spark, Windows 2024-11-21 8.8 High
An issue was discovered in Ignite Realtime Spark 2.8.3 (and the ROAR plugin for it) on Windows. A chat message can include an IMG element with a SRC attribute referencing an external host's IP address. Upon access to this external host, the (NT)LM hashes of the user are sent with the HTTP request. This allows an attacker to collect these hashes, crack them, and potentially compromise the computer. (ROAR can be configured for automatic access. Also, access can occur if the user clicks.)
CVE-2020-12760 1 Opennms 2 Opennms Horizon, Opennms Meridian 2024-11-21 8.8 High
An issue was discovered in OpenNMS Horizon before 26.0.1, and Meridian before 2018.1.19 and 2019 before 2019.1.7. The ActiveMQ channel configuration allowed for arbitrary deserialization of Java objects (aka ActiveMQ Minion payload deserialization), leading to remote code execution for any authenticated channel user regardless of its assigned permissions.
CVE-2020-12758 1 Hashicorp 1 Consul 2024-11-21 7.5 High
HashiCorp Consul and Consul Enterprise could crash when configured with an abnormally-formed service-router entry. Introduced in 1.6.0, fixed in 1.6.6 and 1.7.4.
CVE-2020-12754 1 Google 1 Android 2024-11-21 7.8 High
An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 software. A crafted application can obtain control of device input via the window system service. The LG ID is LVE-SMP-170011 (May 2020).
CVE-2020-12752 1 Google 1 Android 2024-11-21 7.5 High
An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (with TEEGRIS) software. Attackers can determine user credentials via a brute-force attack against the Gatekeeper trustlet. The Samsung ID is SVE-2020-16908 (May 2020).
CVE-2020-12751 1 Google 1 Android 2024-11-21 7.8 High
An issue was discovered on Samsung mobile devices with O(8.X), P(9.0), and Q(10.0) software. The Quram image codec library allows attackers to overwrite memory and execute arbitrary code via crafted JPEG data that is mishandled during decoding. The Samsung ID is SVE-2020-16943 (May 2020).
CVE-2020-12750 1 Google 1 Android 2024-11-21 7.5 High
An issue was discovered on Samsung mobile devices with Q(10.0) software. Attackers can bypass Factory Reset Protection (FRP) via SPEN. The Samsung ID is SVE-2020-17019 (May 2020).
CVE-2020-12749 1 Google 1 Android 2024-11-21 7.8 High
An issue was discovered on Samsung mobile devices with P(9.0) (Exynos chipsets) software. The S.LSI Wi-Fi drivers have a buffer overflow. The Samsung ID is SVE-2020-16906 (May 2020).
CVE-2020-12745 1 Google 1 Android 2024-11-21 7.5 High
An issue was discovered on Samsung mobile devices with Q(10.0) software. Attackers can bypass the locked-state protection mechanism and access clipboard content via USSD. The Samsung ID is SVE-2019-16556 (May 2020).
CVE-2020-12736 1 Code42 1 Code42 2024-11-21 7.2 High
Code42 environments with on-premises server versions 7.0.4 and earlier allow for possible remote code execution. When an administrator creates a local (non-SSO) user via a Code42-generated email, the administrator has the option to modify content for the email invitation. If the administrator entered template language code in the subject line, that code could be interpreted by the email generation services, potentially resulting in server-side code injection.