Export limit exceeded: 419036 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (108400 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2020-10566 | 1 Freebsd | 1 Freebsd | 2024-11-21 | 7.8 High |
| grub2-bhyve, as used in FreeBSD bhyve before revision 525916 2020-02-12, mishandles font loading by a guest through a grub2.cfg file, leading to a buffer overflow. | ||||
| CVE-2020-10565 | 1 Freebsd | 1 Freebsd | 2024-11-21 | 7.8 High |
| grub2-bhyve, as used in FreeBSD bhyve before revision 525916 2020-02-12, does not validate the address provided as part of a memrw command (read_* or write_*) by a guest through a grub2.cfg file. This allows an untrusted guest to perform arbitrary read or write operations in the context of the grub-bhyve process, resulting in code execution as root on the host OS. | ||||
| CVE-2020-10562 | 1 Devome | 1 Grr | 2024-11-21 | 7.2 High |
| An issue was discovered in DEVOME GRR before 3.4.1c. admin_edit_room.php mishandles file uploads. | ||||
| CVE-2020-10557 | 1 Atutor | 1 Acontent | 2024-11-21 | 8.8 High |
| An issue was discovered in AContent through 1.4. It allows the user to run commands on the server with a low-privileged account. The upload section in the file manager page contains an arbitrary file upload vulnerability via upload.php. The extension .php7 bypasses file upload restrictions. | ||||
| CVE-2020-10554 | 1 Psyprax | 1 Psyprax | 2024-11-21 | 7.5 High |
| An issue was discovered in Psyprax beforee 3.2.2. Passwords used to encrypt the data are stored in the database in an obfuscated format, which can be easily reverted. For example, the password AAAAAAAA is stored in the database as MMMMMMMM. | ||||
| CVE-2020-10552 | 1 Psyprax | 1 Psyprax | 2024-11-21 | 8.1 High |
| An issue was discovered in Psyprax before 3.2.2. The Firebird database is accessible with the default user sysdba and password masterke after installation. This allows any user to access it and read and modify the contents, including passwords. Local database files can be accessed directly as well. | ||||
| CVE-2020-10551 | 1 Tencent | 1 Qqbrowser | 2024-11-21 | 7.8 High |
| QQBrowser before 10.5.3870.400 installs a Windows service TsService.exe. This file is writable by anyone belonging to the NT AUTHORITY\Authenticated Users group, which includes all local and remote users. This can be abused by local attackers to escalate privileges to NT AUTHORITY\SYSTEM by writing a malicious executable to the location of TsService. | ||||
| CVE-2020-10540 | 1 Untis | 1 Webuntis | 2024-11-21 | 8.8 High |
| Untis WebUntis before 2020.9.6 allows CSRF for certain combinations of rights and modules. | ||||
| CVE-2020-10537 | 1 Epikur | 1 Epikur | 2024-11-21 | 7.8 High |
| An issue was discovered in Epikur before 20.1.1. A Glassfish 4.1 server with a default configuration is running on TCP port 4848. No password is required to access it with the administrator account. | ||||
| CVE-2020-10532 | 1 Watchguard | 1 Ad Helper Firmware | 2024-11-21 | 7.5 High |
| The AD Helper component in WatchGuard Fireware before 5.8.5.10317 allows remote attackers to discover cleartext passwords via the /domains/list URI. | ||||
| CVE-2020-10519 | 1 Github | 1 Github | 2024-11-21 | 8.8 High |
| A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration of the underlying parsers used by GitHub Pages were not sufficiently restricted and made it possible to execute commands on the GitHub Enterprise Server instance. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 2.22.7 and was fixed in 2.22.7, 2.21.15, and 2.20.24. The underlying issues contributing to this vulnerability were identified through the GitHub Security Bug Bounty program. | ||||
| CVE-2020-10518 | 1 Github | 1 Github | 2024-11-21 | 8.8 High |
| A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration of the underlying parsers used by GitHub Pages were not sufficiently restricted and made it possible to execute commands on the GitHub Enterprise Server instance. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 2.22 and was fixed in 2.21.6, 2.20.15, and 2.19.21. The underlying issues contributing to this vulnerability were identified both internally and through the GitHub Security Bug Bounty program. | ||||
| CVE-2020-10514 | 1 Icatchinc | 1 Dvr Firmware | 2024-11-21 | 8.8 High |
| iCatch DVR firmware before 20200103 do not validate function parameter properly, resulting attackers executing arbitrary command. | ||||
| CVE-2020-10513 | 1 Icatchinc | 1 Dvr Interface | 2024-11-21 | 8.8 High |
| The file management interface of iCatch DVR firmware before 20200103 contains broken access control which allows the attacker to remotely manipulate arbitrary file. | ||||
| CVE-2020-10512 | 1 Hgiga | 1 Oaklouds Ccm\@il | 2024-11-21 | 8.8 High |
| HGiga C&Cmail CCMAILQ before olln-calendar-6.0-100.i386.rpm and CCMAILN before olln-calendar-5.0-100.i386.rpm contains a SQL Injection vulnerability which allows attackers to injecting SQL commands in the URL parameter to execute unauthorized commands. | ||||
| CVE-2020-10510 | 1 Sun | 1 Ehrd | 2024-11-21 | 8.1 High |
| Sunnet eHRD, a human training and development management system, contains a vulnerability of Broken Access Control. After login, attackers can use a specific URL, access unauthorized functionality and data. | ||||
| CVE-2020-10508 | 1 Sun | 1 Ehrd | 2024-11-21 | 7.5 High |
| Sunnet eHRD, a human training and development management system, improperly stores system files. Attackers can use a specific URL and capture confidential information. | ||||
| CVE-2020-10506 | 1 The School Manage System Project | 1 The School Manage System | 2024-11-21 | 7.5 High |
| The School Manage System before 2020, developed by ALLE INFORMATION CO., LTD., contains a vulnerability of Path Traversal, allowing attackers to access arbitrary files. | ||||
| CVE-2020-10478 | 1 Chadhaajay | 1 Phpkb | 2024-11-21 | 8.8 High |
| CSRF in admin/manage-settings.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to change the global settings, potentially gaining code execution or causing a denial of service, via a crafted request. | ||||
| CVE-2020-10390 | 1 Chadhaajay | 1 Phpkb | 2024-11-21 | 7.2 High |
| OS Command Injection in export.php (vulnerable function called from include/functions-article.php) in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to achieve Code Execution by saving the code to be executed as the wkhtmltopdf path via admin/save-settings.php. | ||||