Export limit exceeded: 47137 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (47137 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2020-25005 | 1 Heybbs Project | 1 Heybbs | 2024-11-21 | 9.8 Critical |
| Heybbs v1.2 has a SQL injection vulnerability in msg.php file via the ID parameter which may allow a remote attacker to execute arbitrary code. | ||||
| CVE-2020-25004 | 1 Heybbs Project | 1 Heybbs | 2024-11-21 | 9.8 Critical |
| Heybbs v1.2 has a SQL injection vulnerability in user.php file via the ID parameter which may allow a remote attacker to execute arbitrary code. | ||||
| CVE-2020-24985 | 1 Quadbase | 1 Espressdashboard | 2024-11-21 | 8.1 High |
| An issue was discovered in Quadbase EspressReports ES 7 Update 9. An authenticated user is able to navigate to the MenuPage section of the application, and change the frmsrc parameter value to retrieve and execute external files or payloads. | ||||
| CVE-2020-24950 | 1 Thedaylightstudio | 1 Fuel Cms | 2024-11-21 | 8.8 High |
| SQL Injection vulnerability in file Base_module_model.php in Daylight Studio FUEL-CMS version 1.4.9, allows remote attackers to execute arbitrary code via the col parameter to function list_items. | ||||
| CVE-2020-24944 | 1 Privateoctopus | 1 Picoquic | 2024-11-21 | 7.5 High |
| picoquic (before 3rd of July 2020) allows attackers to cause a denial of service (infinite loop) via a crafted QUIC frame, related to the picoquic_decode_frames and picoquic_decode_stream_frame functions and epoch==3. | ||||
| CVE-2020-24941 | 1 Laravel | 1 Laravel | 2024-11-21 | 7.5 High |
| An issue was discovered in Laravel before 6.18.35 and 7.x before 7.24.0. The $guarded property is mishandled in some situations involving requests with JSON column nesting expressions. | ||||
| CVE-2020-24928 | 1 Premid | 1 Premid | 2024-11-21 | 5.3 Medium |
| managers/socketManager.ts in PreMiD through 2.1.3 has a locally hosted socketio web server (port 3020) open to all origins, which allows attackers to obtain sensitive Discord user information. | ||||
| CVE-2020-24877 | 1 Zzzcms | 1 Zzzphp | 2024-11-21 | 9.8 Critical |
| A SQL injection vulnerability in zzzphp v1.8.0 through /form/index.php?module=getjson may lead to a possible access restriction bypass. | ||||
| CVE-2020-24862 | 1 Pharmacy Medical Store And Sale Point Project | 1 Pharmacy Medical Store And Sale Point | 2024-11-21 | 7.5 High |
| The catID parameter in Pharmacy Medical Store and Sale Point v1.0 has been found to be vulnerable to a Time-Based blind SQL injection via the /medical/inventories.php path which allows attackers to retrieve all databases. | ||||
| CVE-2020-24841 | 1 Sdg | 1 Pnpscada | 2024-11-21 | 9.8 Critical |
| PNPSCADA 2.200816204020 allows SQL injection via parameter 'interf' in /browse.jsp. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. | ||||
| CVE-2020-24791 | 1 Thedaylightstudio | 1 Fuel Cms | 2024-11-21 | 9.8 Critical |
| FUEL CMS 1.4.8 allows SQL injection via the 'fuel_replace_id' parameter in pages/replace/1. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. | ||||
| CVE-2020-24771 | 1 Nexusphp | 1 Nexusphp | 2024-11-21 | 7.5 High |
| Incorrect access control in NexusPHP 1.5.beta5.20120707 allows unauthorized attackers to access published content. | ||||
| CVE-2020-24770 | 1 Nexusphp | 1 Nexusphp | 2024-11-21 | 9.8 Critical |
| SQL injection vulnerability in modrules.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the id parameter. | ||||
| CVE-2020-24769 | 1 Nexusphp | 1 Nexusphp | 2024-11-21 | 9.8 Critical |
| SQL injection vulnerability in takeconfirm.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the classes parameter. | ||||
| CVE-2020-24718 | 4 Freebsd, Netapp, Omniosce and 1 more | 4 Freebsd, Clustered Data Ontap, Omnios and 1 more | 2024-11-21 | 8.2 High |
| bhyve, as used in FreeBSD through 12.1 and illumos (e.g., OmniOS CE through r151034 and OpenIndiana through Hipster 2020.04), does not properly restrict VMCS and VMCB read/write operations, as demonstrated by a root user in a container on an Intel system, who can gain privileges by modifying VMCS_HOST_RIP. | ||||
| CVE-2020-24716 | 2 Freebsd, Openzfs | 2 Freebsd, Openzfs | 2024-11-21 | 7.8 High |
| OpenZFS before 2.0.0-rc1, when used on FreeBSD, allows execute permissions for all directories. | ||||
| CVE-2020-24674 | 1 Abb | 2 Symphony \+ Historian, Symphony \+ Operations | 2024-11-21 | 8.8 High |
| In S+ Operations and S+ Historian, not all client commands correctly check user permission as expected. Authenticated but Unauthorized remote users could execute a Denial-of-Service (DoS) attack, execute arbitrary code, or obtain more privilege than intended on the machines. | ||||
| CVE-2020-24673 | 1 Abb | 2 Symphony \+ Historian, Symphony \+ Operations | 2024-11-21 | 9.8 Critical |
| In S+ Operations and S+ Historian, a successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database (such as shutdown the DBMS), recover the content of a given file present on the DBMS file system and in some cases issue commands to the operating system. This can lead to a loss of confidentiality and data integrity or even affect the product behavior and its availability. | ||||
| CVE-2020-24672 | 1 Abb | 1 Base Software | 2024-11-21 | 9.8 Critical |
| A vulnerability in Base Software for SoftControl allows an attacker to insert and run arbitrary code in a computer running the affected product. This issue affects: . | ||||
| CVE-2020-24671 | 1 Tracefinanacial | 1 Crestbridge | 2024-11-21 | 8.8 High |
| Trace Financial CRESTBridge <6.3.0.02 contains an authenticated SQL injection vulnerability, which was fixed in 6.3.0.03. | ||||