35,538 results · Clear filters · Feed
-
Medium 6.1CVE-2020-29204 Public exploit
Cross-site Scripting in XXL-JOB
XXL-JOB 2.2.0 allows Stored XSS (in Add User) to bypass the 20-character limit via xxl-job-admin/src/main/java/com/xxl/job/admin/controller/UserController.java.
-
Unscored —
KLog Server 2.4.1 allows OS command injection via shell metacharacters in the actions/authenticate.php user parameter.
-
High 8.1
Serialization gadget exploit in jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).
-
Unscored —CVE-2020-8290 Public exploit
Backblaze for Windows and Backblaze for macOS before 7.0.0.439 suffer from improper privilege management in `bztransmit…
-
Unscored —CVE-2020-8289 Public exploit
Backblaze for Windows before 7.0.1.433 and Backblaze for macOS before 7.0.1.434 suffer from improper certificate valida…
-
Unscored —CVE-2020-35437 Public exploit
Subrion CMS 4.2.1 is affected by: Cross Site Scripting (XSS) through the avatar[path] parameter in a POST request to th…
-
Unscored —CVE-2020-35575 Public exploit
A password-disclosure issue in the web interface on certain TP-Link devices allows a remote attacker to get full admini…
-
Unscored —
Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote attackers to execute arbitrary commands or set a new pass…
-
Unscored —CVE-2020-28169 Public exploit
The td-agent-builder plugin before 2020-12-18 for Fluentd allows attackers to gain privileges because the bin directory…
-
Medium 6.1CVE-2020-35669 Public exploit
http before 0.13.3 vulnerable to header injection
An issue was discovered in the http package through 0.12.2 for Dart. If the attacker controls the HTTP method and the app is using Request directly, it's possible to achieve CRLF injection in an HTTP request.
-
Unscored —
Remote Command Execution (RCE) vulnerability in TerraMaster TOS <= 4.2.06 allow remote unauthenticated attackers to inj…
-
Unscored —
ACS Advanced Comment System 1.0 is affected by Directory Traversal via an advanced_component_system/index.php?ACS_path=…
-
Unscored —
An unauthenticated command-execution vulnerability exists in TerraMaster TOS through 4.2.06 via shell metacharacters in…
-
Critical 9.8
Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The …
KEV Nov 3, 2021 -
Unscored —CVE-2020-35151 Public exploit
The Online Marriage Registration System 1.0 post parameter "searchdata" in the user/search.php request is vulnerable to…
-
Unscored —
Arbitrary command execution can occur in Webmin through 1.962. Any user authorized for the Package Updates module can e…
-
Unscored —CVE-2020-21378 Public exploit
SQL injection vulnerability in SeaCMS 10.1 (2020.02.08) via the id parameter in an edit action to admin_members_group.p…
-
Unscored —CVE-2020-25860 Public exploit
The install.c module in the Pengutronix RAUC update client prior to version 1.5 has a Time-of-Check Time-of-Use vulnera…
-
Unscored —CVE-2020-35590 Public exploit
LimitLoginAttempts.php in the limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows a bypass of (per …
-
Unscored —
A potential security vulnerability has been identified in HPE Systems Insight Manager (SIM) version 7.6. The vulnerabil…
-
High 8.8CVE-2020-13519 Public exploit
A privilege escalation vulnerability exists in the WinRing0x64 Driver IRP 0x9c402088 functionality of NZXT CAM 4.8.0. A…
-
Unscored —
There are multiple unauthenticated directory traversal vulnerabilities in different FTP commands in uftpd FTP server ve…
-
Unscored —CVE-2020-25901 Public exploit
Host Header Injection in Spiceworks 7.5.7.0 allowing the attacker to render arbitrary links that point to a malicious w…
-
Unscored —
A reflected Cross-site scripting (XSS) vulnerability in Xinuo (formerly SCO) Openserver version 5 and 6 allows remote a…
-
Unscored —
Xinuos (formerly SCO) Openserver v5 and v6 allows attackers to execute arbitrary commands via shell metacharacters in o…
-
High 8.1CVE-2020-28052 Public exploit
Logic error in Legion of the Bouncy Castle BC Java
An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed…
-
Unscored —CVE-2020-20139 Public exploit
Cross Site Scripting (XSS) vulnerability in the Remote JSON component Under the Connect menu in Flexmonster Pivot Table…
-
Unscored —CVE-2020-20140 Public exploit
Cross Site Scripting (XSS) vulnerability in Remote Report component under the Open menu in Flexmonster Pivot Table & Ch…
-
Unscored —CVE-2020-20141 Public exploit
Cross Site Scripting (XSS) vulnerability in the To OLAP (XMLA) component Under the Connect menu in Flexmonster Pivot Ta…
-
Unscored —CVE-2020-20142 Public exploit
Cross Site Scripting (XSS) vulnerability in the "To Remote CSV" component under "Open" Menu in Flexmonster Pivot Table …
-
Unscored —CVE-2020-35545 Public exploit
Time-based SQL injection exists in Spotweb 1.4.9 via the query string.
-
Unscored —
The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote co…
-
Unscored —CVE-2020-27199 Public exploit
The Magic Home Pro application 1.5.1 for Android allows Authentication Bypass. The security control that the applicatio…
-
Unscored —CVE-2020-35191 Public exploit
The official drupal docker images before 8.5.10-fpm-alpine (Alpine specific) contain a blank password for a root user. …
-
Unscored —
A file upload restriction bypass vulnerability in Pluck CMS before 4.7.13 allows an admin privileged user to gain acces…
-
High 7.3CVE-2020-28458 Public exploit
Prototype Pollution
All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806.
-
Medium 6.3
Server-Side Forgery Request can be activated unmarshalling with XStream
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from interna…
-
Medium 6.8
XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow a remote attacker to delete arbitrary know fi…
-
Critical 9.8
OS Command Injection in OpenTSDB
A remote code execution vulnerability occurs in OpenTSDB through 2.4.0 via command injection in the yrange parameter. The yrange value is written to a gnuplot file in the /tmp directory. This file is then executed via the mygnuplot.sh shell script. (tsd/Graph…
-
Unscored —CVE-2020-35416 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities exist in PHPJabbers Appointment Scheduler 2.3, in the index.php adm…