Export limit exceeded: 383322 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (383322 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2020-12715 | 1 Rainbowfishsoftware | 1 Pacsone Server | 2024-11-21 | 8.8 High |
| RainbowFish PacsOne Server 6.8.4 has Incorrect Access Control. | ||||
| CVE-2020-12714 | 1 Ciphermail | 2 Gateway, Webmail Messenger | 2024-11-21 | 5.9 Medium |
| An issue was discovered in CipherMail Community Gateway Virtual Appliances and Professional/Enterprise Gateway Virtual Appliances versions 1.0.1 through 4.7.1-0 and CipherMail Webmail Messenger Virtual Appliances 1.1.1 through 3.1.1-0. A Diffie-Hellman parameter of insufficient size could allow man-in-the-middle compromise of communications between CipherMail products and external SMTP clients. | ||||
| CVE-2020-12713 | 1 Ciphermail | 2 Gateway, Webmail Messenger | 2024-11-21 | 7.2 High |
| An issue was discovered in CipherMail Community Gateway and Professional/Enterprise Gateway 1.0.1 through 4.7.1-0 and CipherMail Webmail Messenger 1.1.1 through 3.1.1-0. Attackers with administrative access to the web interface have multiple options to escalate their privileges to the Unix root account. | ||||
| CVE-2020-12712 | 1 Sos-berlin | 1 Jobscheduler | 2024-11-21 | 7.5 High |
| A vulnerability based on insecure user/password encryption in the JOE (job editor) component of SOS JobScheduler 1.12 and 1.13 allows attackers to decrypt the user/password that is optionally stored with a user's profile. | ||||
| CVE-2020-12708 | 1 Php-fusion | 1 Php-fusion | 2024-11-21 | 6.1 Medium |
| Multiple cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the cat_id parameter to downloads/downloads.php or article.php. NOTE: this might overlap CVE-2012-6043. | ||||
| CVE-2020-12707 | 1 Lepton-cms | 1 Lepton Cms | 2024-11-21 | 6.1 Medium |
| An XSS vulnerability exists in modules/wysiwyg/save.php of LeptonCMS 4.5.0. This can be exploited because the only security measure used against XSS is the stripping of SCRIPT elements. A malicious actor can use HTML event handlers to run JavaScript instead of using SCRIPT elements. | ||||
| CVE-2020-12706 | 1 Php-fusion | 1 Php-fusion | 2024-11-21 | 5.4 Medium |
| Multiple Cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the go parameter to faq/faq_admin.php or shoutbox_panel/shoutbox_admin.php | ||||
| CVE-2020-12705 | 1 Lepton-cms | 1 Leptoncms | 2024-11-21 | 6.1 Medium |
| Multiple cross-site scripting (XSS) vulnerabilities exist in LeptonCMS before 4.6.0. | ||||
| CVE-2020-12704 | 1 Ulicms | 1 Ulicms | 2024-11-21 | 6.1 Medium |
| UliCMS before 2020.2 has PageController stored XSS. | ||||
| CVE-2020-12703 | 1 Ulicms | 1 Ulicms | 2024-11-21 | 6.1 Medium |
| UliCMS before 2020.2 has XSS during PackageController uninstall. | ||||
| CVE-2020-12702 | 1 Coolkit | 1 Ewelink | 2024-11-21 | 4.6 Medium |
| Weak encryption in the Quick Pairing mode in the eWeLink mobile application (Android application V4.9.2 and earlier, iOS application V4.9.1 and earlier) allows physically proximate attackers to eavesdrop on Wi-Fi credentials and other sensitive information by monitoring the Wi-Fi spectrum during the pairing process. | ||||
| CVE-2020-12700 | 1 Dkd | 1 Direct Mail | 2024-11-21 | 4.3 Medium |
| The direct_mail extension through 5.2.3 for TYPO3 allows Information Disclosure via a newsletter subscriber data Special Query. | ||||
| CVE-2020-12699 | 1 Dkd | 1 Direct Mail | 2024-11-21 | 6.1 Medium |
| The direct_mail extension through 5.2.3 for TYPO3 has an Open Redirect via jumpUrl. | ||||
| CVE-2020-12698 | 1 Dkd | 1 Direct Mail | 2024-11-21 | 4.3 Medium |
| The direct_mail extension through 5.2.3 for TYPO3 has Broken Access Control for newsletter subscriber tables. | ||||
| CVE-2020-12697 | 1 Dkd | 1 Direct Mail | 2024-11-21 | 5.3 Medium |
| The direct_mail extension through 5.2.3 for TYPO3 allows Denial of Service via log entries. | ||||
| CVE-2020-12696 | 1 Iframe Project | 1 Iframe | 2024-11-21 | 6.1 Medium |
| The iframe plugin before 4.5 for WordPress does not sanitize a URL. | ||||
| CVE-2020-12695 | 22 Asus, Broadcom, Canon and 19 more | 218 Rt-n11, Adsl, Selphy Cp1200 and 215 more | 2024-11-21 | 7.5 High |
| The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue. | ||||
| CVE-2020-12693 | 4 Debian, Fedoraproject, Opensuse and 1 more | 4 Debian Linux, Fedora, Leap and 1 more | 2024-11-21 | 8.1 High |
| Slurm 19.05.x before 19.05.7 and 20.02.x before 20.02.3, in the rare case where Message Aggregation is enabled, allows Authentication Bypass via an Alternate Path or Channel. A race condition allows a user to launch a process as an arbitrary user. | ||||
| CVE-2020-12692 | 3 Canonical, Openstack, Redhat | 3 Ubuntu Linux, Keystone, Openstack | 2024-11-21 | 5.4 Medium |
| An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can sniff the Authorization header, and then use it to reissue an OpenStack token an unlimited number of times. | ||||
| CVE-2020-12691 | 3 Canonical, Openstack, Redhat | 3 Ubuntu Linux, Keystone, Openstack | 2024-11-21 | 8.8 High |
| An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any authenticated user can create an EC2 credential for themselves for a project that they have a specified role on, and then perform an update to the credential user and project, allowing them to masquerade as another user. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges. | ||||