Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (43360 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2020-9306 1 Tesla 1 Solarcity Solar Monitoring Gateway 2024-11-21 8.8 High
Tesla SolarCity Solar Monitoring Gateway through 5.46.43 has a "Use of Hard-coded Credentials" issue because Digi ConnectPort X2e uses a .pyc file to store the cleartext password for the python user account.
CVE-2020-9299 1 Netflix 1 Dispatch 2024-11-21 5.4 Medium
There were XSS vulnerabilities discovered and reported in the Dispatch application, affecting name and description parameters of Incident Priority, Incident Type, Tag Type, and Incident Filter. This vulnerability can be exploited by an authenticated user.
CVE-2020-9289 1 Fortinet 2 Fortianalyzer, Fortimanager 2024-11-21 7.5 High
Use of a hard-coded cryptographic key to encrypt password data in CLI configuration in FortiManager 6.2.3 and below, FortiAnalyzer 6.2.3 and below may allow an attacker with access to the CLI configuration or the CLI backup file to decrypt the sensitive data, via knowledge of the hard-coded key.
CVE-2020-9288 1 Fortinet 1 Fortiwlc 2024-11-21 5.4 Medium
An improper neutralization of input vulnerability in FortiWLC 8.5.1 allows a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the ESS profile or the Radius Profile.
CVE-2020-9281 4 Ckeditor, Drupal, Fedoraproject and 1 more 11 Ckeditor, Drupal, Fedora and 8 more 2024-11-21 6.1 Medium
A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).
CVE-2020-9279 1 Dlink 2 Dsl-2640b, Dsl-2640b Firmware 2024-11-21 9.8 Critical
An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devices. A hard-coded account allows management-interface login with high privileges. The logged-in user can perform critical tasks and take full control of the device.
CVE-2020-9092 1 Huawei 2 Mate 20, Mate 20 Firmware 2024-11-21 4.6 Medium
HUAWEI Mate 20 versions earlier than 10.1.0.163(C00E160R3P8) have a JavaScript injection vulnerability. A module does not verify a specific input. This could allow attackers to bypass filter mechanism to launch JavaScript injection. This could compromise normal service of the affected module.
CVE-2020-9056 1 Periscopeholdings 1 Buyspeed 2024-11-21 3.9 Low
Periscope BuySpeed version 14.5 is vulnerable to stored cross-site scripting, which could allow a local, authenticated attacker to store arbitrary JavaScript within the application. This JavaScript is subsequently displayed by the application without sanitization and is executed in the browser of the user, which could possibly cause website redirection, session hijacking, or information disclosure. This vulnerability has been patched in BuySpeed version 15.3.
CVE-2020-9055 1 Versiant 1 Lynx Customer Service Portal 2024-11-21 3.9 Low
Versiant LYNX Customer Service Portal (CSP), version 3.5.2, is vulnerable to stored cross-site scripting, which could allow a local, authenticated attacker to insert malicious JavaScript that is stored and displayed to the end user. This could lead to website redirects, session cookie hijacking, or information disclosure.
CVE-2020-9038 1 Joplin Project 1 Joplin 2024-11-21 5.4 Medium
Joplin through 1.0.184 allows Arbitrary File Read via XSS.
CVE-2020-9036 1 Jeedom 1 Jeedom 2024-11-21 6.1 Medium
Jeedom through 4.0.38 allows XSS.
CVE-2020-9028 1 Microchip 10 Syncserver S100, Syncserver S100 Firmware, Syncserver S200 and 7 more 2024-11-21 6.1 Medium
Symmetricom SyncServer S100 2.90.70.3, S200 1.30, S250 1.25, S300 2.65.0, and S350 2.80.1 devices allow stored XSS via the newUserName parameter on the "User Creation, Deletion and Password Maintenance" screen (when creating a new user).
CVE-2020-9025 1 Iteris 2 Vantage Velocity, Vantage Velocity Firmware 2024-11-21 6.1 Medium
Iteris Vantage Velocity Field Unit 2.4.2 devices have multiple stored XSS issues in all parameters of the Start Data Viewer feature of the /cgi-bin/loaddata.py script.
CVE-2020-9022 1 Cambiumnetworks 8 Xh2-120, Xh2-120 Firmware, Xr2436 and 5 more 2024-11-21 6.1 Medium
An issue was discovered on Xirrus XR520, XR620, XR2436, and XH2-120 devices. The cgi-bin/ViewPage.cgi user parameter allows XSS.
CVE-2020-9019 1 Wpjobboard 1 Wpjobboard 2024-11-21 6.1 Medium
The WPJobBoard plugin 5.5.3 for WordPress allows Persistent XSS via the Add Job form, as demonstrated by title and Description.
CVE-2020-9016 1 Dolibarr 1 Dolibarr Erp\/crm 2024-11-21 5.4 Medium
Dolibarr 11.0 allows XSS via the joinfiles, topic, or code parameter, or the HTTP Referer header.
CVE-2020-9012 1 Gluu 1 Gluu Server 2024-11-21 6.1 Medium
A cross-site scripting (XSS) vulnerability in the Import People functionality in Gluu Identity Configuration 4.0 allows remote attackers to inject arbitrary web script or HTML via the filename parameter.
CVE-2020-9008 1 Blackboard 1 Blackboard Learn 2024-11-21 5.4 Medium
Stored Cross-site scripting (XSS) vulnerability in Blackboard Learn/PeopleTool v9.1 allows users to inject arbitrary web script via the Tile widget in the People Tool profile editor.
CVE-2020-9007 1 Codologic 1 Codoforum 2024-11-21 5.4 Medium
Codoforum 4.8.8 allows self-XSS via the title of a new topic.
CVE-2020-8995 1 Bilanc 1 Bilanc 2024-11-21 9.8 Critical
Programi Bilanc Build 007 Release 014 31.01.2020 supplies a .exe file containing several hardcoded credentials to different servers that allow remote attackers to gain access to the complete infrastructure including the website, update server, and external issue tracking tools.