Export limit exceeded: 95398 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (95398 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2020-28578 | 1 Trendmicro | 1 Interscan Web Security Virtual Appliance | 2024-11-21 | 9.8 Critical |
| A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an unauthenticated, remote attacker to send a specially crafted HTTP message and achieve remote code execution with elevated privileges. | ||||
| CVE-2020-28575 | 1 Trendmicro | 1 Serverprotect | 2024-11-21 | 6.7 Medium |
| A heap-based buffer overflow privilege escalation vulnerability in Trend Micro ServerProtect for Linux 3.0 may allow an attacker to escalate privileges on affected installations. An attacker must first obtain the ability to execute high-privileged code on the target in order to exploit this vulnerability. | ||||
| CVE-2020-28494 | 1 Totaljs | 1 Total.js | 2024-11-21 | 8.6 High |
| This affects the package total.js before 3.4.7. The issue occurs in the image.pipe and image.stream functions. The type parameter is used to build the command that is then executed using child_process.spawn. The issue occurs because child_process.spawn is called with the option shell set to true and because the type parameter is not properly sanitized. | ||||
| CVE-2020-28491 | 4 Fasterxml, Oracle, Quarkus and 1 more | 11 Jackson-dataformats-binary, Weblogic Server, Quarkus and 8 more | 2024-11-21 | 7.5 High |
| This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1. Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception. | ||||
| CVE-2020-28490 | 1 Async-git Project | 1 Async-git | 2024-11-21 | 9.1 Critical |
| The package async-git before 1.13.2 are vulnerable to Command Injection via shell meta-characters (back-ticks). For example: git.reset('atouch HACKEDb') | ||||
| CVE-2020-28487 | 1 Visjs | 1 Vis-timeline | 2024-11-21 | 6.8 Medium |
| This affects the package vis-timeline before 7.4.4. An attacker with the ability to control the items of a Timeline element can inject additional script code into the generated application. | ||||
| CVE-2020-28482 | 1 Fastify | 1 Fastify-csrf | 2024-11-21 | 5.9 Medium |
| This affects the package fastify-csrf before 3.0.0. 1. The generated cookie used insecure defaults, and did not have the httpOnly flag on: cookieOpts: { path: '/', sameSite: true } 2. The CSRF token was available in the GET query parameter | ||||
| CVE-2020-28470 | 1 Scully | 1 Scully | 2024-11-21 | 7.3 High |
| This affects the package @scullyio/scully before 1.0.9. The transfer state is serialised with the JSON.stringify() function and then written into the HTML page. | ||||
| CVE-2020-28468 | 1 Pwntools Project | 1 Pwntools | 2024-11-21 | 8.1 High |
| This affects the package pwntools before 4.3.1. The shellcraft generator for affected versions of this module are vulnerable to Server-Side Template Injection (SSTI), which can lead to remote code execution. | ||||
| CVE-2020-28459 | 1 Markdown-it-decorate Project | 1 Markdown-it-decorate | 2024-11-21 | 7.3 High |
| This affects all versions of package markdown-it-decorate. An attacker can add an event handler or use javascript:xxx for the link. | ||||
| CVE-2020-28457 | 1 S-cart | 1 S-cart | 2024-11-21 | 7.2 High |
| This affects the package s-cart/core before 4.4. The search functionality of the admin dashboard in core/src/Admin/Controllers/AdminOrderController.phpindex is vulnerable to XSS. | ||||
| CVE-2020-28456 | 1 S-cart | 1 S-cart | 2024-11-21 | 7.3 High |
| The package s-cart/core before 4.4 are vulnerable to Cross-site Scripting (XSS) via the admin panel. | ||||
| CVE-2020-28455 | 1 Markdown-it-toc Project | 1 Markdown-it-toc | 2024-11-21 | 7.3 High |
| This affects all versions of package markdown-it-toc. The title of the generated toc and the contents of the header are not escaped. | ||||
| CVE-2020-28453 | 1 Npos-tesseract Project | 1 Npos-tesseract | 2024-11-21 | 9.4 Critical |
| This affects all versions of package npos-tesseract. The injection point is located in line 55 in lib/ocr.js. | ||||
| CVE-2020-28451 | 1 Image-tiler Project | 1 Image-tiler | 2024-11-21 | 9.8 Critical |
| This affects the package image-tiler before 2.0.2. | ||||
| CVE-2020-28447 | 1 Xopen Project | 1 Xopen | 2024-11-21 | 9.8 Critical |
| This affects all versions of package xopen. The injection point is located in line 14 in index.js in the exported function xopen(filepath) | ||||
| CVE-2020-28446 | 1 Ntesseract Project | 1 Ntesseract | 2024-11-21 | 9.8 Critical |
| The package ntesseract before 0.2.9 are vulnerable to Command Injection via lib/tesseract.js. | ||||
| CVE-2020-28445 | 1 Npm-help Project | 1 Npm-help | 2024-11-21 | 9.8 Critical |
| This affects all versions of package npm-help. The injection point is located in line 13 in index.js file in export.latestVersion() function. | ||||
| CVE-2020-28443 | 1 Sonar-wrapper Project | 1 Sonar-wrapper | 2024-11-21 | 9.8 Critical |
| This affects all versions of package sonar-wrapper. The injection point is located in lib/sonarRunner.js. | ||||
| CVE-2020-28440 | 1 Corenlp-js-interface Project | 1 Corenlp-js-interface | 2024-11-21 | 9.8 Critical |
| All versions of package corenlp-js-interface are vulnerable to Command Injection via the main function. | ||||