92846 matches found
CVE-2020-28715
An issue was discovered in kdmserver service in LeEco LeTV X43 version V2401RCN02C080080B04121S, allows attackers to execute arbitrary code, escalate privileges, and cause a denial of service DoS...
CVE-2020-13093
iSpyConnect.com Agent DVR before 2.7.1.0 allows directory traversal...
CVE-2020-15018
playSMS through 1.4.3 is vulnerable to session fixation...
CVE-2020-6623
stb stbtruetype.h through 1.22 has an assertion failure in stbttcffgetindex...
CVE-2020-18114
An arbitrary file upload vulnerability in the /uploads/dede component of DedeCMS V5.7SP2 allows attackers to upload a webshell in HTM format...
CVE-2020-25188
An attacker who convinces a valid user to open a specially crafted project file to exploit could execute code under the privileges of the application due to an out-of-bounds read vulnerability on the LAquis SCADA Versions prior to 4.3.1.870...
CVE-2020-18151
Cross Site Request Forgery CSRF vulnerability in ThinkCMF v5.1.0, which can add an admin account...
CVE-2020-1217
An information disclosure vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime Information Disclosure Vulnerability'...
CVE-2020-15309
An issue was discovered in wolfSSL before 4.5.0, when single precision is not employed. Local attackers can conduct a cache-timing attack against public key operations. These attackers may already have obtained sensitive information if the affected system has been used for private key operations...
CVE-2020-25175
GE Healthcare Imaging and Ultrasound Products may allow specific credentials to be exposed during transport over the network...
CVE-2020-14958
In Gogs 0.11.91, MakeEmailPrimary in models/usermail.go lacks a "not the owner of the email" check...
CVE-2020-7192
A devicethresholdconfig expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center iMC versions: Prior to iMC PLAT 7.3 E0705P07...
CVE-2020-1788
Honor V30 smartphones with versions earlier than 10.0.1.135C00E130R4P1 have an improper authentication vulnerability. Certain applications do not properly validate the identity of another application who would call its interface. An attacker could trick the user into installing a malicious...
CVE-2020-12071
Anchor 0.12.7 allows admins to cause XSS via crafted post content...
CVE-2020-22876
Buffer Overflow vulnerability in quickjs.c in QuickJS, allows remote attackers to cause denial of service. This issue is resolved in the 2020-07-05 release...
CVE-2020-19767
A lack of target address verification in the destroycontract function of 0xRACER 1.0 allows attackers to steal tokens from victim users via a crafted script...
CVE-2020-10821
Nagios XI 5.6.11 allows XSS via the account/main.php theme parameter...
CVE-2020-12646
OX App Suite 7.10.3 and earlier allows XSS via text/x-javascript, text/rdf, or a PDF document...
CVE-2020-29547
An issue was discovered in Citadel through webcit-926. Meddler-in-the-middle attackers can pipeline commands after POP3 STLS, IMAP STARTTLS, or SMTP STARTTLS commands, injecting cleartext commands into an encrypted user session. This can lead to credential disclosure...