Export limit exceeded: 370024 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (370024 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2020-13909 | 1 Facade | 1 Ignition | 2024-11-21 | 9.8 Critical |
| The Ignition component before 2.0.5 for Laravel mishandles globals, _get, _post, _cookie, and _env. NOTE: in the 1.x series, versions 1.16.15 and later are unaffected as a consequence of the CVE-2021-43996 fix. | ||||
| CVE-2020-13906 | 1 Irfanview | 1 Irfanview | 2024-11-21 | 7.8 High |
| IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!GetPlugInInfo+0x0000000000038eb7. | ||||
| CVE-2020-13905 | 1 Irfanview | 1 Irfanview | 2024-11-21 | 8.8 High |
| IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!GetPlugInInfo+0x0000000000038ed4. | ||||
| CVE-2020-13904 | 3 Canonical, Debian, Ffmpeg | 3 Ubuntu Linux, Debian Linux, Ffmpeg | 2024-11-21 | 5.5 Medium |
| FFmpeg 2.8 and 4.2.3 has a use-after-free via a crafted EXTINF duration in an m3u8 file because parse_playlist in libavformat/hls.c frees a pointer, and later that pointer is accessed in av_probe_input_format3 in libavformat/format.c. | ||||
| CVE-2020-13902 | 1 Imagemagick | 1 Imagemagick | 2024-11-21 | 7.1 High |
| ImageMagick 7.0.9-27 through 7.0.10-17 has a heap-based buffer over-read in BlobToStringInfo in MagickCore/string.c during TIFF image decoding. | ||||
| CVE-2020-13901 | 1 Meetecho | 1 Janus | 2024-11-21 | 9.8 Critical |
| An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. janus_sdp_merge in sdp.c has a stack-based buffer overflow. | ||||
| CVE-2020-13900 | 1 Meetecho | 1 Janus | 2024-11-21 | 7.5 High |
| An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. janus_sdp_preparse in sdp.c has a NULL pointer dereference. | ||||
| CVE-2020-13899 | 1 Meetecho | 1 Janus | 2024-11-21 | 7.5 High |
| An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. janus_process_incoming_request in janus.c discloses information from uninitialized stack memory. | ||||
| CVE-2020-13898 | 1 Meetecho | 1 Janus | 2024-11-21 | 7.5 High |
| An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. janus_sdp_process in sdp.c has a NULL pointer dereference. | ||||
| CVE-2020-13897 | 1 Hesk | 1 Hesk | 2024-11-21 | 6.1 Medium |
| HESK before 3.1.10 allows reflected XSS. | ||||
| CVE-2020-13896 | 1 Maipu | 2 Mp1800x-50, Mp1800x-50 Firmware | 2024-11-21 | 5.3 Medium |
| The web interface of Maipu MP1800X-50 7.5.3.14(R) devices allows remote attackers to obtain sensitive information via the form/formDeviceVerGet URI, such as system id, hardware model, hardware version, bootloader version, software version, software image file, compilation time, and system uptime. This is similar to CVE-2019-1653. | ||||
| CVE-2020-13895 | 1 P5-crypt-perl Project | 1 P5-crypt-perl | 2024-11-21 | 8.8 High |
| Crypt::Perl::ECDSA in the Crypt::Perl (aka p5-Crypt-Perl) module before 0.32 for Perl fails to verify correct ECDSA signatures when r and s are small and when s = 1. This happens when using the curve secp256r1 (prime256v1). This could conceivably have a security-relevant impact if an attacker wishes to use public r and s values when guessing whether signature verification will fail. | ||||
| CVE-2020-13894 | 1 Dext5 | 1 Dext5 | 2024-11-21 | 7.5 High |
| handler/upload_handler.jsp in DEXT5 Editor through 3.5.1402961 allows an attacker to download arbitrary files via the savefilepath field. | ||||
| CVE-2020-13893 | 1 Sage | 1 Easypay | 2024-11-21 | 5.4 Medium |
| Multiple stored cross-site scripting (XSS) vulnerabilities in Sage EasyPay 10.7.5.10 allow authenticated attackers to inject arbitrary web script or HTML via multiple parameters through Unicode Transformations (Best-fit Mapping), as demonstrated by the full-width variants of the less-than sign (%EF%BC%9C) and greater-than sign (%EF%BC%9E). | ||||
| CVE-2020-13892 | 1 Themeboy | 1 Sportspress | 2024-11-21 | 5.4 Medium |
| The SportsPress plugin before 2.7.2 for WordPress allows XSS. | ||||
| CVE-2020-13891 | 1 Mattermost | 1 Mattermost | 2024-11-21 | 7.5 High |
| An issue was discovered in Mattermost Mobile Apps before 1.31.2 on iOS. Unintended third-party servers could sometimes obtain authorization tokens, aka MMSA-2020-0022. | ||||
| CVE-2020-13890 | 1 Laborator | 1 Neon | 2024-11-21 | 5.4 Medium |
| The Neon theme 2.0 before 2020-06-03 for Bootstrap allows XSS via an Add Task Input operation in a dashboard. | ||||
| CVE-2020-13889 | 1 Bludit | 1 Bludit | 2024-11-21 | 5.4 Medium |
| showAlert() in the administration panel in Bludit 3.12.0 allows XSS. | ||||
| CVE-2020-13888 | 1 Kordil Edms Project | 1 Kordil Edms | 2024-11-21 | 5.4 Medium |
| Kordil EDMS through 2.2.60rc3 allows stored XSS in users_edit.php, users_management_edit.php, and user_management.php. | ||||
| CVE-2020-13887 | 1 Kordil Edms Project | 1 Kordil Edms | 2024-11-21 | 8.8 High |
| documents_add.php in Kordil EDMS through 2.2.60rc3 allows Remote Command Execution because .php files can be uploaded to the documents folder. | ||||