Export limit exceeded: 385677 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (3411 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2020-8014 | 1 Opensuse | 2 Leap, Tumbleweed Kopano-spamd | 2024-11-21 | 7.7 High |
| A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of kopano-spamd of openSUSE Leap 15.1, openSUSE Tumbleweed allowed local attackers with the privileges of the kopano user to escalate to root. This issue affects: openSUSE Leap 15.1 kopano-spamd versions prior to 10.0.5-lp151.4.1. openSUSE Tumbleweed kopano-spamd versions prior to 10.0.5-1.1. | ||||
| CVE-2020-7572 | 1 Schneider-electric | 1 Webreports | 2024-11-21 | 8.8 High |
| A CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to inject arbitrary XML code and obtain disclosure of confidential data, denial of service, server side request forgery due to improper configuration of the XML parser. | ||||
| CVE-2020-7037 | 1 Avaya | 1 Equinox Conferencing | 2024-11-21 | 8.1 High |
| An XML External Entities (XXE) vulnerability in Media Server component of Avaya Equinox Conferencing could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system or even potentially lead to a denial of service. The affected versions of Avaya Equinox Conferencing includes all 9.x versions before 9.1.11. Equinox Conferencing is now offered as Avaya Meetings Server. | ||||
| CVE-2020-7036 | 1 Avaya | 1 Callback Assist | 2024-11-21 | 8.1 High |
| An XML External Entities (XXE)vulnerability in Callback Assist could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. The affected versions of Callback Assist includes all 4.0.x versions before 4.7.1.1 Patch 7. | ||||
| CVE-2020-7035 | 1 Avaya | 1 Aura Orchestration Designer | 2024-11-21 | 8.1 High |
| An XML External Entities (XXE)vulnerability in the web-based user interface of Avaya Aura Orchestration Designer could allow an authenticated, remote attacker to gain read access to information that is stored on an affected system. The affected versions of Orchestration Designer includes all 7.x versions before 7.2.3. | ||||
| CVE-2020-7032 | 1 Avaya | 2 Aura System Manager, Weblm | 2024-11-21 | 6.5 Medium |
| An XML external entity (XXE) vulnerability in Avaya WebLM admin interface allows authenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request. Affected versions of Avaya WebLM include: 7.0 through 7.1.3.6 and 8.0 through 8.1.2. | ||||
| CVE-2020-6958 | 1 Yet Another Java Service Wrapper Project | 1 Yet Another Java Service Wrapper | 2024-11-21 | 9.1 Critical |
| An XXE vulnerability in JnlpSupport in Yet Another Java Service Wrapper (YAJSW) 12.14, as used in NSA Ghidra and other products, allows attackers to exfiltrate data from remote hosts and potentially cause denial-of-service. | ||||
| CVE-2020-6649 | 1 Fortinet | 1 Fortiisolator | 2024-11-21 | 9.8 Critical |
| An insufficient session expiration vulnerability in FortiNet's FortiIsolator version 2.0.1 and below may allow an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID (via other, hypothetical attacks) | ||||
| CVE-2020-6644 | 1 Fortinet | 1 Fortideceptor | 2024-11-21 | 8.1 High |
| An insufficient session expiration vulnerability in FortiDeceptor 3.0.0 and below allows an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID via other, hypothetical attacks. | ||||
| CVE-2020-6623 | 1 Nothings | 1 Stb Truetype.h | 2024-11-21 | 8.8 High |
| stb stb_truetype.h through 1.22 has an assertion failure in stbtt__cff_get_index. | ||||
| CVE-2020-6619 | 1 Nothings | 1 Stb Truetype.h | 2024-11-21 | 8.8 High |
| stb stb_truetype.h through 1.22 has an assertion failure in stbtt__buf_seek. | ||||
| CVE-2020-6617 | 1 Nothings | 1 Stb Truetype.h | 2024-11-21 | 8.8 High |
| stb stb_truetype.h through 1.22 has an assertion failure in stbtt__cff_int. | ||||
| CVE-2020-6590 | 1 Forcepoint | 3 Data Loss Prevention, Email Security, Web Security Content Gateway | 2024-11-21 | 7.5 High |
| Forcepoint Web Security Content Gateway versions prior to 8.5.4 improperly process XML input, leading to information disclosure. | ||||
| CVE-2020-6363 | 1 Sap | 1 Commerce Cloud | 2024-11-21 | 4.6 Medium |
| SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, exposes several web applications that maintain sessions with a user. These sessions are established after the user has authenticated with username/passphrase credentials. The user can change their own passphrase, but this does not invalidate active sessions that the user may have with SAP Commerce Cloud web applications, which gives an attacker the opportunity to reuse old session credentials, resulting in Insufficient Session Expiration. | ||||
| CVE-2020-6292 | 1 Sap | 1 Disclosure Management | 2024-11-21 | 8.8 High |
| Logout mechanism in SAP Disclosure Management, version 10.1, does not invalidate one of the session cookies, leading to Insufficient Session Expiration. | ||||
| CVE-2020-6291 | 1 Sap | 1 Disclosure Management | 2024-11-21 | 8.8 High |
| SAP Disclosure Management, version 10.1, session mechanism does not have expiration data set therefore allows unlimited access after authenticating once, leading to Insufficient Session Expiration | ||||
| CVE-2020-6238 | 1 Sap | 1 Commerce Cloud | 2024-11-21 | 9.3 Critical |
| SAP Commerce, versions - 6.6, 6.7, 1808, 1811, 1905, does not process XML input securely in the Rest API from Servlet xyformsweb, leading to Missing XML Validation. This affects confidentiality and availability (partially) of SAP Commerce. | ||||
| CVE-2020-6197 | 1 Sap | 1 Enable Now | 2024-11-21 | 3.3 Low |
| SAP Enable Now, before version 1908, does not invalidate session tokens in a timely manner. The Insufficient Session Expiration may allow attackers with local access, for instance, to still download the portables. | ||||
| CVE-2020-6187 | 1 Sap | 1 Netweaver Guided Procedures | 2024-11-21 | 4.9 Medium |
| SAP NetWeaver (Guided Procedures), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate an XML document input from a compromised admin, leading to Denial of Service. | ||||
| CVE-2020-6105 | 1 F2fs-tools Project | 1 F2fs-tools | 2024-11-21 | 7.8 High |
| An exploitable code execution vulnerability exists in the multiple devices functionality of F2fs-Tools F2fs.Fsck 1.13. A specially crafted f2fs filesystem can cause Information overwrite resulting in a code execution. An attacker can provide a malicious file to trigger this vulnerability. | ||||