Export limit exceeded: 100184 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (100184 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2020-28019 | 1 Exim | 1 Exim | 2024-11-21 | 7.5 High |
| Exim 4 before 4.94.2 has Improper Initialization that can lead to recursion-based stack consumption or other consequences. This occurs because use of certain getc functions is mishandled when a client uses BDAT instead of DATA. | ||||
| CVE-2020-28016 | 1 Exim | 1 Exim | 2024-11-21 | 7.8 High |
| Exim 4 before 4.94.2 allows an off-by-two Out-of-bounds Write because "-F ''" is mishandled by parse_fix_phrase. | ||||
| CVE-2020-28015 | 1 Exim | 1 Exim | 2024-11-21 | 7.8 High |
| Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters. Local users can alter the behavior of root processes because a recipient address can have a newline character. | ||||
| CVE-2020-28013 | 1 Exim | 1 Exim | 2024-11-21 | 7.8 High |
| Exim 4 before 4.94.2 allows Heap-based Buffer Overflow because it mishandles "-F '.('" on the command line, and thus may allow privilege escalation from any user to root. This occurs because of the interpretation of negative sizes in strncpy. | ||||
| CVE-2020-28012 | 1 Exim | 1 Exim | 2024-11-21 | 7.8 High |
| Exim 4 before 4.94.2 allows Exposure of File Descriptor to Unintended Control Sphere because rda_interpret uses a privileged pipe that lacks a close-on-exec flag. | ||||
| CVE-2020-28011 | 1 Exim | 1 Exim | 2024-11-21 | 7.8 High |
| Exim 4 before 4.94.2 allows Heap-based Buffer Overflow in queue_run via two sender options: -R and -S. This may cause privilege escalation from exim to root. | ||||
| CVE-2020-28010 | 1 Exim | 1 Exim | 2024-11-21 | 7.8 High |
| Exim 4 before 4.94.2 allows Out-of-bounds Write because the main function, while setuid root, copies the current working directory pathname into a buffer that is too small (on some common platforms). | ||||
| CVE-2020-28009 | 1 Exim | 1 Exim | 2024-11-21 | 7.8 High |
| Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow because get_stdinput allows unbounded reads that are accompanied by unbounded increases in a certain size variable. NOTE: exploitation may be impractical because of the execution time needed to overflow (multiple days). | ||||
| CVE-2020-28008 | 1 Exim | 1 Exim | 2024-11-21 | 7.8 High |
| Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the spool directory (owned by a non-root user), an attacker can write to a /var/spool/exim4/input spool header file, in which a crafted recipient address can indirectly lead to command execution. | ||||
| CVE-2020-28007 | 1 Exim | 1 Exim | 2024-11-21 | 7.8 High |
| Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the log directory (owned by a non-root user), a symlink or hard link attack allows overwriting critical root-owned files anywhere on the filesystem. | ||||
| CVE-2020-27997 | 1 Smartstore | 1 Smartstorenet | 2024-11-21 | 8.8 High |
| An issue was discovered in SmartStoreNET before 4.1.0. Lack of Cross Site Request Forgery (CSRF) protection may lead to elevation of privileges (e.g., /admin/customer/create to create an admin account). | ||||
| CVE-2020-27996 | 1 Smartstore | 1 Smartstorenet | 2024-11-21 | 8.8 High |
| An issue was discovered in SmartStoreNET before 4.0.1. It does not properly consider the need for a CustomModelPartAttribute decoration in certain ModelBase.CustomProperties situations. | ||||
| CVE-2020-27992 | 1 Wondershare | 1 Dr.fone | 2024-11-21 | 7.8 High |
| Dr.Fone 3.0.0 allows local users to gain privileges via a Trojan horse DriverInstall.exe because %PROGRAMFILES(X86)%\Wondershare\dr.fone\Library\DriverInstaller has Full Control for BUILTIN\Users. | ||||
| CVE-2020-27986 | 1 Sonarsource | 1 Sonarqube | 2024-11-21 | 7.5 High |
| SonarQube 8.4.2.36762 allows remote attackers to discover cleartext SMTP, SVN, and GitLab credentials via the api/settings/values URI. NOTE: reportedly, the vendor's position for SMTP and SVN is "it is the administrator's responsibility to configure it. | ||||
| CVE-2020-27985 | 1 Securityonionsolutions | 1 Security Onion | 2024-11-21 | 7.8 High |
| Security Onion v2 prior to 2.3.10 has an incorrect sudo configuration, which allows the administrative user to obtain root access without using the sudo password by editing and executing /home/<user>/SecurityOnion/setup/so-setup. | ||||
| CVE-2020-27978 | 1 Shibboleth | 1 Identity Provider | 2024-11-21 | 7.5 High |
| Shibboleth Identify Provider 3.x before 3.4.6 has a denial of service flaw. A remote unauthenticated attacker can cause a login flow to trigger Java heap exhaustion due to the creation of objects in the Java Servlet container session. | ||||
| CVE-2020-27977 | 1 Capasystems | 1 Capainstaller | 2024-11-21 | 7.8 High |
| CapaSystems CapaInstaller before 6.0.101 does not properly assign, modify, or check privileges for an actor who attempts to edit registry values, allowing an attacker to escalate privileges. | ||||
| CVE-2020-27975 | 1 Oscommerce | 1 Oscommerce | 2024-11-21 | 8.8 High |
| osCommerce Phoenix CE before 1.0.5.4 allows admin/define_language.php CSRF. | ||||
| CVE-2020-27969 | 1 Yandex | 1 Yandex Browser | 2024-11-21 | 7.3 High |
| Yandex Browser for Android 20.8.4 allows remote attackers to perform SOP bypass and addresss bar spoofing | ||||
| CVE-2020-27952 | 1 Apple | 2 Mac Os X, Macos | 2024-11-21 | 7.8 High |
| An out-of-bounds write was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, macOS Big Sur 11.0.1. Processing a maliciously crafted font file may lead to arbitrary code execution. | ||||