56.855 CVE tracked
777 Exploited now
183 Used by ransomware
Last sync
CVE Tracker
56.855 CVE
Ten vendors followed by CPE identifier, not by keyword: a CVE appears here once NVD says which products it affects — usually a few days after it is published.
| Identifier | Severity, sorted descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2020-3135 | HIGH 8.8 | cisco unified_communications_manager A vulnerability in the web-based management interface of Cisco Unified Communications Manager (UCM) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected device. The vulnerability is due to insuffi | 0.5% | — |
| CVE-2020-3119 | HIGH 8.8 | cisco nx-os A vulnerability in the Cisco Discovery Protocol implementation for Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to execute arbitrary code or cause a reload on an affected device. The vulnerability exists because the Cisco Discovery Pr | 4.8% | — |
| CVE-2020-3118 | HIGH 8.8 | cisco ios_xr A vulnerability in the Cisco Discovery Protocol implementation for Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to execute arbitrary code or cause a reload on an affected device. The vulnerability is due to improper validation of str | 11.7% | |
| CVE-2020-3115 | HIGH 8.8 | cisco sd-wan_firmware A vulnerability in the CLI of the Cisco SD-WAN Solution vManage software could allow an authenticated, local attacker to elevate privileges to root-level privileges on the underlying operating system. The vulnerability is due to insufficient input validation. | 0.3% | — |
| CVE-2020-3114 | HIGH 8.8 | cisco data_center_network_manager A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insuffici | 0.6% | — |
| CVE-2020-3112 | HIGH 8.8 | cisco data_center_network_manager A vulnerability in the REST API endpoint of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to elevate privileges on the application. The vulnerability is due to insufficient access control validation. An attacker could e | 1.5% | — |
| CVE-2020-3111 | HIGH 8.8 | cisco ip_conference_phone_7832_firmware A vulnerability in the Cisco Discovery Protocol implementation for the Cisco IP Phone could allow an unauthenticated, adjacent attacker to remotely execute code with root privileges or cause a reload of an affected IP phone. The vulnerability is due to missing | 3.1% | — |
| CVE-2020-3110 | HIGH 8.8 | cisco video_surveillance_8000p_ip_camera_firmware A vulnerability in the Cisco Discovery Protocol implementation for the Cisco Video Surveillance 8000 Series IP Cameras could allow an unauthenticated, adjacent attacker to execute code remotely or cause a reload of an affected IP Camera. The vulnerability is d | 5.7% | — |
| CVE-2020-29569 | HIGH 8.8 | debian debian_linux An issue was discovered in the Linux kernel through 5.10.1, as used with Xen through 4.14.x. The Linux kernel PV block backend expects the kernel thread handler to reset ring->xenblkd to NULL when stopped. However, the handler may not have time to run if the f | 0.4% | — |
| CVE-2020-29018 | HIGH 8.8 | fortinet fortiweb A format string vulnerability in FortiWeb 6.3.0 through 6.3.5 may allow an authenticated, remote attacker to read the content of memory and retrieve sensitive data via the redir parameter. | 2.0% | — |
| CVE-2020-29017 | HIGH 8.8 | fortinet fortideceptor An OS command injection vulnerability in FortiDeceptor 3.1.0, 3.0.1, 3.0.0 may allow a remote authenticated attacker to execute arbitrary commands on the system by exploiting a command injection vulnerability on the Customization page. | 3.6% | — |
| CVE-2020-29011 | HIGH 8.8 | fortinet fortisandbox Instances of SQL Injection vulnerabilities in the checksum search and MTA-quarantine modules of FortiSandbox 3.2.0 through 3.2.2, and 3.1.0 through 3.1.4 may allow an authenticated attacker to execute unauthorized code on the underlying SQL interpreter via spe | 1.0% | — |
| CVE-2020-27694 | HIGH 8.8 | trendmicro interscan_messaging_security_virtual_appliance Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 has updated a specific critical library that may vulnerable to attack. | 7.4% | — |
| CVE-2020-27016 | HIGH 8.8 | trendmicro interscan_messaging_security_virtual_appliance Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to a cross-site request forgery (CSRF) vulnerability which could allow an attacker to modify policy rules by tricking an authenticated administrator into accessing an attacker | 1.9% | — |
| CVE-2020-26075 | HIGH 8.8 | cisco iot_field_network_director A vulnerability in the REST API of Cisco IoT Field Network Director (FND) could allow an authenticated, remote attacker to gain access to the back-end database of an affected device. The vulnerability is due to insufficient input validation of REST API request | 1.6% | — |
| CVE-2020-25967 | HIGH 8.8 | fastadmin fastadmin The member center function in fastadmin V1.0.0.20200506_beta is vulnerable to a Server-Side Template Injection (SSTI) vulnerability. | 1.3% | — |
| CVE-2020-2036 | HIGH 8.8 | paloaltonetworks pan-os A reflected cross-site scripting (XSS) vulnerability exists in the PAN-OS management web interface. A remote attacker able to convince an administrator with an active authenticated session on the firewall management interface to click on a crafted link to that | 23.9% | — |
| CVE-2020-2017 | HIGH 8.8 | paloaltonetworks pan-os A DOM-Based Cross Site Scripting Vulnerability exists in PAN-OS and Panorama Management Web Interfaces. A remote attacker able to convince an authenticated administrator to click on a crafted link to PAN-OS and Panorama Web Interfaces could execute arbitrary J | 0.8% | — |
| CVE-2020-2015 | HIGH 8.8 | paloaltonetworks pan-os A buffer overflow vulnerability in the PAN-OS management server allows authenticated users to crash system processes or potentially execute arbitrary code with root privileges. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions ea | 1.9% | — |
| CVE-2020-2014 | HIGH 8.8 | paloaltonetworks pan-os An OS Command Injection vulnerability in PAN-OS management server allows authenticated users to inject and execute arbitrary shell commands with root privileges. This issue affects: All versions of PAN-OS 7.1 and 8.0; PAN-OS 8.1 versions earlier than 8.1.14; P | 2.7% | — |
| CVE-2020-1956 | HIGH 8.8 | apache kylin Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation. | 97.3% | |
| CVE-2020-1937 | HIGH 8.8 | apache kylin Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database queries. | 2.7% | — |
| CVE-2020-19316 | HIGH 8.8 | laravel framework OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17. | 2.5% | — |
| CVE-2020-18171 | HIGH 8.8 | techsmith snagit TechSmith Snagit 19.1.0.2653 uses Object Linking and Embedding (OLE) which can allow attackers to obfuscate and embed crafted files used to escalate privileges. NOTE: This implies that Snagit's use of OLE is a security vulnerability unto itself and it is not. | 0.4% | — |
| CVE-2020-17759 | HIGH 8.8 | evernote evernote An issue was found in the Evernote client for Windows 10, 7, and 2008 in the protocol handler. This enables attackers for arbitrary command execution if the user clicks on a specially crafted URL. AKA: WINNOTE-19941. | 3.4% | — |