Total
2618 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-26171 | 1 Tangro | 1 Business Workflow | 2026-06-17 | 4.0 MEDIUM | 4.3 MEDIUM |
| In tangro Business Workflow before 1.18.1, the documentId of attachment uploads to /api/document/attachments/upload can be manipulated. By doing this, users can add attachments to workitems that do not belong to them. | |||||
| CVE-2020-26068 | 1 Cisco | 2 Roomos, Telepresence Collaboration Endpoint | 2026-06-17 | 5.5 MEDIUM | 5.5 MEDIUM |
| A vulnerability in the xAPI service of Cisco Telepresence CE Software and Cisco RoomOS Software could allow an authenticated, remote attacker to generate an access token for an affected device. The vulnerability is due to insufficient access authorization. An attacker could exploit this vulnerability by using the xAPI service to generate a specific token. A successful exploit could allow the attacker to use the generated token to enable experimental features on the device that should not be available to users. | |||||
| CVE-2020-23722 | 1 Thedaylightstudio | 1 Fuel Cms | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| An issue was discovered in FUEL CMS 1.4.7. There is a escalation of privilege vulnerability to obtain super admin privilege via the "id" and "fuel_id" parameters. | |||||
| CVE-2020-23449 | 1 Newbee-mall Project | 1 Newbee-mall | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| newbee-mall all versions are affected by incorrect access control to remotely gain privileges through NewBeeMallIndexConfigServiceImpl.java. Unauthorized changes can be made to any user information through the userID. | |||||
| CVE-2020-20183 | 1 Zyxel | 2 P1302-t10 V3, P1302-t10 V3 Firmware | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| Insecure direct object reference vulnerability in Zyxel’s P1302-T10 v3 with firmware version 2.00(ABBX.3) and earlier allows attackers to gain privileges and access certain admin pages. | |||||
| CVE-2020-19890 | 1 Dbhcms Project | 1 Dbhcms | 2026-06-17 | 4.0 MEDIUM | 4.9 MEDIUM |
| DBHcms v1.2.0 has an Arbitrary file read vulnerability in dbhcms\mod\mod.editor.php $_GET['file'] is filename,and as there is no filter function for security, you can read any file's content. | |||||
| CVE-2020-16240 | 1 Ge | 1 Asset Performance Management Classic | 2026-06-17 | 5.0 MEDIUM | 5.3 MEDIUM |
| GE Digital APM Classic, Versions 4.4 and prior. An insecure direct object reference (IDOR) vulnerability allows user account data to be downloaded in JavaScript object notation (JSON) format by users who should not have access to such functionality. An attacker can download sensitive data related to user accounts without having the proper privileges. | |||||
| CVE-2020-16194 | 1 Store-opart | 1 Op\'art Devis | 2026-06-17 | 5.0 MEDIUM | 5.3 MEDIUM |
| An Insecure Direct Object Reference (IDOR) vulnerability was found in Prestashop Opart devis < 4.0.2. Unauthenticated attackers can have access to any user's invoice and delivery address by exploiting an IDOR on the delivery_address and invoice_address fields. | |||||
| CVE-2020-15958 | 1 1crm | 1 1crm | 2026-06-17 | 5.0 MEDIUM | 8.6 HIGH |
| An issue was discovered in 1CRM System through 8.6.7. An insecure direct object reference to internally stored files allows a remote attacker to access various sensitive information via an unauthenticated request with a predictable URL. | |||||
| CVE-2020-14174 | 1 Atlassian | 4 Jira, Jira Data Center, Jira Server and 1 more | 2026-06-17 | 4.0 MEDIUM | 4.3 MEDIUM |
| Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view titles of a private project via an Insecure Direct Object References (IDOR) vulnerability in the Administration Permission Helper. The affected versions are before version 7.13.6, from version 8.0.0 before 8.5.7, from version 8.6.0 before 8.9.2, and from version 8.10.0 before 8.10.1. | |||||
| CVE-2020-13998 | 1 Citrix | 1 Xenapp | 2026-06-17 | 4.3 MEDIUM | 5.3 MEDIUM |
| Citrix XenApp 6.5, when 2FA is enabled, allows a remote unauthenticated attacker to ascertain whether a user exists on the server, because the 2FA error page only occurs after a valid username is entered. NOTE: This vulnerability only affects products that are no longer supported by the maintainer | |||||
| CVE-2020-13923 | 1 Apache | 1 Ofbiz | 2026-06-17 | 5.0 MEDIUM | 5.3 MEDIUM |
| IDOR vulnerability in the order processing feature from ecommerce component of Apache OFBiz before 17.12.04 | |||||
| CVE-2020-13700 | 1 Acf To Rest Api Project | 1 Acf To Rest Api | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in the acf-to-rest-api plugin through 3.1.0 for WordPress. It allows an insecure direct object reference via permalinks manipulation, as demonstrated by a wp-json/acf/v3/options/ request that reads sensitive information in the wp_options table, such as the login and pass values. | |||||
| CVE-2020-13462 | 1 Tufin | 1 Securetrack | 2026-06-17 | 2.7 LOW | 5.7 MEDIUM |
| Insecure Direct Object Reference (IDOR) exists in Tufin SecureChange, affecting all versions prior to R20-2 GA. Fixed in version R20-2 GA. | |||||
| CVE-2020-13357 | 1 Gitlab | 1 Gitlab | 2026-06-17 | 4.0 MEDIUM | 4.3 MEDIUM |
| An issue was discovered in Gitlab CE/EE versions >= 13.1 to <13.4.7, >= 13.5 to <13.5.5, and >= 13.6 to <13.6.2 allowed an unauthorized user to access the user list corresponding to a feature flag in a project. | |||||
| CVE-2020-12643 | 1 Open-xchange | 1 Open-xchange Appsuite | 2026-06-17 | 4.0 MEDIUM | 4.3 MEDIUM |
| OX App Suite 7.10.3 and earlier has Incorrect Access Control via an /api/subscriptions request for a snippet containing an email address. | |||||
| CVE-2020-11659 | 1 Broadcom | 1 Ca Api Developer Portal | 2026-06-17 | 4.0 MEDIUM | 4.3 MEDIUM |
| CA API Developer Portal 4.3.1 and earlier contains an access control flaw that allows privileged users to perform a restricted user administration action. | |||||
| CVE-2020-11658 | 1 Broadcom | 1 Ca Api Developer Portal | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| CA API Developer Portal 4.3.1 and earlier handles shared secret keys in an insecure manner, which allows attackers to bypass authorization. | |||||
| CVE-2020-11589 | 1 Cipplanner | 1 Cipace | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| An Insecure Direct Object Reference issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make a GET request to a certain URL and obtain information that should be provided to authenticated users only. | |||||
| CVE-2020-11585 | 1 Dnnsoftware | 1 Dotnetnuke | 2026-06-17 | 4.0 MEDIUM | 4.3 MEDIUM |
| There is an information disclosure issue in DNN (formerly DotNetNuke) 9.5 within the built-in Activity-Feed/Messaging/Userid/ Message Center module. A registered user is able to enumerate any file in the Admin File Manager (other than ones contained in a secure folder) by sending themselves a message with the file attached, e.g., by using an arbitrary small integer value in the fileIds parameter. | |||||