Total
417646 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-9015 | 1 Arista | 6 Dcs-7050cx3-32s-r, Dcs-7050cx3-32s-r Firmware, Dcs-7050qx-32s-r and 3 more | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| Arista DCS-7050QX-32S-R 4.20.9M, DCS-7050CX3-32S-R 4.20.11M, and DCS-7280SRAM-48C6-R 4.22.0.1F devices (and possibly other products) allow attackers to bypass intended TACACS+ shell restrictions via a | character. NOTE: the vendor reports that this is a configuration issue relating to an overly permissive regular expression in the TACACS+ server permitted commands | |||||
| CVE-2020-9014 | 1 Epson | 1 Iprojection | 2026-06-17 | 2.1 LOW | 5.5 MEDIUM |
| In Epson iProjection v2.30, the driver file (EMP_NSAU.sys) allows local users to cause a denial of service (BSOD) via crafted input to the virtual audio device driver with IOCTL 0x9C402402, 0x9C402406, or 0x9C40240A. \Device\EMPNSAUIO and \DosDevices\EMPNSAU are similarly affected. | |||||
| CVE-2020-9013 | 1 Arvato | 1 Skillpipe | 2026-06-17 | 4.0 MEDIUM | 4.3 MEDIUM |
| Arvato Skillpipe 3.0 allows attackers to bypass intended print restrictions by deleting <div id="watermark"> from the HTML source code. | |||||
| CVE-2020-9012 | 1 Gluu | 1 Gluu Server | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| A cross-site scripting (XSS) vulnerability in the Import People functionality in Gluu Identity Configuration 4.0 allows remote attackers to inject arbitrary web script or HTML via the filename parameter. | |||||
| CVE-2020-9009 | 1 Shipstation | 1 Shipstation | 2026-06-17 | N/A | 3.7 LOW |
| The ShipStation.com plugin 1.1 and earlier for CS-Cart allows remote attackers to insert arbitrary information into the database (via action=shipnotify) because access to this endpoint is completely unchecked. The attacker must guess an order number. | |||||
| CVE-2020-9008 | 1 Blackboard | 1 Blackboard Learn | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| Stored Cross-site scripting (XSS) vulnerability in Blackboard Learn/PeopleTool v9.1 allows users to inject arbitrary web script via the Tile widget in the People Tool profile editor. | |||||
| CVE-2020-9007 | 1 Codologic | 1 Codoforum | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| Codoforum 4.8.8 allows self-XSS via the title of a new topic. | |||||
| CVE-2020-9006 | 1 Sygnoos | 1 Popup Builder | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| The Popup Builder plugin 2.2.8 through 2.6.7.6 for WordPress is vulnerable to SQL injection (in the sgImportPopups function in sg_popup_ajax.php) via PHP Deserialization on attacker-controlled data with the attachmentUrl POST variable. This allows creation of an arbitrary WordPress Administrator account, leading to possible Remote Code Execution because Administrators can run PHP code on Wordpress instances. (This issue has been fixed in the 3.x branch of popup-builder.) | |||||
| CVE-2020-9005 | 1 Valvesoftware | 1 Dota 2 | 2026-06-17 | 6.8 MEDIUM | 7.8 HIGH |
| meshsystem.dll in Valve Dota 2 through 2020-02-17 allows remote attackers to achieve code execution or denial of service by creating a gaming server with a crafted map, and inviting a victim to this server. A GetValue call is mishandled. | |||||
| CVE-2020-9004 | 1 Wowza | 1 Streaming Engine | 2026-06-17 | 9.0 HIGH | 8.8 HIGH |
| A remote authenticated authorization-bypass vulnerability in Wowza Streaming Engine 4.8.0 and earlier allows any read-only user to issue requests to the administration panel in order to change functionality. For example, a read-only user may activate the Java JMX port in unauthenticated mode and execute OS commands under root privileges. This issue was resolved in Wowza Streaming Engine 4.8.5. | |||||
| CVE-2020-9003 | 1 Wpchill | 1 Modula Image Gallery | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| A stored XSS vulnerability exists in the Modula Image Gallery plugin before 2.2.5 for WordPress. Successful exploitation of this vulnerability would allow an authenticated low-privileged user to inject arbitrary JavaScript code that is viewed by other users. | |||||
| CVE-2020-9002 | 1 Iportalis | 1 Iportalis Control Portal | 2026-06-17 | 6.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in iPortalis iCS 7.1.13.0. An attacker can gain privileges by intercepting a request and changing UserRoleKey=COMPANY_ADMIN to UserRoleKey=DOMAIN_ADMIN (to achieve Domain Administrator access). | |||||
| CVE-2020-9000 | 1 Iportalis | 1 Iportalis Control Portal | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in iPortalis iCS 7.1.13.0. Attackers can send a sequence of requests to rapidly cause .NET Input Validation errors. This increases the size of the log file on the remote server until memory is exhausted, therefore consuming the maximum amount of resources (triggering a denial of service condition). | |||||
| CVE-2020-8997 | 1 Abbott | 2 Freestyle Libre, Freestyle Libre Firmware | 2026-06-17 | 5.8 MEDIUM | 8.8 HIGH |
| Older generation Abbott FreeStyle Libre sensors allow remote attackers within close proximity to enable write access to memory via a specific NFC unlock command. NOTE: The vulnerability is not present in the FreeStyle Libre 14-day in the U.S (announced in August 2018) and FreeStyle Libre 2 outside the U.S (announced in October 2018). | |||||
| CVE-2020-8996 | 1 Aishu | 1 Anyshare Cloud | 2026-06-17 | 4.0 MEDIUM | 4.3 MEDIUM |
| AnyShare Cloud 6.0.9 allows authenticated directory traversal to read files, as demonstrated by the interface/downloadwithpath/downloadfile/?filepath=/etc/passwd URI. | |||||
| CVE-2020-8995 | 1 Bilanc | 1 Bilanc | 2026-06-17 | 5.0 MEDIUM | 9.8 CRITICAL |
| Programi Bilanc Build 007 Release 014 31.01.2020 supplies a .exe file containing several hardcoded credentials to different servers that allow remote attackers to gain access to the complete infrastructure including the website, update server, and external issue tracking tools. | |||||
| CVE-2020-8994 | 1 Mi | 2 Mdz-25-dt, Mdz-25-dt Firmware | 2026-06-17 | 7.2 HIGH | 6.8 MEDIUM |
| An issue was discovered on XIAOMI AI speaker MDZ-25-DT 1.34.36, and 1.40.14. Attackers can get root shell by accessing the UART interface and then they can read Wi-Fi SSID or password, read the dialogue text files between users and XIAOMI AI speaker, use Text-To-Speech tools pretend XIAOMI speakers' voice achieve social engineering attacks, eavesdrop on users and record what XIAOMI AI speaker hears, delete the entire XIAOMI AI speaker system, modify system files, stop voice assistant service, start the XIAOMI AI speaker’s SSH service as a backdoor | |||||
| CVE-2020-8992 | 4 Canonical, Linux, Netapp and 1 more | 11 Ubuntu Linux, Linux Kernel, Active Iq Unified Manager and 8 more | 2026-06-17 | 4.9 MEDIUM | 5.5 MEDIUM |
| ext4_protect_reserved_inode in fs/ext4/block_validity.c in the Linux kernel through 5.5.3 allows attackers to cause a denial of service (soft lockup) via a crafted journal size. | |||||
| CVE-2020-8991 | 1 Redhat | 1 Lvm2 | 2026-06-17 | 2.1 LOW | 2.3 LOW |
| vg_lookup in daemons/lvmetad/lvmetad-core.c in LVM2 2.02 mismanages memory, leading to an lvmetad memory leak, as demonstrated by running pvs. NOTE: RedHat disputes CVE-2020-8991 as not being a vulnerability since there’s no apparent route to either privilege escalation or to denial of service through the bug | |||||
| CVE-2020-8990 | 1 Western Digital | 2 Ibi, My Cloud Home | 2026-06-17 | 6.4 MEDIUM | 9.1 CRITICAL |
| Western Digital My Cloud Home before 3.6.0 and ibi before 3.6.0 allow Session Fixation. | |||||