Total
417611 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-8544 | 1 Open-xchange | 1 Open-xchange Appsuite | 2026-06-17 | 4.0 MEDIUM | 6.5 MEDIUM |
| OX App Suite through 7.10.3 allows SSRF. | |||||
| CVE-2020-8543 | 1 Open-xchange | 1 Open-xchange Appsuite | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| OX App Suite through 7.10.3 has Improper Input Validation. | |||||
| CVE-2020-8542 | 1 Open-xchange | 1 Open-xchange Appsuite | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| OX App Suite through 7.10.3 allows XSS. | |||||
| CVE-2020-8541 | 1 Open-xchange | 1 Open-xchange Appsuite | 2026-06-17 | 4.0 MEDIUM | 6.5 MEDIUM |
| OX App Suite through 7.10.3 allows XXE attacks. | |||||
| CVE-2020-8540 | 1 Zohocorp | 1 Manageengine Desktop Central | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| An XML external entity (XXE) vulnerability in Zoho ManageEngine Desktop Central before the 07-Mar-2020 update allows remote unauthenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request. | |||||
| CVE-2020-8539 | 1 Kia | 2 Head Unit, Head Unit Firmware | 2026-06-17 | 4.6 MEDIUM | 7.8 HIGH |
| Kia Motors Head Unit with Software version: SOP.003.30.18.0703, SOP.005.7.181019, and SOP.007.1.191209 may allow an attacker to inject unauthorized commands, by executing the micomd executable deamon, to trigger unintended functionalities. In addition, this executable may be used by an attacker to inject commands to generate CAN frames that are sent into the M-CAN bus (Multimedia CAN bus) of the vehicle. | |||||
| CVE-2020-8521 | 1 Phpzag | 1 Phpzag | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| SQL injection with start and length parameters in Records.php for phpzag live add edit delete data tables records with ajax php mysql | |||||
| CVE-2020-8520 | 1 Phpzag | 1 Phpzag | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| SQL injection in order and column parameters in Records.php for phpzag live add edit delete data tables records with ajax php mysql | |||||
| CVE-2020-8519 | 1 Phpzag | 1 Phpzag | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| SQL injection with the search parameter in Records.php for phpzag live add edit delete data tables records with ajax php mysql | |||||
| CVE-2020-8518 | 3 Debian, Fedoraproject, Horde | 3 Debian Linux, Fedora, Groupware | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| Horde Groupware Webmail Edition 5.2.22 allows injection of arbitrary PHP code via CSV data, leading to remote code execution. | |||||
| CVE-2020-8517 | 3 Canonical, Opensuse, Squid-cache | 3 Ubuntu Linux, Leap, Squid | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in Squid before 4.10. Due to incorrect input validation, the NTLM authentication credentials parser in ext_lm_group_acl may write to memory outside the credentials buffer. On systems with memory access protections, this can result in the helper process being terminated unexpectedly. This leads to the Squid process also terminating and a denial of service for all clients using the proxy. | |||||
| CVE-2020-8516 | 1 Torproject | 1 Tor | 2026-06-17 | 5.0 MEDIUM | 5.3 MEDIUM |
| The daemon in Tor through 0.4.1.8 and 0.4.2.x through 0.4.2.6 does not verify that a rendezvous node is known before attempting to connect to it, which might make it easier for remote attackers to discover circuit information. NOTE: The network team of Tor claims this is an intended behavior and not a vulnerability | |||||
| CVE-2020-8515 | 1 Draytek | 6 Vigor2960, Vigor2960 Firmware, Vigor300b and 3 more | 2026-06-17 | 10.0 HIGH | 9.8 CRITICAL |
| DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/mainfunction.cgi URI. This issue has been fixed in Vigor3900/2960/300B v1.5.1. | |||||
| CVE-2020-8514 | 2 Apple, Maxum | 2 Macos, Rumpus | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in Rumpus 8.2.10 on macOS. By crafting a directory name, it is possible to activate JavaScript in the context of the web application after invoking the rename folder functionality. | |||||
| CVE-2020-8512 | 1 Icewarp | 1 Icewarp Server | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| In IceWarp Webmail Server through 11.4.4.1, there is XSS in the /webmail/ color parameter. | |||||
| CVE-2020-8511 | 1 Artica | 1 Pandora Fms | 2026-06-17 | 6.5 MEDIUM | 7.2 HIGH |
| In Artica Pandora FMS through 7.42, Web Admin users can execute arbitrary code by uploading a .php file via the File Repository component, a different issue than CVE-2020-7935 and CVE-2020-8500. | |||||
| CVE-2020-8510 | 1 Phpabook Project | 1 Phpabook | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered in phpABook 0.9 Intermediate. On the login page, if one sets a userInfo cookie with the value of admin+1+en (user+perms+lang), one can login as any user without a password. | |||||
| CVE-2020-8509 | 1 Zohocorp | 1 Manageengine Desktop Central | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| Zoho ManageEngine Desktop Central before 10.0.483 allows unauthenticated users to access PDFGenerationServlet, leading to sensitive information disclosure. | |||||
| CVE-2020-8508 | 1 Norman | 1 Malware Cleaner | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| nsak64.sys in Norman Malware Cleaner 2.08.08 allows users to call arbitrary kernel functions because the passing of function pointers between user and kernel mode is mishandled. | |||||
| CVE-2020-8507 | 1 Rogersmedia | 1 Citytv Video | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| The Citytv Video application 4.08.0 for Android and 3.35 for iOS sends Unencrypted Analytics. | |||||