Total
416262 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-36912 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| Plexus anblick Digital Signage Management 3.1.13 contains an open redirect vulnerability in the 'PantallaLogin' script that allows attackers to manipulate the 'pagina' GET parameter. Attackers can craft malicious links that redirect users to arbitrary websites by exploiting improper input validation in the parameter. | |||||
| CVE-2020-36911 | 1 Cobbr | 1 Covenant | 2026-06-17 | N/A | 9.8 CRITICAL |
| Covenant 0.1.3 - 0.5 contains a remote code execution vulnerability that allows attackers to craft malicious JWT tokens with administrative privileges. Attackers can generate forged tokens with admin roles and upload custom DLL payloads to execute arbitrary commands on the target system. | |||||
| CVE-2020-36910 | 2026-06-17 | N/A | 8.8 HIGH | ||
| Cayin Signage Media Player 3.0 contains an authenticated remote command injection vulnerability in system.cgi and wizard_system.cgi pages. Attackers can exploit the 'NTP_Server_IP' parameter with default credentials to execute arbitrary shell commands as root. | |||||
| CVE-2020-36909 | 1 Securecomputing | 2 Snapgear Sg560, Snapgear Sg560 Firmware | 2026-06-17 | N/A | 6.5 MEDIUM |
| SnapGear Management Console SG560 3.1.5 contains a file manipulation vulnerability that allows authenticated users to read, write, and delete files using the edit_config_files CGI script. Attackers can manipulate POST request parameters in /cgi-bin/cgix/edit_config_files to access and modify files outside the intended /etc/config/ directory. | |||||
| CVE-2020-36908 | 1 Securecomputing | 2 Snapgear Sg560, Snapgear Sg560 Firmware | 2026-06-17 | N/A | 5.3 MEDIUM |
| SnapGear Management Console SG560 version 3.1.5 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. Attackers can craft a malicious web page that automatically submits a form to create a new super user account with full administrative privileges when a logged-in user visits the page. | |||||
| CVE-2020-36907 | 2026-06-17 | N/A | 7.5 HIGH | ||
| Aerohive HiveOS contains a denial of service vulnerability in the NetConfig UI that allows unauthenticated attackers to render the web interface unusable. Attackers can send a crafted HTTP request to the action.php5 script with specific parameters to trigger a 5-minute service disruption. | |||||
| CVE-2020-36906 | 2026-06-17 | N/A | 4.3 MEDIUM | ||
| P5 FNIP-8x16A FNIP-4xSH 1.0.20 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. Attackers can craft malicious web pages to add new admin users, change passwords, and modify system configurations by tricking authenticated users into loading a specially crafted form. | |||||
| CVE-2020-36905 | 2026-06-17 | N/A | 7.5 HIGH | ||
| FIBARO System Home Center 5.021 contains a remote file inclusion vulnerability in the undocumented proxy API that allows attackers to include arbitrary client-side scripts. Attackers can exploit the 'url' GET parameter to inject malicious JavaScript and potentially hijack user sessions or manipulate page content. | |||||
| CVE-2020-36902 | 1 Medivision | 2 Medivision Digital Signage, Medivision Digital Signage Firmware | 2026-06-17 | N/A | 9.8 CRITICAL |
| UBICOD Medivision Digital Signage 1.5.1 contains an authorization bypass vulnerability that allows normal users to escalate privileges by manipulating the 'ft[grp]' parameter. Attackers can send a GET request to /html/user with 'ft[grp]' set to integer value '3' to gain super admin rights without authentication. | |||||
| CVE-2020-36901 | 1 Medivision | 2 Medivision Digital Signage, Medivision Digital Signage Firmware | 2026-06-17 | N/A | 8.8 HIGH |
| UBICOD Medivision Digital Signage 1.5.1 contains a cross-site request forgery vulnerability that allows attackers to create administrative user accounts without proper request validation. Attackers can craft a malicious web page that submits a form to the /query/user/itSet endpoint to add a new admin user with elevated privileges. | |||||
| CVE-2020-36900 | 1 All-dynamics | 1 Digital Signage System | 2026-06-17 | N/A | 8.8 HIGH |
| All-Dynamics Digital Signage System 2.0.2 contains a cross-site request forgery vulnerability that allows attackers to create administrative users without proper request validation. Attackers can craft a malicious web page that automatically submits forms to create a new user with global administrative privileges when a logged-in user visits the page. | |||||
| CVE-2020-36899 | 1 Howfor | 1 Qihang Media Web Digital Signage | 2026-06-17 | N/A | 7.5 HIGH |
| QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated file disclosure vulnerability that allows remote attackers to access sensitive files through unverified 'filename' and 'path' parameters. Attackers can exploit the QH.aspx endpoint to read arbitrary files and directory contents without authentication by manipulating download and getAll actions. | |||||
| CVE-2020-36898 | 1 Howfor | 1 Qihang Media Web Digital Signage | 2026-06-17 | N/A | 9.1 CRITICAL |
| QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated file deletion vulnerability in the QH.aspx endpoint that allows remote attackers to delete files without authentication. Attackers can exploit the 'data' parameter by sending a POST request with file paths to delete arbitrary files with web server permissions using directory traversal sequences. | |||||
| CVE-2020-36897 | 1 Howfor | 1 Qihang Media Web Digital Signage | 2026-06-17 | N/A | 9.8 CRITICAL |
| QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated remote code execution vulnerability in the QH.aspx file that allows attackers to upload malicious ASPX scripts. Attackers can exploit the file upload functionality by using the 'remotePath' and 'fileToUpload' parameters to write and execute arbitrary system commands on the server. | |||||
| CVE-2020-36896 | 1 Howfor | 1 Qihang Media Web Digital Signage | 2026-06-17 | N/A | 7.5 HIGH |
| QiHang Media Web Digital Signage 3.0.9 contains a cleartext credentials vulnerability that allows unauthenticated attackers to access administrative login information through an unprotected XML file. Attackers can retrieve hardcoded admin credentials by requesting the '/xml/User/User.xml' file, enabling direct authentication bypass. | |||||
| CVE-2020-36895 | 1 Eibiz | 1 I-media Server Digital Signage | 2026-06-17 | N/A | 7.5 HIGH |
| EIBIZ i-Media Server Digital Signage 3.8.0 contains an unauthenticated configuration disclosure vulnerability that allows remote attackers to access sensitive configuration files via direct object reference. Attackers can retrieve the SiteConfig.properties file through an HTTP GET request, exposing administrative credentials, database connection details, and system configuration information. | |||||
| CVE-2020-36894 | 1 Eibiz | 1 I-media Server Digital Signage | 2026-06-17 | N/A | 7.5 HIGH |
| Eibiz i-Media Server Digital Signage 3.8.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to create admin users through AMF-encoded object manipulation. Attackers can send crafted serialized objects to the /messagebroker/amf endpoint to create administrative users without authentication, bypassing security controls. | |||||
| CVE-2020-36893 | 1 Eibiz | 1 I-media Server Digital Signage | 2026-06-17 | N/A | 7.5 HIGH |
| Eibiz i-Media Server Digital Signage 3.8.0 contains a directory traversal vulnerability that allows unauthenticated remote attackers to access files outside the server's root directory. Attackers can exploit the 'oldfile' GET parameter to view sensitive configuration files like web.xml and system files such as win.ini. | |||||
| CVE-2020-36892 | 1 Eibiz | 1 I-media Server Digital Signage | 2026-06-17 | N/A | 9.8 CRITICAL |
| Eibiz i-Media Server Digital Signage 3.8.0 contains an unauthenticated privilege escalation vulnerability in the updateUser object that allows attackers to modify user roles. Attackers can exploit the /messagebroker/amf endpoint to elevate privileges and take over user accounts by manipulating role settings without authentication. | |||||
| CVE-2020-36891 | 1 Kentico | 1 Xperience | 2026-06-17 | N/A | 5.4 MEDIUM |
| A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to upload files with spoofed Content-Type that do not match file extensions. Attackers can exploit this vulnerability by uploading malicious files with manipulated MIME types, allowing malicious scripts to execute in users' browsers. | |||||