Total
414101 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-24032 | 1 Xorux | 2 Lpar2rrd, Stor2rrd | 2026-06-17 | 10.0 HIGH | 9.8 CRITICAL |
| tz.pl on XoruX LPAR2RRD and STOR2RRD 2.70 virtual appliances allows cmd=set&tz=OS command injection via shell metacharacters in a timezone. | |||||
| CVE-2020-24030 | 1 Forlogic | 1 Qualiex | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| ForLogic Qualiex v1 and v3 has weak token expiration. This allows remote unauthenticated privilege escalation and access to sensitive data via token reuse. NOTE: as of 2025-10-14, the Supplier's perspective is that this is "not exploitable in the current implementation. Tokens are properly expired, invalidated, and bound to session context. Attempts to alter the token payload to extend its validity do not affect server-side validation." | |||||
| CVE-2020-24029 | 1 Forlogic | 1 Qualiex | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| Because of unauthenticated password changes in ForLogic Qualiex v1 and v3, customer and admin permissions and data can be accessed via a simple request. NOTE: as of 2025-10-14, the Supplier's perspective is that this is "corrected in all maintained versions. Password reset requests are validated against registered user emails and require a valid, short-lived token." | |||||
| CVE-2020-24028 | 1 Forlogic | 1 Qualiex | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| ForLogic Qualiex v1 and v3 allows any authenticated customer to achieve privilege escalation via user creations, password changes, or user permission updates. NOTE: as of 2025-10-14, the Supplier's perspective is that this "does not allow administrative privilege gain. Authorization is enforced server-side, restricting actions to the user’s own permission scope." | |||||
| CVE-2020-24027 | 1 Live555 | 1 Liblivemedia | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| In Live Networks, Inc., liblivemedia version 20200625, there is a potential buffer overflow bug in the server handling of a RTSP "PLAY" command, when the command specifies seeking by absolute time. | |||||
| CVE-2020-24026 | 1 Tinyshop Project | 1 Tinyshop | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| TinyShop, a free and open source mall based on RageFrame2, has a stored XSS vulnerability that affects version 1.2.0. TinyShop allows XSS via the explain_first and again_explain parameters of the /evaluate/index.php page. The vulnerability may be exploited remotely, resulting in cross-site scripting (XSS) or information disclosure. | |||||
| CVE-2020-24025 | 1 Sass-lang | 1 Node-sass | 2026-06-17 | 5.0 MEDIUM | 5.3 MEDIUM |
| Certificate validation in node-sass 2.0.0 to 4.14.1 is disabled when requesting binaries even if the user is not specifying an alternative download path. | |||||
| CVE-2020-24020 | 1 Ffmpeg | 1 Ffmpeg | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| Buffer Overflow vulnerability in FFMpeg 4.2.3 in dnn_execute_layer_pad in libavfilter/dnn/dnn_backend_native_layer_pad.c due to a call to memcpy without length checks, which could let a remote malicious user execute arbitrary code. | |||||
| CVE-2020-24008 | 1 Umanni | 1 Human Resources | 2026-06-17 | 5.0 MEDIUM | 5.3 MEDIUM |
| Umanni RH 1.0 has a user enumeration vulnerability. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users. | |||||
| CVE-2020-24007 | 1 Umanni | 1 Human Resources | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| Umanni RH 1.0 does not limit the number of authentication attempts. An unauthenticated user may exploit this vulnerability to launch a brute-force authentication attack against the Login page. | |||||
| CVE-2020-24003 | 1 Microsoft | 1 Skype | 2026-06-17 | 2.1 LOW | 3.3 LOW |
| Microsoft Skype through 8.59.0.77 on macOS has the disable-library-validation entitlement, which allows a local process (with the user's privileges) to obtain unprompted microphone and camera access by loading a crafted library and thereby inheriting Skype Client's microphone and camera access. | |||||
| CVE-2020-24000 | 1 Eyoucms | 1 Eyoucms | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| SQL Injection vulnerability in eyoucms cms v1.4.7, allows attackers to execute arbitrary code and disclose sensitive information, via the tid parameter to index.php. | |||||
| CVE-2020-23996 | 1 Ilias | 1 Ilias | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| A local file inclusion vulnerability in ILIAS before 5.3.19, 5.4.10 and 6.0 allows remote authenticated attackers to execute arbitrary code via the import of personal data. | |||||
| CVE-2020-23995 | 1 Ilias | 1 Ilias | 2026-06-17 | 4.0 MEDIUM | 6.5 MEDIUM |
| An information disclosure vulnerability in ILIAS before 5.3.19, 5.4.12 and 6.0 allows remote authenticated attackers to get the upload data path via a workspace upload. | |||||
| CVE-2020-23992 | 1 Nagios | 1 Nagios Xi | 2026-06-17 | N/A | 6.1 MEDIUM |
| Cross Site Scripting (XSS) in Nagios XI 5.7.1 allows remote attackers to run arbitrary code via returnUrl parameter in a crafted GET request. | |||||
| CVE-2020-23989 | 1 Nedi | 1 Nedi | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| NeDi 1.9C allows pwsec.php oid XSS. | |||||
| CVE-2020-23986 | 1 Github Readme Stats Project | 1 Github Readme Stats | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| Github Read Me Stats commit 3c7220e4f7144f6cb068fd433c774f6db47ccb95 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the function renderError. | |||||
| CVE-2020-23984 | 1 Online Hotel Booking System Pro Project | 1 Online Hotel Booking System Pro | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| Online Hotel Booking System Pro PHP Version 1.3 has Persistent Cross-site Scripting in Customer registration-form all-tags. | |||||
| CVE-2020-23983 | 1 Ichat Project | 1 Ichat | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| Michael-design iChat Realtime PHP Live Support System 1.6 has persistent Cross-site Scripting via chat,text-filed tags. | |||||
| CVE-2020-23982 | 1 Designmasterevents | 1 Conference Management Cms | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| DesignMasterEvents Conference management 1.0.0 has cross site scripting via the 'certificate.php' | |||||