Total
414077 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-23852 | 1 Rockcarry | 1 Ffjpeg | 2026-06-17 | 4.3 MEDIUM | 5.5 MEDIUM |
| A heap based buffer overflow vulnerability exists in ffjpeg through 2020-07-02 in the jfif_decode(void *ctxt, BMP *pb) function at ffjpeg/src/jfif.c (line 544 & line 545), which could cause a denial of service by submitting a malicious jpeg image. | |||||
| CVE-2020-23851 | 1 Rockcarry | 1 Ffjpeg | 2026-06-17 | 4.3 MEDIUM | 5.5 MEDIUM |
| A stack-based buffer overflow vulnerability exists in ffjpeg through 2020-07-02 in the jfif_decode(void *ctxt, BMP *pb) function at ffjpeg/src/jfif.c:513:28, which could cause a denial of service by submitting a malicious jpeg image. | |||||
| CVE-2020-23849 | 1 Jsoneditoronline | 1 Jsoneditor | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| Stored XSS was discovered in the tree mode of jsoneditor before 9.0.2 through injecting and executing JavaScript. | |||||
| CVE-2020-23839 | 1 Get-simple | 1 Getsimple Cms | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| A Reflected Cross-Site Scripting (XSS) vulnerability in GetSimple CMS v3.3.16, in the admin/index.php login portal webpage, allows remote attackers to execute JavaScript code in the client's browser and harvest login credentials after a client clicks a link, enters credentials, and submits the login form. | |||||
| CVE-2020-23837 | 1 Multi User Project | 1 Multi User | 2026-06-17 | 6.8 MEDIUM | 8.8 HIGH |
| A Cross-Site Request Forgery (CSRF) vulnerability in the Multi User plugin 1.8.2 for GetSimple CMS allows remote attackers to add admin (or other) users after an authenticated admin visits a third-party site or clicks on a URL. | |||||
| CVE-2020-23836 | 1 Oswapp | 1 Warehouse Inventory System | 2026-06-17 | 6.8 MEDIUM | 8.8 HIGH |
| A Cross-Site Request Forgery (CSRF) vulnerability in edit_user.php in OSWAPP Warehouse Inventory System (aka OSWA-INV) through 2020-08-10 allows remote attackers to change the admin's password after an authenticated admin visits a third-party site. | |||||
| CVE-2020-23835 | 1 Tailor Management System Project | 1 Tailor Management System | 2026-06-17 | 4.3 MEDIUM | 6.4 MEDIUM |
| A Reflected Cross-Site Scripting (XSS) vulnerability in the index.php login-portal webpage of SourceCodester Tailor Management System v1.0 allows remote attackers to harvest keys pressed by an unauthenticated victim who clicks on a malicious URL and begins typing. | |||||
| CVE-2020-23834 | 1 Realtimelogic | 1 Barracudadrive | 2026-06-17 | 7.2 HIGH | 8.8 HIGH |
| Insecure Service File Permissions in the bd service in Real Time Logic BarracudaDrive v6.5 allow local attackers to escalate privileges to admin by replacing the %SYSTEMDRIVE%\bd\bd.exe file. When the computer next starts, the new bd.exe will be run as LocalSystem. | |||||
| CVE-2020-23833 | 1 Projectworlds | 1 House Rental | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| Projectworlds House Rental v1.0 suffers from an unauthenticated SQL Injection vulnerability, allowing remote attackers to execute arbitrary code on the hosting webserver via a malicious index.php POST request. | |||||
| CVE-2020-23832 | 1 Car Rental Management System Project | 1 Car Rental Management System | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| A Persistent Cross-Site Scripting (XSS) vulnerability in message_admin.php in Projectworlds Car Rental Management System v1.0 allows unauthenticated remote attackers to harvest an admin login session cookie and steal an admin session upon an admin login. | |||||
| CVE-2020-23831 | 1 Stock Management System Project | 1 Stock Management System | 2026-06-17 | 4.3 MEDIUM | 6.4 MEDIUM |
| A Reflected Cross-Site Scripting (XSS) vulnerability in the index.php login-portal webpage of SourceCodester Stock Management System v1.0 allows remote attackers to harvest login credentials and session cookies when an unauthenticated victim clicks on a malicious URL and enters credentials. | |||||
| CVE-2020-23830 | 1 Stock Management System Project | 1 Stock Management System | 2026-06-17 | 5.8 MEDIUM | 7.1 HIGH |
| A Cross-Site Request Forgery (CSRF) vulnerability in changeUsername.php in SourceCodester Stock Management System v1.0 allows remote attackers to deny future logins by changing an authenticated victim's username when they visit a third-party site. | |||||
| CVE-2020-23829 | 1 Librehealth | 1 Librehealth Ehr | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| interface/new/new_comprehensive_save.php in LibreHealth EHR 2.0.0 suffers from an authenticated file upload vulnerability, allowing remote attackers to achieve remote code execution (RCE) on the hosting webserver by uploading a maliciously crafted image. | |||||
| CVE-2020-23828 | 1 Online Course Registration Project | 1 Online Course Registration | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| A File Upload vulnerability in SourceCodester Online Course Registration v1.0 allows remote attackers to achieve Remote Code Execution (RCE) on the hosting webserver by uploading a crafted PHP web-shell that bypasses the image upload filters. An attack uses /Online%20Course%20Registration/my-profile.php with the POST parameter photo. | |||||
| CVE-2020-23826 | 1 Assaabloy | 2 Yale Wipc-303w, Yale Wipc-303w Firmware | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| The Yale WIPC-303W 2.21 through 2.31 camera is vulnerable to remote command execution (RCE) through command injection via the HTTP API. NOTE: This may be a duplicate of CVE-2020-10176 | |||||
| CVE-2020-23824 | 1 Argosoft | 1 Mail Server | 2026-06-17 | 6.8 MEDIUM | 8.8 HIGH |
| ArGo Soft Mail Server 1.8.8.9 is affected by Cross Site Request Forgery (CSRF) for perform remote arbitrary code execution. The component is the Administration dashboard. When using admin/user credentials, if the admin/user admin opens a website with the malicious page that will run the CSRF. | |||||
| CVE-2020-23814 | 1 Xuxueli | 1 Xxl-job | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| Multiple cross-site scripting (XSS) vulnerabilities in xxl-job v2.2.0 allow remote attackers to inject arbitrary web script or HTML via (1) AppName and (2)AddressList parameter in JobGroupController.java file. | |||||
| CVE-2020-23811 | 1 Xuxueli | 1 Xxl-job | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| xxl-job 2.2.0 allows Information Disclosure of username, model, and password via job/admin/controller/UserController.java. | |||||
| CVE-2020-23804 | 2 Debian, Freedesktop | 2 Debian Linux, Poppler | 2026-06-17 | N/A | 7.5 HIGH |
| Uncontrolled Recursion in pdfinfo, and pdftops in poppler 0.89.0 allows remote attackers to cause a denial of service via crafted input. | |||||
| CVE-2020-23793 | 1 Spice-space | 1 Spice-server | 2026-06-17 | N/A | 8.6 HIGH |
| An issue was discovered in spice-server spice-server-0.14.0-6.el7_6.1.x86_64 of Redhat's VDI product. There is a security vulnerablility that can restart KVMvirtual machine without any authorization. It is not yet known if there will be other other effects. | |||||