Total
413315 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-13867 | 2 Fedoraproject, Targetcli-fb Project | 2 Fedora, Targetcli-fb | 2026-06-17 | 2.1 LOW | 5.5 MEDIUM |
| Open-iSCSI targetcli-fb through 2.1.52 has weak permissions for /etc/target (and for the backup directory and backup files). | |||||
| CVE-2020-13866 | 1 Qbik | 1 Wingate | 2026-06-17 | 7.2 HIGH | 7.8 HIGH |
| WinGate v9.4.1.5998 has insecure permissions for the installation directory, which allows local users to gain privileges by replacing an executable file with a Trojan horse. | |||||
| CVE-2020-13865 | 1 Elementor | 1 Elementor Page Builder | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from multiple stored XSS vulnerabilities. An author user can create posts that result in stored XSS vulnerabilities, by using a crafted link in the custom URL or by applying custom attributes. | |||||
| CVE-2020-13864 | 1 Elementor | 1 Elementor Page Builder | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from a stored XSS vulnerability. An author user can create posts that result in a stored XSS by using a crafted payload in custom links. | |||||
| CVE-2020-13863 | 1 Mitel | 1 Micollab | 2026-06-17 | 5.5 MEDIUM | 8.1 HIGH |
| The SAS portal of Mitel MiCollab before 9.1.3 could allow an attacker to access user data by performing a header injection in HTTP responses, due to the improper handling of input parameters. A successful exploit could allow an attacker to access user information. | |||||
| CVE-2020-13860 | 1 Mofinetwork | 2 Mofi4500-4gxelte, Mofi4500-4gxelte Firmware | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. The one-time password algorithm for the undocumented system account mofidev generates a predictable six-digit password. | |||||
| CVE-2020-13859 | 1 Mofinetwork | 2 Mofi4500-4gxelte, Mofi4500-4gxelte Firmware | 2026-06-17 | 5.0 MEDIUM | 9.8 CRITICAL |
| An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. A format error in /etc/shadow, coupled with a logic bug in the LuCI - OpenWrt Configuration Interface framework, allows the undocumented system account mofidev to login to the cgi-bin/luci/quick/wizard management interface without a password by abusing a forgotten-password feature. | |||||
| CVE-2020-13858 | 1 Mofinetwork | 2 Mofi4500-4gxelte, Mofi4500-4gxelte Firmware | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| An issue was discovered on Mofi Network MOFI4500-4GXeLTE 3.6.1-std and 4.0.8-std devices. They contain two undocumented administrator accounts. The sftp and mofidev accounts are defined in /etc/passwd and the password is not unique across installations. | |||||
| CVE-2020-13857 | 1 Mofinetwork | 2 Mofi4500-4gxelte, Mofi4500-4gxelte Firmware | 2026-06-17 | 7.8 HIGH | 7.5 HIGH |
| An issue was discovered on Mofi Network MOFI4500-4GXeLTE 3.6.1-std and 4.0.8-std devices. They can be rebooted by sending an unauthenticated poof.cgi HTTP GET request. | |||||
| CVE-2020-13856 | 1 Mofinetwork | 2 Mofi4500-4gxelte, Mofi4500-4gxelte Firmware | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.0.8-std devices. Authentication is not required to download the support file that contains sensitive information such as cleartext credentials and password hashes. | |||||
| CVE-2020-13855 | 1 Pandorafms | 1 Pandora Fms | 2026-06-17 | 9.0 HIGH | 7.2 HIGH |
| Artica Pandora FMS 7.44 allows arbitrary file upload (leading to remote command execution) via the File Repository Manager feature. | |||||
| CVE-2020-13854 | 1 Pandorafms | 1 Pandora Fms | 2026-06-17 | 10.0 HIGH | 9.8 CRITICAL |
| Artica Pandora FMS 7.44 allows privilege escalation. | |||||
| CVE-2020-13853 | 1 Pandorafms | 1 Pandora Fms | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| Artica Pandora FMS 7.44 has persistent XSS in the Messages feature. | |||||
| CVE-2020-13852 | 1 Pandorafms | 1 Pandora Fms | 2026-06-17 | 9.0 HIGH | 7.2 HIGH |
| Artica Pandora FMS 7.44 allows arbitrary file upload (leading to remote command execution) via the File Manager feature. | |||||
| CVE-2020-13851 | 1 Pandorafms | 1 Pandora Fms | 2026-06-17 | 9.0 HIGH | 8.8 HIGH |
| Artica Pandora FMS 7.44 allows remote command execution via the events feature. | |||||
| CVE-2020-13850 | 1 Pandorafms | 1 Pandora Fms | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| Artica Pandora FMS 7.44 has inadequate access controls on a web folder. | |||||
| CVE-2020-13849 | 1 Mqtt | 1 Mqtt | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| The MQTT protocol 3.1.1 requires a server to set a timeout value of 1.5 times the Keep-Alive value specified by a client, which allows remote attackers to cause a denial of service (loss of the ability to establish new connections), as demonstrated by SlowITe. | |||||
| CVE-2020-13848 | 2 Debian, Libupnp Project | 2 Debian Linux, Libupnp | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| Portable UPnP SDK (aka libupnp) 1.12.1 and earlier allows remote attackers to cause a denial of service (crash) via a crafted SSDP message due to a NULL pointer dereference in the functions FindServiceControlURLPath and FindServiceEventURLPath in genlib/service_table/service_table.c. | |||||
| CVE-2020-13847 | 1 Sylabs | 1 Singularity | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| Sylabs Singularity 3.0 through 3.5 lacks support for an Integrity Check. Singularity's sign and verify commands do not sign metadata found in the global header or data object descriptors of a SIF file. | |||||
| CVE-2020-13846 | 1 Sylabs | 1 Singularity | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| Sylabs Singularity 3.5.0 through 3.5.3 fails to report an error in a Status Code. | |||||