CVEs published in June 2020
2,026 vulnerabilities, 225 critical, 10 exploited.
- booleboxBooleBox Secure File Sharing Utility (potentially all versions) allows CSV injection via a...7.3 High
- bluditBludit 3.12.0 allows admins to use a /plugin-backup-download?file=../ directory traversal...4.9 Medium
- booleboxBooleBox Secure File Sharing Utility (potentially all versions) allows stored XSS via a crafted...5.4 Medium
- ntp, netapp 8300 firmware, 8700 firmware +13 more +15 morentpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a...4.4 Medium
- rubyonrails rails, fedoraproject fedora, rails https://github.com/rails/rails +2 moreUntrusted users can run pending migrations in production in Rails6.5 Medium
django-sendfile2PyPIDirectory traversal outside of SENDFILE_ROOT in django-sendfile2No score- draytek vigor2960 firmware, vigor300b firmware, vigor3900 firmware +2 moreDrayTek Vigor3900, Vigor2960, and Vigor300B with firmware before 1.5.1.1 is affected by a remote...9.8 Critical
- draytek vigor2960 firmware, vigor300b firmware, vigor3900 firmware +2 moreStack-based buffer overflow vulnerability in Vigor3900, Vigor2960, and Vigor300B with firmware...9.8 Critical
- mi mijia inkjet printer firmwareAn issue was discovered on Xiaomi Mi Jia ink-jet printer < 3.4.6_0138. Injecting parameters to...9.8 Critical
- mi xiaomi r3600 firmwareXiaomi router R3600 ROM before 1.0.50 is affected by a sensitive information leakage caused by an...7.5 High
- mi xiaomi r3600 firmwareXiaomi router R3600 ROM before 1.0.50 is affected by a vulnerability when checking backup file in...9.8 Critical
- mi xiaomi r3600 firmwareAn unsafe configuration of nginx lead to information leak in Xiaomi router R3600 ROM before 1.0.50.7.5 High
- vmware esxi, fusion, workstation +1 more +3 moreVMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202004101-SG and 6.5 before...8.2 High
- vmware esxi, fusion, workstation +1 more +3 moreVMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839, 6.7 before ESXi670-202004101-SG and 6.5 before...7.8 High
- xiaomi router r3600, mi xiaomi r3600 firmware +1 moreIn Xiaomi router R3600, ROM version<1.0.20, the connection service can be injected through the...9.8 Critical
- zte netnumenu31r20, netnumen u31 r10 firmware +1 moreThe version V12.17.20T115 of ZTE U31R20 product is impacted by a design error vulnerability. An...8.0 High
- apache traffic server, debian linux +1 moreApache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.10, and 8.0.0 to 8.0.7 is vulnerable to...7.5 High
- xiaomi router r3600, mi xiaomi r3600 firmware +1 moreIn Xiaomi router R3600, ROM version<1.0.20, a connect service suffers from an injection...9.8 Critical
- expressionengineExpressionEngine before 5.3.2 allows remote attackers to upload and execute arbitrary code in a ...8.8 High
- bitrix24The Web Application Firewall in Bitrix24 through 20.0.0 allows XSS via the items[ITEMS][ID]...6.1 Medium
- bitrix24Bitrix24 through 20.0.975 allows SSRF via an intranet IP address in the services/main/ajax.php...9.8 Critical
- acf to rest api project to rest apiacf-to-rest-api plugin insecure direct object reference (IDOR) via permalink manipulation7.5 High
- naviwebs navigate cmsAn issue was discovered in Navigate CMS 2.9 r1433. There is a stored XSS vulnerability that is...6.1 Medium
- naviwebs navigate cmsAn issue was discovered in Navigate CMS 2.9 r1433. Sessions, as well as associated information...7.5 High
- naviwebs navigate cmsAn issue was discovered in Navigate CMS 2.9 r1433. The forgot-password feature allows users to...5.3 Medium
- gleamtech fileultimateGleamTech FileUltimate Cross-site Scripting6.1 Medium
- naviwebs navigate cmsAn issue was discovered in Navigate CMS 2.9 r1433. When performing a password reset, a user is...7.5 High
- naviwebs navigate cmsAn issue was discovered in Navigate CMS 2.9 r1433. The query parameter fid on the resource...5.4 Medium
- ibm security secret serverIBM Security Secret Server 10.7 could allow a remote attacker to obtain sensitive information,...5.9 Medium
- ibm security secret serverIBM Security Secret Server 10.7 could disclose sensitive information included in installation...5.3 Medium
- ibm security secret serverIBM Security Secret Server 10.7 could allow a remote attacker to obtain sensitive information...2.7 Low
- ibm security secret serverIBM Security Secret Server 10.7 could allow a remote attacker to obtain sensitive information...2.7 Low
- ibm security secret serverIBM Security Secret Server 10.7 is vulnerable to cross-site scripting. This vulnerability allows...6.1 Medium
- ibm security secret serverIBM Security Secret Server 10.7 could allow a remote attacker to hijack the clicking action of...4.3 Medium
- solarwinds orion network performance monitor, orion web performance monitor +1 moreSolarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows...8.8 High
- solarwinds orion network performance monitor, orion web performance monitor +1 moreSolarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows...5.4 Medium
- solarwinds orion network performance monitor, orion web performance monitor +1 moreSolarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows...5.4 Medium
- sane-project sane backends, canonical ubuntu linux, debian linux +1 more +3 moreAn out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to...4.3 Medium
- sane-project sane backends, canonical ubuntu linux, debian linux +1 more +3 moreAn out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to...4.3 Medium
- sane-project sane backends, canonical ubuntu linux, opensuse leap +2 moreAn out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to...4.3 Medium
- sane-project sane backends, canonical ubuntu linux, debian linux +1 more +3 moreA heap buffer overflow in SANE Backends before 1.0.30 may allow a malicious device connected to...8.0 High
- sane-project sane backends, canonical ubuntu linux, opensuse leap +2 moreA NULL pointer dereference in SANE Backends before 1.0.30 allows a malicious device connected to...5.7 Medium
- playsmsplaySMS through 1.4.3 is vulnerable to session fixation.6.5 Medium
- pramod blogcmspramodmahato BlogCMS through 2019-12-31 has admin/changepass.php CSRF.8.8 High
- sas go rpm utilsArbitrary File Write via Archive Extraction (Zip Slip)7.5 High
- gnu mailman, canonical ubuntu linux, debian linux +2 moreGNU Mailman before 2.1.33 allows arbitrary content injection via the Cgi/private.py private...4.3 Medium
- idsoftware tech 1, doom vanille project vanille +1 moreA buffer overflow in the M_LoadDefaults function in m_misc.c in id Tech 1 (aka Doom engine)...9.8 Critical
- bluditBludit 3.12.0 allows stored XSS via JavaScript code in an SVG document to bl-kernel/ajax/logo...5.4 Medium
- aliasrobotics mir1000 firmware, mir100 firmware, mir200 firmware +8 more +10 moreRVD#2569: Insecure operating system defaults in MiR robots10.0 Critical
- easyrobotics er-flex firmware, er-lite firmware, er-one firmware +8 more +10 moreRVD#2568: Apache server is vulnerable to a DoS8.2 High
- Show moreLoading…