Skip to content
OpenAdvisories

Archive

June 2020

Vulnerabilities first published in this month (UTC), newest first.

← May 2020 2020 / June July 2020 →
  1. 138
  2. 256
  3. 3127
  4. 4100
  5. 533
  6. 65
  7. 78
  8. 834
  9. 9222
  10. 1074
  11. 11123
  12. 1228
  13. 13 
  14. 143
  15. 1590
  16. 1653
  17. 1752
  18. 1884
  19. 19193
  20. 202
  21. 218
  22. 2280
  23. 2327
  24. 2466
  25. 2574
  26. 26104
  27. 272
  28. 283
  29. 2972
  30. 3052
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 10.0
    CVE-2020-2021 Exploited · Ransomware Public exploit

    PAN-OS: Authentication Bypass in SAML Authentication

    When Security Assertion Markup Language (SAML) authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled (unchecked), improper verification of signatures in PAN-OS SAML authentication enables an unauthenticated network-base…

    Palo Alto Networks PAN-OS Network devices
    KEV Mar 25, 2022
  • Critical 10.0
    CVE-2018-21268 Public exploit

    Node-Traceroute RCE Vulnerability

    The traceroute (aka node-traceroute) package through 1.0.0 for Node.js allows remote command injection via the host parameter. This occurs because the Child.exec() method, which is considered to be not entirely safe, is used. In particular, an OS command can …

    traceroute npm
  • Critical 9.8
    CVE-2020-9480 Public exploit Scanner template EPSS 30%

    Improper Authentication in Apache Spark

    In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application…

    Apache Software Foundation Apache Spark pyspark org.apache.spark:spark-parent_2.11 Maven PyPI
  • Critical 9.8
    CVE-2020-11989 Public exploit EPSS 24%

    Improper Authentication in Apache Shiro

    Apache Shiro before 1.5.3, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass.

    Apache Software Foundation Apache Shiro shiro shiro Debian Ubuntu Maven
  • Critical 9.8
    CVE-2020-8165 Public exploit EPSS 46%

    ActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore

    A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user-provided objects in MemCacheStore and RedisCacheStore potentially resulting in an RCE.

    rails rails activesupport Debian Ubuntu RubyGems
  • Critical 9.8
    CVE-2020-11975 Public exploit Scanner template EPSS 31%

    Improper Input Validation in Apache Unomi

    Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process.

    org.apache.unomi:unomi Maven
  • Critical 9.8
    CVE-2020-13756 Public exploit EPSS 50%

    Sabberworm PHP CSS Parser Code injection vulnerability in allSelectors()

    Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors() or getSelectorsBySpecificity() is called with input from an attacker.

    sabberworm/php-css-parser php-horde-css-parser php-horde-css-parser Debian Ubuntu Packagist