# Vulnerabilities published in 2020


- [CVE-2020-2642](https://insights.sbomify.com/CVE-2020-2642/): Other in Enterprise Manager Base Platform (medium 6.0)
- [CVE-2020-26419](https://insights.sbomify.com/CVE-2020-26419/): Denial of service in Wireshark (low 3.1)
- [CVE-2020-26418](https://insights.sbomify.com/CVE-2020-26418/): Denial of service in Wireshark (low 3.1)
- [CVE-2020-26417](https://insights.sbomify.com/CVE-2020-26417/): Information disclosure in GitLab CE/EE (medium 5.3)
- [CVE-2020-26416](https://insights.sbomify.com/CVE-2020-26416/): Information disclosure in GitLab EE (medium 4.0)
- [CVE-2020-26415](https://insights.sbomify.com/CVE-2020-26415/): Missing authorization in GitLab (medium 4.3)
- [CVE-2020-26414](https://insights.sbomify.com/CVE-2020-26414/): Denial of service in GitLab (medium 4.3)
- [CVE-2020-26413](https://insights.sbomify.com/CVE-2020-26413/): Information disclosure in GitLab CE/EE (medium 5.3)
- [CVE-2020-26412](https://insights.sbomify.com/CVE-2020-26412/): Missing authorization in GitLab EE (low 3.1)
- [CVE-2020-26411](https://insights.sbomify.com/CVE-2020-26411/): Denial of service in GitLab (medium 4.3)
- [CVE-2020-2641](https://insights.sbomify.com/CVE-2020-2641/): Other in Enterprise Manager Base Platform (medium 6.0)
- [CVE-2020-26409](https://insights.sbomify.com/CVE-2020-26409/): Denial of service in GitLab CE/EE (medium 4.3)
- [CVE-2020-26408](https://insights.sbomify.com/CVE-2020-26408/): Missing authorization in GitLab CE/EE (medium 5.3)
- [CVE-2020-26407](https://insights.sbomify.com/CVE-2020-26407/): Cross-site scripting in Gitlab CE/EE (medium 5.5)
- [CVE-2020-26406](https://insights.sbomify.com/CVE-2020-26406/): Information disclosure in GitLab EE (medium 5.3)
- [CVE-2020-26405](https://insights.sbomify.com/CVE-2020-26405/): Path traversal in GitLab CE/EE (high 7.1)
- [CVE-2020-2640](https://insights.sbomify.com/CVE-2020-2640/): Other in Enterprise Manager Base Platform (medium 6.0)
- [CVE-2020-2639](https://insights.sbomify.com/CVE-2020-2639/): Other in Enterprise Manager Base Platform (medium 6.0)
- [CVE-2020-2638](https://insights.sbomify.com/CVE-2020-2638/): Other in Enterprise Manager Base Platform (medium 6.0)
- [CVE-2020-2637](https://insights.sbomify.com/CVE-2020-2637/): Other in Enterprise Manager for Oracle Database (medium 6.0)
- [CVE-2020-2636](https://insights.sbomify.com/CVE-2020-2636/): Other in Enterprise Manager Base Platform (medium 6.0)
- [CVE-2020-2635](https://insights.sbomify.com/CVE-2020-2635/): Other in Enterprise Manager Base Platform (medium 6.0)
- [CVE-2020-2634](https://insights.sbomify.com/CVE-2020-2634/): Other in Enterprise Manager Base Platform (medium 6.0)
- [CVE-2020-2633](https://insights.sbomify.com/CVE-2020-2633/): Other in Enterprise Manager Base Platform (medium 6.0)
- [CVE-2020-2632](https://insights.sbomify.com/CVE-2020-2632/): Other in Enterprise Manager Base Platform (medium 6.0)
- [CVE-2020-26312](https://insights.sbomify.com/CVE-2020-26312/): GHSL-2020-254: Arbitrary file read and/or write in dotmesh (high 8.1)
- [CVE-2020-26311](https://insights.sbomify.com/CVE-2020-26311/): GHSL-2020-312: Regular Expression Denial of Service (ReDoS) in useragent (high 8.7)
- [CVE-2020-26310](https://insights.sbomify.com/CVE-2020-26310/): GHSL-2020-305: Regular Expression Denial of Service (ReDoS) in Pure JavaScript HTML5 Parser (high 8.7)
- [CVE-2020-2631](https://insights.sbomify.com/CVE-2020-2631/): Other in Enterprise Manager Base Platform (medium 6.0)
- [CVE-2020-26309](https://insights.sbomify.com/CVE-2020-26309/): GHSL-2020-303: Regular Expression Denial of Service (ReDoS) in nope-validator (high 8.7)
- [CVE-2020-26308](https://insights.sbomify.com/CVE-2020-26308/): GHSL-2020-302: Regular Expression Denial of Service (ReDoS) in validate.js (high 8.7)
- [CVE-2020-26307](https://insights.sbomify.com/CVE-2020-26307/): GHSL-2020-301: Regular Expression Denial of Service (ReDoS) in HTML2Markdown (high 8.7)
- [CVE-2020-26306](https://insights.sbomify.com/CVE-2020-26306/): GHSL-2020-296: Regular Expression Denial of Service (ReDoS) in Knwl.js (high 8.7)
- [CVE-2020-26305](https://insights.sbomify.com/CVE-2020-26305/): GHSL-2020-291: Regular Expression Denial of Service (ReDoS) in CommonRegexJS (high 8.7)
- [CVE-2020-26304](https://insights.sbomify.com/CVE-2020-26304/): GHSL-2020-290: Regular Expression Denial of Service (ReDoS) in foundation-sites (high 8.7)
- [CVE-2020-26303](https://insights.sbomify.com/CVE-2020-26303/): GHSL-2020-289: Regular Expression Denial of Service (ReDoS) in insane (high 8.7)
- [CVE-2020-26302](https://insights.sbomify.com/CVE-2020-26302/): is_js vulnerable to Regular Expression Denial of Service (high 7.5)
- [CVE-2020-26301](https://insights.sbomify.com/CVE-2020-26301/): Command injection in mscdex/ssh2 (high 7.5)
- [CVE-2020-26300](https://insights.sbomify.com/CVE-2020-26300/): Command injection in systeminformation (medium 5.9)
- [CVE-2020-2630](https://insights.sbomify.com/CVE-2020-2630/): Other in Enterprise Manager Base Platform (medium 6.0)
- [CVE-2020-26299](https://insights.sbomify.com/CVE-2020-26299/): File System Bounds Escape (medium 6.3)
- [CVE-2020-26298](https://insights.sbomify.com/CVE-2020-26298/): Injection in Redcarpet (medium 6.8)
- [CVE-2020-26297](https://insights.sbomify.com/CVE-2020-26297/): XSS in mdBook's search page (high 8.2)
- [CVE-2020-26296](https://insights.sbomify.com/CVE-2020-26296/): XSS in Vega (high 8.7)
- [CVE-2020-26295](https://insights.sbomify.com/CVE-2020-26295/): CMS Editor code execution (high 8.7)
- [CVE-2020-26294](https://insights.sbomify.com/CVE-2020-26294/): Exposure of server configuration (high 7.4)
- [CVE-2020-26293](https://insights.sbomify.com/CVE-2020-26293/): Possible XSS bypass if style tag is allowed (medium 6.1)
- [CVE-2020-26292](https://insights.sbomify.com/CVE-2020-26292/): Potential Malware Discovered (Possible False Positive) (low 3.1)
- [CVE-2020-26291](https://insights.sbomify.com/CVE-2020-26291/): Hostname spoofing in URI.js (medium 6.5)
- [CVE-2020-26290](https://insights.sbomify.com/CVE-2020-26290/): Critical security issues in XML encoding in Dex (critical 9.3)
- [CVE-2020-2629](https://insights.sbomify.com/CVE-2020-2629/): Other in Enterprise Manager Base Platform (medium 6.0)
- [CVE-2020-26289](https://insights.sbomify.com/CVE-2020-26289/): Regular expression Denial of Service in date-and-time (high 7.5)
- [CVE-2020-26288](https://insights.sbomify.com/CVE-2020-26288/): Parse Server stores password in plain text (high 7.7)
- [CVE-2020-26287](https://insights.sbomify.com/CVE-2020-26287/): Stored XSS in mermaid diagrams (high 8.7)
- [CVE-2020-26286](https://insights.sbomify.com/CVE-2020-26286/): Arbitary file upload (high 7.5)
- [CVE-2020-26285](https://insights.sbomify.com/CVE-2020-26285/): Widget instances allows a hacker to inject an executable file on the server on OpenMage (high 8.7)
- [CVE-2020-26284](https://insights.sbomify.com/CVE-2020-26284/): Hugo can execute a binary from the current directory on Windows (high 7.7)
- [CVE-2020-26283](https://insights.sbomify.com/CVE-2020-26283/): Control character injection in console output (medium 6.8)
- [CVE-2020-26282](https://insights.sbomify.com/CVE-2020-26282/): Template Injection in BrowserUp Proxy (critical 10.0)
- [CVE-2020-26281](https://insights.sbomify.com/CVE-2020-26281/): request smuggling in async-h1 (medium 6.8)
- [CVE-2020-26280](https://insights.sbomify.com/CVE-2020-26280/): XSS in OpenSlides (high 8.9)
- [CVE-2020-2628](https://insights.sbomify.com/CVE-2020-2628/): Other in Enterprise Manager Base Platform (medium 6.0)
- [CVE-2020-26279](https://insights.sbomify.com/CVE-2020-26279/): Path traversal (high 7.7)
- [CVE-2020-26278](https://insights.sbomify.com/CVE-2020-26278/): Weave Net Pods running in host PID namespace can be used to escalate other Kubernetes vulnerabilities (medium 5.8)
- [CVE-2020-26277](https://insights.sbomify.com/CVE-2020-26277/): Arbitrary read/write in DBdeployer (medium 6.1)
- [CVE-2020-26276](https://insights.sbomify.com/CVE-2020-26276/): SAML authentication vulnerability in Fleet (critical 10.0)
- [CVE-2020-26275](https://insights.sbomify.com/CVE-2020-26275/): Open redirect vulnerability (medium 6.1)
- [CVE-2020-26274](https://insights.sbomify.com/CVE-2020-26274/): Command Injection Vulnerability in systeminformation (medium 6.4)
- [CVE-2020-26273](https://insights.sbomify.com/CVE-2020-26273/): sqlite ATTACH allows some filesystem access (medium 5.2)
- [CVE-2020-26272](https://insights.sbomify.com/CVE-2020-26272/): Electron vulnerable to ID collision when routing IPC messages to renderers containing OOPIFs (medium 5.4)
- [CVE-2020-26271](https://insights.sbomify.com/CVE-2020-26271/): Heap out of bounds access in MakeEdge in TensorFlow (medium 4.4)
- [CVE-2020-26270](https://insights.sbomify.com/CVE-2020-26270/): CHECK-fail in LSTM with zero-length input in TensorFlow (medium 4.4)
- [CVE-2020-2627](https://insights.sbomify.com/CVE-2020-2627/): Denial of service in MySQL Server (medium 6.5)
- [CVE-2020-26269](https://insights.sbomify.com/CVE-2020-26269/): Heap out of bounds read in filesystem glob matching in TensorFlow (high 7.5)
- [CVE-2020-26268](https://insights.sbomify.com/CVE-2020-26268/): Write to immutable memory region in TensorFlow (medium 4.4)
- [CVE-2020-26267](https://insights.sbomify.com/CVE-2020-26267/): Lack of validation in data format attributes in TensorFlow (medium 4.4)
- [CVE-2020-26266](https://insights.sbomify.com/CVE-2020-26266/): Uninitialized memory access in Eigen types in TensorFlow (medium 4.4)
- [CVE-2020-26265](https://insights.sbomify.com/CVE-2020-26265/): Consensus flaw during block processing (medium 5.3)
- [CVE-2020-26264](https://insights.sbomify.com/CVE-2020-26264/): LES Server DoS via GetProofsV2 (medium 6.5)
- [CVE-2020-26263](https://insights.sbomify.com/CVE-2020-26263/): RSA vulnerability in tslite-ng (high 7.5)
- [CVE-2020-26262](https://insights.sbomify.com/CVE-2020-26262/): Loopback bypass in Coturn (high 7.2)
- [CVE-2020-26261](https://insights.sbomify.com/CVE-2020-26261/): user-readable api tokens in systemd units (high 7.9)
- [CVE-2020-26260](https://insights.sbomify.com/CVE-2020-26260/): Server Side Request Forgery in BookStack (medium 6.4)
- [CVE-2020-2626](https://insights.sbomify.com/CVE-2020-2626/): Other in Enterprise Manager Base Platform (medium 6.0)
- [CVE-2020-26259](https://insights.sbomify.com/CVE-2020-26259/): XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling (medium 6.8)
- [CVE-2020-26258](https://insights.sbomify.com/CVE-2020-26258/): Server-Side Forgery Request can be activated unmarshalling with XStream (medium 6.3)
- [CVE-2020-26257](https://insights.sbomify.com/CVE-2020-26257/): Denial of service attack via incorrect parameters to federation APIs (medium 6.5)
- [CVE-2020-26256](https://insights.sbomify.com/CVE-2020-26256/): Denial of service in fast-csv (medium 5.7)
- [CVE-2020-26255](https://insights.sbomify.com/CVE-2020-26255/): PHP Phar archives could be uploaded and executed in Kirby (medium 6.8)
- [CVE-2020-26254](https://insights.sbomify.com/CVE-2020-26254/): omniauth-apple allows attacker to fake their email address during authentication (high 7.7)
- [CVE-2020-26253](https://insights.sbomify.com/CVE-2020-26253/): .dev domains treated as local in Kirby (medium 6.8)
- [CVE-2020-26252](https://insights.sbomify.com/CVE-2020-26252/): Layout XML RCE Vulnerability in OpenMage (high 8.7)
- [CVE-2020-26251](https://insights.sbomify.com/CVE-2020-26251/): CORS configuration is possibly vulnerable (medium 4.7)
- [CVE-2020-26250](https://insights.sbomify.com/CVE-2020-26250/): Base class whitelist configuration ignored in OAuthenticator (medium 6.3)
- [CVE-2020-2625](https://insights.sbomify.com/CVE-2020-2625/): Other in Enterprise Manager Base Platform (medium 6.0)
- [CVE-2020-26249](https://insights.sbomify.com/CVE-2020-26249/): Remote Code Execution (RCE) Exploit on Cross Site Scripting (XSS) Vulnerability (high 7.7)
- [CVE-2020-26248](https://insights.sbomify.com/CVE-2020-26248/): Blind SQL injection during the CommentGrade process (medium 6.8)
- [CVE-2020-26247](https://insights.sbomify.com/CVE-2020-26247/): XXE in Nokogiri (low 2.6)
- [CVE-2020-26246](https://insights.sbomify.com/CVE-2020-26246/): Authorization bypass in Pimcore (high 7.7)
- [CVE-2020-26245](https://insights.sbomify.com/CVE-2020-26245/): Prototype Pollution leading to Command Injection in systeminformation (high 8.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/109/