# Vulnerabilities published in 2020


- [CVE-2020-2599](https://insights.sbomify.com/CVE-2020-2599/): Other in Hospitality Cruise Materials Management (medium 4.2)
- [CVE-2020-25989](https://insights.sbomify.com/CVE-2020-25989/): Privilege escalation in pritunl:pritunl-client-electron (high 7.8)
- [CVE-2020-25988](https://insights.sbomify.com/CVE-2020-25988/): Information disclosure in genexis:platinum 4410 firmware (medium 6.5)
- [CVE-2020-25987](https://insights.sbomify.com/CVE-2020-25987/): Hardcoded credentials in monocms:monocms (high 7.5)
- [CVE-2020-25986](https://insights.sbomify.com/CVE-2020-25986/): Cross-site request forgery in monocms:monocms (medium 6.5)
- [CVE-2020-25985](https://insights.sbomify.com/CVE-2020-25985/): Path traversal in monocms:monocms (high 8.1)
- [CVE-2020-2598](https://insights.sbomify.com/CVE-2020-2598/): Cross-site scripting in PeopleSoft Enterprise PT PeopleTools (medium 6.1)
- [CVE-2020-2597](https://insights.sbomify.com/CVE-2020-2597/): Other in One-to-One Fulfillment (medium 4.7)
- [CVE-2020-25969](https://insights.sbomify.com/CVE-2020-25969/): Memory corruption in gnuplot:gnuplot (critical 9.8)
- [CVE-2020-25967](https://insights.sbomify.com/CVE-2020-25967/): Code injection in fastadmin:fastadmin (high 8.8)
- [CVE-2020-25966](https://insights.sbomify.com/CVE-2020-25966/): Missing authorization in sectona:spectra (high 7.5)
- [CVE-2020-2596](https://insights.sbomify.com/CVE-2020-2596/): Other in CRM Technical Foundation (medium 4.7)
- [CVE-2020-25955](https://insights.sbomify.com/CVE-2020-25955/): Cross-site scripting in student management system project in php project:student management system project in php (medium 5.4)
- [CVE-2020-25952](https://insights.sbomify.com/CVE-2020-25952/): SQL injection in phpgurukul:user registration \& login and user management system (critical 9.8)
- [CVE-2020-25950](https://insights.sbomify.com/CVE-2020-25950/): Cross-site request forgery in totalonlinesolutions:advanced webhost billing system (medium 4.3)
- [CVE-2020-2595](https://insights.sbomify.com/CVE-2020-2595/): Information disclosure in GraalVM Enterprise Edition (medium 5.8)
- [CVE-2020-2594](https://insights.sbomify.com/CVE-2020-2594/): Other in Primavera P6 Enterprise Project Portfolio Management (medium 6.5)
- [CVE-2020-2593](https://insights.sbomify.com/CVE-2020-2593/): Other in Java (medium 4.8)
- [CVE-2020-25928](https://insights.sbomify.com/CVE-2020-25928/): Memory corruption in hcc-embedded:nichestack tcp\/ip (critical 9.8)
- [CVE-2020-25927](https://insights.sbomify.com/CVE-2020-25927/): Memory corruption in hcc-embedded:nichestack tcp\/ip (high 7.5)
- [CVE-2020-25926](https://insights.sbomify.com/CVE-2020-25926/): Weak cryptography in hcc-embedded:nichestack tcp\/ip (high 7.5)
- [CVE-2020-25925](https://insights.sbomify.com/CVE-2020-25925/): Cross-site scripting in icewarp:webclient (medium 6.1)
- [CVE-2020-2592](https://insights.sbomify.com/CVE-2020-2592/): Information disclosure in AutoVue 3D Professional Advanced (medium 5.3)
- [CVE-2020-25917](https://insights.sbomify.com/CVE-2020-25917/): Missing authorization in stratodesk:notouch center (high 8.8)
- [CVE-2020-25915](https://insights.sbomify.com/CVE-2020-25915/): ThinkCMF Cross-site Scripting Vulnerability (medium 5.4)
- [CVE-2020-25912](https://insights.sbomify.com/CVE-2020-25912/): XML external entity in getsymphony:symphony (critical 9.1)
- [CVE-2020-25911](https://insights.sbomify.com/CVE-2020-25911/): XML External Entity vulnerability in MODX CMS (critical 9.1)
- [CVE-2020-2591](https://insights.sbomify.com/CVE-2020-2591/): Other in Web Applications Desktop Integrator (high 8.2)
- [CVE-2020-25905](https://insights.sbomify.com/CVE-2020-25905/): SQL injection in mobile shop system project:mobile shop system (critical 9.8)
- [CVE-2020-25902](https://insights.sbomify.com/CVE-2020-25902/): Cross-site scripting in blackboard:collaborate ultra (medium 6.1)
- [CVE-2020-25901](https://insights.sbomify.com/CVE-2020-25901/): Open redirect in spiceworks:spiceworks (medium 6.1)
- [CVE-2020-25900](https://insights.sbomify.com/CVE-2020-25900/): Information disclosure in HelloTalk (medium 5.3)
- [CVE-2020-2590](https://insights.sbomify.com/CVE-2020-2590/): Other in Java (low 3.7)
- [CVE-2020-25890](https://insights.sbomify.com/CVE-2020-25890/): Cross-site scripting in kyocera:ecosys m2640idw firmware (medium 6.1)
- [CVE-2020-2589](https://insights.sbomify.com/CVE-2020-2589/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2020-25889](https://insights.sbomify.com/CVE-2020-25889/): SQL injection in online bus booking system project:online bus booking system (critical 9.8)
- [CVE-2020-25887](https://insights.sbomify.com/CVE-2020-25887/): Memory corruption in cesanta:mongoose (high 8.8)
- [CVE-2020-25881](https://insights.sbomify.com/CVE-2020-25881/): Path traversal in ranko:rkcms (medium 5.5)
- [CVE-2020-2588](https://insights.sbomify.com/CVE-2020-2588/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2020-25879](https://insights.sbomify.com/CVE-2020-25879/): Cross-site scripting in codologic:codoforum (medium 5.4)
- [CVE-2020-25878](https://insights.sbomify.com/CVE-2020-25878/): Cross-site scripting in blackcat-cms:blackcat cms (medium 4.8)
- [CVE-2020-25877](https://insights.sbomify.com/CVE-2020-25877/): Cross-site scripting in blackcat-cms:blackcat cms (medium 5.4)
- [CVE-2020-25876](https://insights.sbomify.com/CVE-2020-25876/): Cross-site scripting in codologic:codoforum (medium 5.4)
- [CVE-2020-25875](https://insights.sbomify.com/CVE-2020-25875/): Cross-site scripting in codologic:codoforum (medium 5.4)
- [CVE-2020-25873](https://insights.sbomify.com/CVE-2020-25873/): Path traversal in baijiacms project:baijiacms (medium 6.5)
- [CVE-2020-25872](https://insights.sbomify.com/CVE-2020-25872/): Path traversal in frogcms project:frogcms (medium 4.9)
- [CVE-2020-2587](https://insights.sbomify.com/CVE-2020-2587/): Other in Human Resources (critical 9.9)
- [CVE-2020-25869](https://insights.sbomify.com/CVE-2020-25869/): Information disclosure in fedoraproject:fedora (high 7.5)
- [CVE-2020-25868](https://insights.sbomify.com/CVE-2020-25868/): Denial of service in pexip:pexip infinity (high 7.5)
- [CVE-2020-25867](https://insights.sbomify.com/CVE-2020-25867/): Auth bypass in soplanning:soplanning (medium 5.3)
- [CVE-2020-25866](https://insights.sbomify.com/CVE-2020-25866/): Null dereference in fedoraproject:fedora (high 7.5)
- [CVE-2020-25864](https://insights.sbomify.com/CVE-2020-25864/): HashiCorp Consul Cross-site Scripting vulnerability (medium 6.1)
- [CVE-2020-25863](https://insights.sbomify.com/CVE-2020-25863/): Memory corruption in debian:debian linux (high 7.5)
- [CVE-2020-25862](https://insights.sbomify.com/CVE-2020-25862/): Denial of service in debian:debian linux (high 7.5)
- [CVE-2020-25860](https://insights.sbomify.com/CVE-2020-25860/): Race condition in Pengutronix RAUC (medium 6.6)
- [CVE-2020-2586](https://insights.sbomify.com/CVE-2020-2586/): Other in Human Resources (critical 9.9)
- [CVE-2020-25859](https://insights.sbomify.com/CVE-2020-25859/): Command injection in Qualcomm QCMAP (medium 6.7)
- [CVE-2020-25858](https://insights.sbomify.com/CVE-2020-25858/): Null dereference in Qualcomm QCMAP (high 7.5)
- [CVE-2020-25857](https://insights.sbomify.com/CVE-2020-25857/): Memory corruption in Realtek RTL8195A Wi-Fi Module (high 7.5)
- [CVE-2020-25856](https://insights.sbomify.com/CVE-2020-25856/): Memory corruption in Realtek RTL8195A Wi-Fi Module (high 8.1)
- [CVE-2020-25855](https://insights.sbomify.com/CVE-2020-25855/): Memory corruption in Realtek RTL8195A Wi-Fi Module (high 8.1)
- [CVE-2020-25854](https://insights.sbomify.com/CVE-2020-25854/): Memory corruption in Realtek RTL8195A Wi-Fi Module (high 8.1)
- [CVE-2020-25853](https://insights.sbomify.com/CVE-2020-25853/): Memory corruption in Realtek RTL8195A Wi-Fi Module (high 7.5)
- [CVE-2020-25850](https://insights.sbomify.com/CVE-2020-25850/): HGiga MailSherlock - Arbitrary File Download (high 8.1)
- [CVE-2020-2585](https://insights.sbomify.com/CVE-2020-2585/): Other in Java (medium 5.9)
- [CVE-2020-25849](https://insights.sbomify.com/CVE-2020-25849/): Openfind MailGates/MailAudit - Command Injection (high 8.8)
- [CVE-2020-25848](https://insights.sbomify.com/CVE-2020-25848/): HGiga MailSherlock - Broken Authentication (critical 9.8)
- [CVE-2020-25847](https://insights.sbomify.com/CVE-2020-25847/): Command Injection Vulnerability in QTS and QuTS hero (high 8.8)
- [CVE-2020-25846](https://insights.sbomify.com/CVE-2020-25846/): CHANGING Inc. NHIServiSignAdapter Windows Versions - Information Leakage -2 (high 7.5)
- [CVE-2020-25845](https://insights.sbomify.com/CVE-2020-25845/): CHANGING Inc. NHIServiSignAdapter Windows Versions - Information Leakage -1 (high 7.5)
- [CVE-2020-25844](https://insights.sbomify.com/CVE-2020-25844/): CHANGING Inc. NHIServiSignAdapter Windows Versions - Stack Overflow (high 8.1)
- [CVE-2020-25843](https://insights.sbomify.com/CVE-2020-25843/): CHANGING Inc. NHIServiSignAdapter Windows Versions - Heap Overflow (high 8.1)
- [CVE-2020-25842](https://insights.sbomify.com/CVE-2020-25842/): CHANGING Inc. NHIServiSignAdapter Windows Versions - Arbitrary File Access (high 7.5)
- [CVE-2020-25840](https://insights.sbomify.com/CVE-2020-25840/): Cross-site scripting in Access Manager. (medium 6.1)
- [CVE-2020-2584](https://insights.sbomify.com/CVE-2020-2584/): Other in MySQL Server (medium 4.4)
- [CVE-2020-25839](https://insights.sbomify.com/CVE-2020-25839/): SQL injection in NetIQ Identity Manager (critical 9.8)
- [CVE-2020-25838](https://insights.sbomify.com/CVE-2020-25838/): Information disclosure in Filr (medium 6.5)
- [CVE-2020-25837](https://insights.sbomify.com/CVE-2020-25837/): Information disclosure in Micro Focus Self Service Password Reset (SSPR) (high 7.5)
- [CVE-2020-25836](https://insights.sbomify.com/CVE-2020-25836/): Potential information leakage resulting in unauthorized access (medium 6.3)
- [CVE-2020-25835](https://insights.sbomify.com/CVE-2020-25835/): Micro Focus ArcSight Management Center Remote Vulnerability (medium 5.9)
- [CVE-2020-25834](https://insights.sbomify.com/CVE-2020-25834/): Cross-site scripting in ArcSight Logger (medium 5.4)
- [CVE-2020-25833](https://insights.sbomify.com/CVE-2020-25833/): Cross-site scripting in IDOL (medium 4.8)
- [CVE-2020-25832](https://insights.sbomify.com/CVE-2020-25832/): Cross-site scripting in Filr (medium 5.4)
- [CVE-2020-25830](https://insights.sbomify.com/CVE-2020-25830/): MantisBT HTML Injection vulnerability (medium 4.8)
- [CVE-2020-2583](https://insights.sbomify.com/CVE-2020-2583/): Denial of service in Java (low 3.7)
- [CVE-2020-25829](https://insights.sbomify.com/CVE-2020-25829/): Denial of service in opensuse:backports sle (high 7.5)
- [CVE-2020-25828](https://insights.sbomify.com/CVE-2020-25828/): MediaWiki Cross-site Scripting (XSS) vulnerability (medium 6.1)
- [CVE-2020-25827](https://insights.sbomify.com/CVE-2020-25827/): OATHAuth extension in MediaWiki is not implementing rate limit (high 7.5)
- [CVE-2020-25826](https://insights.sbomify.com/CVE-2020-25826/): Privilege escalation in pingidentity:pingid integration for windows login (high 7.8)
- [CVE-2020-25825](https://insights.sbomify.com/CVE-2020-25825/): Information disclosure in octopus:octopus deploy (high 7.5)
- [CVE-2020-25824](https://insights.sbomify.com/CVE-2020-25824/): Auth bypass in telegram:telegram desktop (low 2.4)
- [CVE-2020-25821](https://insights.sbomify.com/CVE-2020-25821/): Null dereference in peg-markdown project:peg-markdown (high 7.5)
- [CVE-2020-25820](https://insights.sbomify.com/CVE-2020-25820/): Server-side request forgery in bigbluebutton:bigbluebutton (medium 6.5)
- [CVE-2020-2582](https://insights.sbomify.com/CVE-2020-2582/): Other in iStore (high 8.2)
- [CVE-2020-25817](https://insights.sbomify.com/CVE-2020-25817/): SilverStripe XXE Vulnerability in CSSContentParser (medium 4.8)
- [CVE-2020-25816](https://insights.sbomify.com/CVE-2020-25816/): Token leases could outlive their TTL in HashiCorp Vault (medium 6.8)
- [CVE-2020-25815](https://insights.sbomify.com/CVE-2020-25815/): MediaWiki Cross-site Scripting (XSS) vulnerability (medium 6.1)
- [CVE-2020-25814](https://insights.sbomify.com/CVE-2020-25814/): MediaWiki Cross-site Scripting (XSS) vulnerability (medium 6.1)
- [CVE-2020-25813](https://insights.sbomify.com/CVE-2020-25813/): MediaWiki Special:UserRights exposes the existence of hidden users (medium 5.3)
- [CVE-2020-25812](https://insights.sbomify.com/CVE-2020-25812/): MediaWiki Cross-site Scripting (XSS) vulnerability (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/112/