# Vulnerabilities published in 2020


- [CVE-2020-25122](https://insights.sbomify.com/CVE-2020-25122/): Cross-site scripting in vbulletin:vbulletin (medium 4.8)
- [CVE-2020-25121](https://insights.sbomify.com/CVE-2020-25121/): Cross-site scripting in vbulletin:vbulletin (medium 4.8)
- [CVE-2020-25120](https://insights.sbomify.com/CVE-2020-25120/): Cross-site scripting in vbulletin:vbulletin (medium 4.8)
- [CVE-2020-2512](https://insights.sbomify.com/CVE-2020-2512/): Denial of service in Oracle Database (medium 5.9)
- [CVE-2020-25119](https://insights.sbomify.com/CVE-2020-25119/): Cross-site scripting in vbulletin:vbulletin (medium 4.8)
- [CVE-2020-25118](https://insights.sbomify.com/CVE-2020-25118/): Cross-site scripting in vbulletin:vbulletin (medium 4.8)
- [CVE-2020-25117](https://insights.sbomify.com/CVE-2020-25117/): Cross-site scripting in vbulletin:vbulletin (medium 4.8)
- [CVE-2020-25116](https://insights.sbomify.com/CVE-2020-25116/): Cross-site scripting in vbulletin:vbulletin (medium 4.8)
- [CVE-2020-25115](https://insights.sbomify.com/CVE-2020-25115/): Cross-site scripting in vbulletin:vbulletin (medium 4.8)
- [CVE-2020-25112](https://insights.sbomify.com/CVE-2020-25112/): Memory corruption in contiki-os:contiki-os (critical 9.8)
- [CVE-2020-25111](https://insights.sbomify.com/CVE-2020-25111/): Memory corruption in contiki-os:contiki-os (critical 9.8)
- [CVE-2020-25110](https://insights.sbomify.com/CVE-2020-25110/): Memory corruption in ethernut:nut\/os (critical 9.8)
- [CVE-2020-2511](https://insights.sbomify.com/CVE-2020-2511/): Denial of service in Oracle Database (high 7.7)
- [CVE-2020-25109](https://insights.sbomify.com/CVE-2020-25109/): Memory corruption in ethernut:nut\/os (critical 9.8)
- [CVE-2020-25108](https://insights.sbomify.com/CVE-2020-25108/): Memory corruption in ethernut:nut\/os (critical 9.8)
- [CVE-2020-25107](https://insights.sbomify.com/CVE-2020-25107/): Memory corruption in ethernut:nut\/os (critical 9.8)
- [CVE-2020-25106](https://insights.sbomify.com/CVE-2020-25106/): Privilege escalation in supremocontrol:supremo (high 7.8)
- [CVE-2020-25105](https://insights.sbomify.com/CVE-2020-25105/): Weak cryptography in eramba:eramba (critical 9.8)
- [CVE-2020-25104](https://insights.sbomify.com/CVE-2020-25104/): Cross-site scripting in eramba:eramba (medium 5.4)
- [CVE-2020-25102](https://insights.sbomify.com/CVE-2020-25102/): silverstripe-advancedreports vulnerable to XSS (medium 6.1)
- [CVE-2020-2510](https://insights.sbomify.com/CVE-2020-2510/): Other in Oracle Database (high 7.5)
- [CVE-2020-25097](https://insights.sbomify.com/CVE-2020-25097/): Security feature bypass in debian:debian linux (high 8.6)
- [CVE-2020-25096](https://insights.sbomify.com/CVE-2020-25096/): Missing authorization in logrhythm:platform manager (high 8.8)
- [CVE-2020-25095](https://insights.sbomify.com/CVE-2020-25095/): Cross-site request forgery in logrhythm:platform manager (high 8.8)
- [CVE-2020-25094](https://insights.sbomify.com/CVE-2020-25094/): Command injection in logrhythm:platform manager (critical 9.8)
- [CVE-2020-25093](https://insights.sbomify.com/CVE-2020-25093/): Cross-site scripting in ecommerce-codeigniter-bootstrap project:ecommerce-codeigniter-bootstrap (medium 6.1)
- [CVE-2020-25092](https://insights.sbomify.com/CVE-2020-25092/): Cross-site scripting in ecommerce-codeigniter-bootstrap project:ecommerce-codeigniter-bootstrap (medium 6.1)
- [CVE-2020-25091](https://insights.sbomify.com/CVE-2020-25091/): Cross-site scripting in ecommerce-codeigniter-bootstrap project:ecommerce-codeigniter-bootstrap (medium 6.1)
- [CVE-2020-25090](https://insights.sbomify.com/CVE-2020-25090/): Cross-site scripting in ecommerce-codeigniter-bootstrap project:ecommerce-codeigniter-bootstrap (medium 6.1)
- [CVE-2020-2509](https://insights.sbomify.com/CVE-2020-2509/): QNAP Network-Attached Storage (NAS) Command Injection (critical 9.8, exploited in the wild)
- [CVE-2020-25089](https://insights.sbomify.com/CVE-2020-25089/): Cross-site scripting in ecommerce-codeigniter-bootstrap project:ecommerce-codeigniter-bootstrap (medium 6.1)
- [CVE-2020-25088](https://insights.sbomify.com/CVE-2020-25088/): Cross-site scripting in ecommerce-codeigniter-bootstrap project:ecommerce-codeigniter-bootstrap (medium 6.1)
- [CVE-2020-25087](https://insights.sbomify.com/CVE-2020-25087/): Cross-site scripting in ecommerce-codeigniter-bootstrap project:ecommerce-codeigniter-bootstrap (medium 6.1)
- [CVE-2020-25086](https://insights.sbomify.com/CVE-2020-25086/): Cross-site scripting in ecommerce-codeigniter-bootstrap project:ecommerce-codeigniter-bootstrap (medium 6.1)
- [CVE-2020-25085](https://insights.sbomify.com/CVE-2020-25085/): Memory corruption in debian:debian linux (medium 5.0)
- [CVE-2020-25084](https://insights.sbomify.com/CVE-2020-25084/): Use after free in debian:debian linux (low 3.2)
- [CVE-2020-25082](https://insights.sbomify.com/CVE-2020-25082/): Information disclosure in nuvoton:npct75x firmware (low 3.8)
- [CVE-2020-2508](https://insights.sbomify.com/CVE-2020-2508/): Command Injection Vulnerability in QTS and QuTS hero (high 7.2)
- [CVE-2020-25079](https://insights.sbomify.com/CVE-2020-25079/): D-Link DCS-2530L and DCS-2670L Command Injection (high 8.8, exploited in the wild)
- [CVE-2020-25078](https://insights.sbomify.com/CVE-2020-25078/): D-Link DCS-2530L and DCS-2670L Devices Unspecified (high 7.5, exploited in the wild)
- [CVE-2020-25074](https://insights.sbomify.com/CVE-2020-25074/): MoinMoin vulnerable to remote code execution via cache action (critical 9.8)
- [CVE-2020-25073](https://insights.sbomify.com/CVE-2020-25073/): Information disclosure in debian:freedombox (medium 5.3)
- [CVE-2020-25071](https://insights.sbomify.com/CVE-2020-25071/): Cross-site scripting in niftypm:nifty (medium 5.4)
- [CVE-2020-25070](https://insights.sbomify.com/CVE-2020-25070/): Cross-site request forgery in usvn:usvn (high 8.8)
- [CVE-2020-2507](https://insights.sbomify.com/CVE-2020-2507/): command injection vulnerability in Helpdesk (critical 9.8)
- [CVE-2020-25069](https://insights.sbomify.com/CVE-2020-25069/): Code injection in usvn:usvn (critical 9.8)
- [CVE-2020-25068](https://insights.sbomify.com/CVE-2020-25068/): Path traversal in setelsa-security:conacwin (high 7.5)
- [CVE-2020-25067](https://insights.sbomify.com/CVE-2020-25067/): Command injection in netgear:r8300 firmware (critical 9.6)
- [CVE-2020-25066](https://insights.sbomify.com/CVE-2020-25066/): Memory corruption in treck:tcp\/ip (critical 10.0)
- [CVE-2020-25065](https://insights.sbomify.com/CVE-2020-25065/): Information disclosure in google:android (high 7.5)
- [CVE-2020-25064](https://insights.sbomify.com/CVE-2020-25064/): Other in google:android (high 7.5)
- [CVE-2020-25063](https://insights.sbomify.com/CVE-2020-25063/): Denial of service in google:android (high 7.5)
- [CVE-2020-25062](https://insights.sbomify.com/CVE-2020-25062/): Privilege escalation in google:android (critical 9.8)
- [CVE-2020-25061](https://insights.sbomify.com/CVE-2020-25061/): Other in google:android (critical 9.8)
- [CVE-2020-25060](https://insights.sbomify.com/CVE-2020-25060/): Privilege escalation in google:android (high 7.8)
- [CVE-2020-2506](https://insights.sbomify.com/CVE-2020-2506/): QNAP Helpdesk Improper Access Control (high 7.3, exploited in the wild)
- [CVE-2020-25059](https://insights.sbomify.com/CVE-2020-25059/): Denial of service in google:android (high 7.5)
- [CVE-2020-25058](https://insights.sbomify.com/CVE-2020-25058/): Missing authorization in google:android (critical 9.8)
- [CVE-2020-25057](https://insights.sbomify.com/CVE-2020-25057/): Missing authorization in google:android (critical 9.8)
- [CVE-2020-25056](https://insights.sbomify.com/CVE-2020-25056/): Security feature bypass in google:android (high 7.5)
- [CVE-2020-25055](https://insights.sbomify.com/CVE-2020-25055/): Security feature bypass in google:android (critical 9.8)
- [CVE-2020-25054](https://insights.sbomify.com/CVE-2020-25054/): Memory corruption in samsung:exynos (critical 9.1)
- [CVE-2020-25053](https://insights.sbomify.com/CVE-2020-25053/): Other in google:android (critical 9.8)
- [CVE-2020-25052](https://insights.sbomify.com/CVE-2020-25052/): Memory corruption in google:android (critical 9.8)
- [CVE-2020-25051](https://insights.sbomify.com/CVE-2020-25051/): Security feature bypass in google:android (high 7.5)
- [CVE-2020-25050](https://insights.sbomify.com/CVE-2020-25050/): Information disclosure in google:android (high 7.5)
- [CVE-2020-2505](https://insights.sbomify.com/CVE-2020-2505/): Sensitive information via generation of error messages vulnerability in QES (low 2.3)
- [CVE-2020-25049](https://insights.sbomify.com/CVE-2020-25049/): Missing authorization in google:android (critical 9.8)
- [CVE-2020-25048](https://insights.sbomify.com/CVE-2020-25048/): Auth bypass in google:android (medium 4.6)
- [CVE-2020-25047](https://insights.sbomify.com/CVE-2020-25047/): Security feature bypass in google:android (medium 5.5)
- [CVE-2020-25046](https://insights.sbomify.com/CVE-2020-25046/): Information disclosure in google:android (medium 5.5)
- [CVE-2020-25045](https://insights.sbomify.com/CVE-2020-25045/): Privilege escalation in Kaspersky Security Center & Kaspersky Security Center Web Console (high 7.8)
- [CVE-2020-25044](https://insights.sbomify.com/CVE-2020-25044/): Other in Kaspersky Virus Removal Tool (high 7.1)
- [CVE-2020-25043](https://insights.sbomify.com/CVE-2020-25043/): Other in Kaspersky VPN Secure Connection (high 7.1)
- [CVE-2020-25042](https://insights.sbomify.com/CVE-2020-25042/): File upload in maracms:maracms (high 7.2)
- [CVE-2020-25040](https://insights.sbomify.com/CVE-2020-25040/): Insecure permissions on build temporary rootfs in Singularity (high 8.8)
- [CVE-2020-2504](https://insights.sbomify.com/CVE-2020-2504/): Absolute path traversal vulnerability in QES (medium 5.8)
- [CVE-2020-25039](https://insights.sbomify.com/CVE-2020-25039/): Insecure permissions on user namespace / fakeroot temporary rootfs in Singularity (high 8.1)
- [CVE-2020-25037](https://insights.sbomify.com/CVE-2020-25037/): Command injection in ucopia:ucopia wireless appliance (high 8.2)
- [CVE-2020-25036](https://insights.sbomify.com/CVE-2020-25036/): Command injection in ucopia:ucopia wireless appliance (high 8.8)
- [CVE-2020-25035](https://insights.sbomify.com/CVE-2020-25035/): Code injection in ucopia:express wireless appliance (medium 6.7)
- [CVE-2020-25034](https://insights.sbomify.com/CVE-2020-25034/): SQL injection in fireeye:email malware protection system (medium 6.5)
- [CVE-2020-25033](https://insights.sbomify.com/CVE-2020-25033/): Cross-site scripting in blubrry:subscribe sidebar (medium 6.1)
- [CVE-2020-25032](https://insights.sbomify.com/CVE-2020-25032/): Flask-Cors Directory Traversal vulnerability (high 7.5)
- [CVE-2020-25031](https://insights.sbomify.com/CVE-2020-25031/): Misconfiguration in canonical:checkinstall (high 7.8)
- [CVE-2020-2503](https://insights.sbomify.com/CVE-2020-2503/): Stored cross-site scripting vulnerability in QES (critical 9.0)
- [CVE-2020-25026](https://insights.sbomify.com/CVE-2020-25026/): Information Disclosure in TYPO3 extension sf_event_mgt (medium 4.3)
- [CVE-2020-25025](https://insights.sbomify.com/CVE-2020-25025/): Incorrect Authorization in TYPO3 extension (medium 4.3)
- [CVE-2020-25023](https://insights.sbomify.com/CVE-2020-25023/): Memory corruption in noise-java project:noise-java (critical 9.8)
- [CVE-2020-25022](https://insights.sbomify.com/CVE-2020-25022/): Memory corruption in noise-java project:noise-java (critical 9.8)
- [CVE-2020-25021](https://insights.sbomify.com/CVE-2020-25021/): Memory corruption in noise-java project:noise-java (critical 9.8)
- [CVE-2020-25020](https://insights.sbomify.com/CVE-2020-25020/): Improper Restriction of XML External Entity Reference in MPXJ (critical 9.8)
- [CVE-2020-2502](https://insights.sbomify.com/CVE-2020-2502/): Cross-site Scripting Vulnerability in Photo Station (medium 6.1)
- [CVE-2020-25019](https://insights.sbomify.com/CVE-2020-25019/): Security feature bypass in jitsi:meet electron (high 7.5)
- [CVE-2020-25018](https://insights.sbomify.com/CVE-2020-25018/): Other in envoyproxy:envoy (high 7.5)
- [CVE-2020-25017](https://insights.sbomify.com/CVE-2020-25017/): Other in envoyproxy:envoy (high 8.3)
- [CVE-2020-25016](https://insights.sbomify.com/CVE-2020-25016/): Out of bounds access in rgb (critical 9.1)
- [CVE-2020-25015](https://insights.sbomify.com/CVE-2020-25015/): Cross-site request forgery in genexis:platinum 4410 firmware (medium 6.5)
- [CVE-2020-25014](https://insights.sbomify.com/CVE-2020-25014/): Memory corruption in zyxel:access points firmware (critical 9.8)
- [CVE-2020-25013](https://insights.sbomify.com/CVE-2020-25013/): Denial of service in jetbrains:toolbox (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/118/