# Vulnerabilities published in 2020


- [CVE-2020-25011](https://insights.sbomify.com/CVE-2020-25011/): Information disclosure in kyland:kps2204 6 port managed din-rail programmable serial device firmware (critical 9.8)
- [CVE-2020-25010](https://insights.sbomify.com/CVE-2020-25010/): File upload in kyland:kps2204 6 port managed din-rail programmable serial device firmware (critical 9.8)
- [CVE-2020-2501](https://insights.sbomify.com/CVE-2020-2501/): Stack Buffer Overflow in Surveillance Station (critical 9.8)
- [CVE-2020-25006](https://insights.sbomify.com/CVE-2020-25006/): SQL injection in heybbs project:heybbs (critical 9.8)
- [CVE-2020-25005](https://insights.sbomify.com/CVE-2020-25005/): SQL injection in heybbs project:heybbs (critical 9.8)
- [CVE-2020-25004](https://insights.sbomify.com/CVE-2020-25004/): SQL injection in heybbs project:heybbs (critical 9.8)
- [CVE-2020-2500](https://insights.sbomify.com/CVE-2020-2500/): Hardcoded credentials in Helpdesk (critical 9.8)
- [CVE-2020-24999](https://insights.sbomify.com/CVE-2020-24999/): Memory corruption in xpdfreader:xpdf (high 7.8)
- [CVE-2020-24996](https://insights.sbomify.com/CVE-2020-24996/): Memory corruption in xpdfreader:xpdf (high 7.8)
- [CVE-2020-24995](https://insights.sbomify.com/CVE-2020-24995/): Memory corruption in ffmpeg:ffmpeg (high 7.8)
- [CVE-2020-24994](https://insights.sbomify.com/CVE-2020-24994/): Memory corruption in libass project:libass (high 8.8)
- [CVE-2020-24993](https://insights.sbomify.com/CVE-2020-24993/): Cross-site scripting in cmswing:cmswing (medium 5.4)
- [CVE-2020-24992](https://insights.sbomify.com/CVE-2020-24992/): Cross-site scripting in cmswing:cmswing (medium 5.4)
- [CVE-2020-24990](https://insights.sbomify.com/CVE-2020-24990/): Path traversal in qsc:q-sys core manager (high 7.5)
- [CVE-2020-2499](https://insights.sbomify.com/CVE-2020-2499/): Hard-coded Password Vulnerability in QES (medium 6.3)
- [CVE-2020-24987](https://insights.sbomify.com/CVE-2020-24987/): Auth bypass in tendacn:ac18 firmware (critical 9.8)
- [CVE-2020-24986](https://insights.sbomify.com/CVE-2020-24986/): File upload in concretecms:concrete cms (high 7.2)
- [CVE-2020-24985](https://insights.sbomify.com/CVE-2020-24985/): Code injection in quadbase:espressdashboard (high 8.1)
- [CVE-2020-24984](https://insights.sbomify.com/CVE-2020-24984/): Cross-site request forgery in quadbase:espressreports es (high 8.8)
- [CVE-2020-24983](https://insights.sbomify.com/CVE-2020-24983/): Cross-site request forgery in quadbase:espressreports es (high 8.8)
- [CVE-2020-24982](https://insights.sbomify.com/CVE-2020-24982/): Cross-site request forgery in quadbase:espressdashboard (medium 4.3)
- [CVE-2020-24981](https://insights.sbomify.com/CVE-2020-24981/): Information disclosure in ucms project:ucms (medium 5.3)
- [CVE-2020-2498](https://insights.sbomify.com/CVE-2020-2498/): Cross-site scripting vulnerability in QTS and QuTS hero (medium 6.1)
- [CVE-2020-24978](https://insights.sbomify.com/CVE-2020-24978/): Memory corruption in nasm:netwide assembler (critical 9.8)
- [CVE-2020-24977](https://insights.sbomify.com/CVE-2020-24977/): Memory corruption in debian:debian linux (medium 6.5)
- [CVE-2020-24972](https://insights.sbomify.com/CVE-2020-24972/): Command injection in fedoraproject:fedora (high 8.8)
- [CVE-2020-2497](https://insights.sbomify.com/CVE-2020-2497/): Cross-site scripting vulnerability in QTS and QuTS hero (medium 6.1)
- [CVE-2020-24963](https://insights.sbomify.com/CVE-2020-24963/): Cross-site scripting in appsbd:best support system (medium 5.4)
- [CVE-2020-2496](https://insights.sbomify.com/CVE-2020-2496/): Cross-site scripting vulnerability in QTS and QuTS hero (medium 6.1)
- [CVE-2020-24955](https://insights.sbomify.com/CVE-2020-24955/): Privilege escalation in superantispyware:professional x (high 7.8)
- [CVE-2020-24950](https://insights.sbomify.com/CVE-2020-24950/): SQL injection in thedaylightstudio:fuel cms (high 8.8)
- [CVE-2020-2495](https://insights.sbomify.com/CVE-2020-2495/): Cross-site scripting vulnerability in QTS and QuTS hero (medium 6.1)
- [CVE-2020-24949](https://insights.sbomify.com/CVE-2020-24949/): Command injection in php-fusion:php-fusion (high 8.8)
- [CVE-2020-24948](https://insights.sbomify.com/CVE-2020-24948/): File upload in autoptimize:autoptimize (high 7.2)
- [CVE-2020-24944](https://insights.sbomify.com/CVE-2020-24944/): Denial of service in privateoctopus:picoquic (high 7.5)
- [CVE-2020-24941](https://insights.sbomify.com/CVE-2020-24941/): Improper Input Validation in Laravel (high 7.5)
- [CVE-2020-24940](https://insights.sbomify.com/CVE-2020-24940/): Guard bypass in Eloquent models affecting Laravel illuminate database component (high 7.5)
- [CVE-2020-2494](https://insights.sbomify.com/CVE-2020-2494/): Cross-site Scripting Vulnerability in Music Station (medium 6.1)
- [CVE-2020-24939](https://insights.sbomify.com/CVE-2020-24939/): Prototype pollution in supermixer (high 7.5)
- [CVE-2020-24932](https://insights.sbomify.com/CVE-2020-24932/): SQL injection in razormist:complaint management system (critical 9.8)
- [CVE-2020-24930](https://insights.sbomify.com/CVE-2020-24930/): Path traversal in wuzhicms:wuzhicms (high 8.1)
- [CVE-2020-2493](https://insights.sbomify.com/CVE-2020-2493/): Cross-site Scripting Vulnerability in Multimedia Console (medium 6.1)
- [CVE-2020-24928](https://insights.sbomify.com/CVE-2020-24928/): Missing authorization in premid:premid (medium 5.3)
- [CVE-2020-24925](https://insights.sbomify.com/CVE-2020-24925/): Information disclosure in elkarbackup:elkarbackup (high 7.5)
- [CVE-2020-24924](https://insights.sbomify.com/CVE-2020-24924/): Cross-site scripting in elkarbackup:elkarbackup (medium 5.4)
- [CVE-2020-24922](https://insights.sbomify.com/CVE-2020-24922/): xuxueli xxl-job Cross-Site Request Forgery Vulnerability (high 8.8)
- [CVE-2020-2492](https://insights.sbomify.com/CVE-2020-2492/): Command injection in QTS (high 7.2)
- [CVE-2020-24918](https://insights.sbomify.com/CVE-2020-24918/): Memory corruption in ambarella:oryx rtsp server (critical 9.8)
- [CVE-2020-24917](https://insights.sbomify.com/CVE-2020-24917/): Cross-site scripting in enhancesoft:osticket (medium 6.1)
- [CVE-2020-24916](https://insights.sbomify.com/CVE-2020-24916/): Command injection in canonical:ubuntu linux (critical 9.8)
- [CVE-2020-24914](https://insights.sbomify.com/CVE-2020-24914/): qcubed PHP object injection (critical 9.8)
- [CVE-2020-24913](https://insights.sbomify.com/CVE-2020-24913/): qcubed SQL injection vulnerability in profile.php via the strQuery parameter (critical 9.8)
- [CVE-2020-24912](https://insights.sbomify.com/CVE-2020-24912/): qcubed reflected cross-site scripting (XSS) vulnerability (medium 6.1)
- [CVE-2020-2491](https://insights.sbomify.com/CVE-2020-2491/): Cross-site Scripting Vulnerability in Photo Station (medium 6.1)
- [CVE-2020-24908](https://insights.sbomify.com/CVE-2020-24908/): Privilege escalation in checkmk:checkmk (high 7.8)
- [CVE-2020-24904](https://insights.sbomify.com/CVE-2020-24904/): Information disclosure in davesteele:gnome-gmail (medium 6.5)
- [CVE-2020-24903](https://insights.sbomify.com/CVE-2020-24903/): Cross-site scripting in cutesoft:cute editor (medium 6.1)
- [CVE-2020-24902](https://insights.sbomify.com/CVE-2020-24902/): Cross-site scripting in quixplorer project:quixplorer (medium 4.7)
- [CVE-2020-24901](https://insights.sbomify.com/CVE-2020-24901/): Cross-site scripting in krpano:krpano (medium 6.1)
- [CVE-2020-24900](https://insights.sbomify.com/CVE-2020-24900/): Cross-site scripting in krpano:krpano (medium 6.1)
- [CVE-2020-2490](https://insights.sbomify.com/CVE-2020-2490/): Command injection in QTS (high 7.2)
- [CVE-2020-24899](https://insights.sbomify.com/CVE-2020-24899/): Command injection in nagios:nagios xi (high 8.8)
- [CVE-2020-24898](https://insights.sbomify.com/CVE-2020-24898/): Server-side request forgery in stiltsoft:table filter and charts for confluence server (high 7.6)
- [CVE-2020-24897](https://insights.sbomify.com/CVE-2020-24897/): Cross-site scripting in stiltsoft:table filter and charts for confluence server (high 8.9)
- [CVE-2020-24890](https://insights.sbomify.com/CVE-2020-24890/): Null dereference in libraw:libraw (medium 5.5)
- [CVE-2020-24889](https://insights.sbomify.com/CVE-2020-24889/): Memory corruption in libraw:libraw (high 7.8)
- [CVE-2020-24881](https://insights.sbomify.com/CVE-2020-24881/): Server-side request forgery in enhancesoft:osticket (critical 9.8)
- [CVE-2020-24877](https://insights.sbomify.com/CVE-2020-24877/): SQL injection in zzzcms:zzzphp (critical 9.8)
- [CVE-2020-24876](https://insights.sbomify.com/CVE-2020-24876/): Hardcoded credentials in pancakeapp:pancake (critical 9.8)
- [CVE-2020-24872](https://insights.sbomify.com/CVE-2020-24872/): Cross-site scripting in lepton-cms:leptoncms (medium 6.1)
- [CVE-2020-24870](https://insights.sbomify.com/CVE-2020-24870/): Memory corruption in libraw:libraw (high 8.8)
- [CVE-2020-24863](https://insights.sbomify.com/CVE-2020-24863/): Memory corruption in freebsd:freebsd (medium 5.5)
- [CVE-2020-24862](https://insights.sbomify.com/CVE-2020-24862/): SQL injection in pharmacy medical store and sale point project:pharmacy medical store and sale point (high 7.5)
- [CVE-2020-24861](https://insights.sbomify.com/CVE-2020-24861/): Cross-site scripting in get-simple:getsimple cms (medium 5.4)
- [CVE-2020-24860](https://insights.sbomify.com/CVE-2020-24860/): Cross-site scripting in cmsmadesimple:cms made simple (medium 5.4)
- [CVE-2020-24857](https://insights.sbomify.com/CVE-2020-24857/): Cross-site scripting in inex:ixp manager (medium 6.1)
- [CVE-2020-24855](https://insights.sbomify.com/CVE-2020-24855/): easywebpack-cli Path Traversal vulnerability (medium 5.3)
- [CVE-2020-24849](https://insights.sbomify.com/CVE-2020-24849/): Command injection in fruitywifi project:fruitywifi (high 8.8)
- [CVE-2020-24848](https://insights.sbomify.com/CVE-2020-24848/): Misconfiguration in fruitywifi project:fruitywifi (high 7.8)
- [CVE-2020-24847](https://insights.sbomify.com/CVE-2020-24847/): Cross-site request forgery in fruitywifi project:fruitywifi (medium 4.3)
- [CVE-2020-24842](https://insights.sbomify.com/CVE-2020-24842/): Cross-site scripting in sdgc:pnpscada (medium 6.1)
- [CVE-2020-24841](https://insights.sbomify.com/CVE-2020-24841/): SQL injection in sdg:pnpscada (critical 9.8)
- [CVE-2020-24838](https://insights.sbomify.com/CVE-2020-24838/): Integer overflow in issuer project:issuer (high 7.5)
- [CVE-2020-24837](https://insights.sbomify.com/CVE-2020-24837/): Integer overflow in zcfees project:zcfees (high 7.5)
- [CVE-2020-24829](https://insights.sbomify.com/CVE-2020-24829/): Memory corruption in gpac:gpac (medium 5.5)
- [CVE-2020-24827](https://insights.sbomify.com/CVE-2020-24827/): Memory corruption in libelfin project:libelfin (medium 5.5)
- [CVE-2020-24826](https://insights.sbomify.com/CVE-2020-24826/): Memory corruption in libelfin project:libelfin (medium 5.5)
- [CVE-2020-24825](https://insights.sbomify.com/CVE-2020-24825/): Memory corruption in libelfin project:libelfin (medium 5.5)
- [CVE-2020-24824](https://insights.sbomify.com/CVE-2020-24824/): Memory corruption in libelfin project:libelfin (medium 5.5)
- [CVE-2020-24823](https://insights.sbomify.com/CVE-2020-24823/): Memory corruption in libelfin project:libelfin (medium 5.5)
- [CVE-2020-24822](https://insights.sbomify.com/CVE-2020-24822/): Memory corruption in libelfin project:libelfin (medium 5.5)
- [CVE-2020-24821](https://insights.sbomify.com/CVE-2020-24821/): Memory corruption in libelfin project:libelfin (medium 5.5)
- [CVE-2020-24815](https://insights.sbomify.com/CVE-2020-24815/): Server-side request forgery in microstrategy:microstrategy (medium 6.5)
- [CVE-2020-24807](https://insights.sbomify.com/CVE-2020-24807/): File restriction bypass in socket.io-file (high 7.8)
- [CVE-2020-24804](https://insights.sbomify.com/CVE-2020-24804/): Information disclosure in cms-dev:cms (medium 6.5)
- [CVE-2020-24794](https://insights.sbomify.com/CVE-2020-24794/): Cross-site scripting in kentico:xperience (medium 6.1)
- [CVE-2020-24791](https://insights.sbomify.com/CVE-2020-24791/): SQL injection in thedaylightstudio:fuel cms (critical 9.8)
- [CVE-2020-24786](https://insights.sbomify.com/CVE-2020-24786/): Auth bypass in zohocorp:manageengine ad360 (critical 9.8)
- [CVE-2020-24772](https://insights.sbomify.com/CVE-2020-24772/): Security feature bypass in clash project:clash (high 8.8)
- [CVE-2020-24771](https://insights.sbomify.com/CVE-2020-24771/): Missing authorization in nexusphp:nexusphp (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/119/