# Vulnerabilities published in 2020


- [CVE-2020-24770](https://insights.sbomify.com/CVE-2020-24770/): SQL injection in nexusphp:nexusphp (critical 9.8)
- [CVE-2020-24769](https://insights.sbomify.com/CVE-2020-24769/): SQL injection in nexusphp:nexusphp (critical 9.8)
- [CVE-2020-24765](https://insights.sbomify.com/CVE-2020-24765/): Information disclosure in mind:imind server (high 7.5)
- [CVE-2020-24755](https://insights.sbomify.com/CVE-2020-24755/): Other in ui:unifi video (high 7.8)
- [CVE-2020-24753](https://insights.sbomify.com/CVE-2020-24753/): Memory corruption in objective open cbor run-time project:objective open cbor run-time (critical 9.8)
- [CVE-2020-24750](https://insights.sbomify.com/CVE-2020-24750/): Unsafe Deserialization in jackson-databind (high 8.1)
- [CVE-2020-24743](https://insights.sbomify.com/CVE-2020-24743/): Privilege escalation in zohocorp:manageengine applications manager (critical 9.8)
- [CVE-2020-24742](https://insights.sbomify.com/CVE-2020-24742/): Code injection in qt:qt (high 7.8)
- [CVE-2020-24740](https://insights.sbomify.com/CVE-2020-24740/): Cross-site request forgery in pluck-cms:pluck (medium 4.3)
- [CVE-2020-24739](https://insights.sbomify.com/CVE-2020-24739/): Cross-site request forgery in idreamsoft:icms (medium 6.5)
- [CVE-2020-24736](https://insights.sbomify.com/CVE-2020-24736/): Memory corruption in ghost:sqlite3 (medium 5.5)
- [CVE-2020-24723](https://insights.sbomify.com/CVE-2020-24723/): Cross-site scripting in phpgurukul:user registration \& login and user management system (medium 4.8)
- [CVE-2020-24722](https://insights.sbomify.com/CVE-2020-24722/): Weak cryptography in exposure notifications project:exposure notifications (medium 5.9)
- [CVE-2020-24721](https://insights.sbomify.com/CVE-2020-24721/): Information disclosure in apple:exposure notifications (medium 5.7)
- [CVE-2020-24719](https://insights.sbomify.com/CVE-2020-24719/): Information disclosure in couchbase:couchbase server (critical 9.8)
- [CVE-2020-24718](https://insights.sbomify.com/CVE-2020-24718/): Missing authorization in freebsd:freebsd (high 8.2)
- [CVE-2020-24717](https://insights.sbomify.com/CVE-2020-24717/): Misconfiguration in openzfs:openzfs (high 7.8)
- [CVE-2020-24716](https://insights.sbomify.com/CVE-2020-24716/): Misconfiguration in openzfs:openzfs (high 7.8)
- [CVE-2020-24715](https://insights.sbomify.com/CVE-2020-24715/): Scalyr Agent 2 Missing SSL Certificate Validation (critical 9.8)
- [CVE-2020-24714](https://insights.sbomify.com/CVE-2020-24714/): Scalyr Agent Missing SSL Certificate Validation (critical 9.8)
- [CVE-2020-24713](https://insights.sbomify.com/CVE-2020-24713/): Auth bypass in getgophish:gophish (high 7.5)
- [CVE-2020-24712](https://insights.sbomify.com/CVE-2020-24712/): Cross-site scripting in getgophish:gophish (medium 5.4)
- [CVE-2020-24711](https://insights.sbomify.com/CVE-2020-24711/): Denial of service in getgophish:gophish (medium 6.5)
- [CVE-2020-24710](https://insights.sbomify.com/CVE-2020-24710/): Gophish vulnerable to Server-Side Request Forgery (medium 5.3)
- [CVE-2020-24709](https://insights.sbomify.com/CVE-2020-24709/): Cross-site scripting in getgophish:gophish (medium 5.4)
- [CVE-2020-24708](https://insights.sbomify.com/CVE-2020-24708/): Cross-site scripting in getgophish:gophish (medium 5.4)
- [CVE-2020-24707](https://insights.sbomify.com/CVE-2020-24707/): Code injection in getgophish:gophish (high 7.8)
- [CVE-2020-24706](https://insights.sbomify.com/CVE-2020-24706/): Cross-site scripting in wso2:api manager (medium 6.1)
- [CVE-2020-24705](https://insights.sbomify.com/CVE-2020-24705/): Information disclosure in wso2:api manager (high 8.8)
- [CVE-2020-24704](https://insights.sbomify.com/CVE-2020-24704/): Cross-site scripting in wso2:api manager (medium 6.1)
- [CVE-2020-24703](https://insights.sbomify.com/CVE-2020-24703/): Information disclosure in wso2:api manager (high 8.8)
- [CVE-2020-24701](https://insights.sbomify.com/CVE-2020-24701/): Cross-site scripting in open-xchange:open-xchange appsuite (medium 6.1)
- [CVE-2020-24700](https://insights.sbomify.com/CVE-2020-24700/): Server-side request forgery in open-xchange:open-xchange appsuite (medium 5.4)
- [CVE-2020-24699](https://insights.sbomify.com/CVE-2020-24699/): Cross-site scripting in chamber dashboard business directory project:chamber dashboard business directory (medium 6.1)
- [CVE-2020-24698](https://insights.sbomify.com/CVE-2020-24698/): Memory corruption in powerdns:authoritative (critical 9.8)
- [CVE-2020-24697](https://insights.sbomify.com/CVE-2020-24697/): Denial of service in powerdns:authoritative (high 7.5)
- [CVE-2020-24696](https://insights.sbomify.com/CVE-2020-24696/): Race condition in powerdns:authoritative (high 8.1)
- [CVE-2020-24693](https://insights.sbomify.com/CVE-2020-24693/): Information disclosure in mitel:micontact center business (low 3.3)
- [CVE-2020-24692](https://insights.sbomify.com/CVE-2020-24692/): Cross-site scripting in mitel:micontact center business (high 7.1)
- [CVE-2020-24686](https://insights.sbomify.com/CVE-2020-24686/): AC500 V2 webserver denial of service vulnerability (high 7.5)
- [CVE-2020-24685](https://insights.sbomify.com/CVE-2020-24685/): AC500 V2 unauthenticated crafter packet vulnerability (high 8.6)
- [CVE-2020-24683](https://insights.sbomify.com/CVE-2020-24683/): Authentication Bypass in Symphony Plus (critical 9.8)
- [CVE-2020-24682](https://insights.sbomify.com/CVE-2020-24682/): Automation Studio and PVI Multiple unquoted service path vulnerabilities (high 7.2)
- [CVE-2020-24681](https://insights.sbomify.com/CVE-2020-24681/): Automation Studio and PVI Multiple incorrect permission assignments for services (high 8.2)
- [CVE-2020-24680](https://insights.sbomify.com/CVE-2020-24680/): Improper Credential Storage in Symphony Plus (high 7.0)
- [CVE-2020-24679](https://insights.sbomify.com/CVE-2020-24679/): Denial of Service attack on Symphony Plus (high 7.5)
- [CVE-2020-24678](https://insights.sbomify.com/CVE-2020-24678/): Potential Privilege Escalation in Symphony Plus (high 8.8)
- [CVE-2020-24677](https://insights.sbomify.com/CVE-2020-24677/): Insecure Web Service in Symphony Plus (high 8.8)
- [CVE-2020-24676](https://insights.sbomify.com/CVE-2020-24676/): Insecure Windows Services in Symphony Plus (high 7.8)
- [CVE-2020-24675](https://insights.sbomify.com/CVE-2020-24675/): Weak Authentication in Symphony Plus (critical 9.8)
- [CVE-2020-24674](https://insights.sbomify.com/CVE-2020-24674/): Improper Authorization in Symphony Plus (high 8.8)
- [CVE-2020-24673](https://insights.sbomify.com/CVE-2020-24673/): SQL Injection in Symphony Plus (critical 9.8)
- [CVE-2020-24672](https://insights.sbomify.com/CVE-2020-24672/): ABB Base Software for SoftControl Remote Code Execution vulnerability (critical 9.8)
- [CVE-2020-24671](https://insights.sbomify.com/CVE-2020-24671/): SQL injection in tracefinanacial:crestbridge (high 8.8)
- [CVE-2020-24670](https://insights.sbomify.com/CVE-2020-24670/): Cross-site scripting in hitachi:vantara pentaho (medium 5.4)
- [CVE-2020-24669](https://insights.sbomify.com/CVE-2020-24669/): Cross-site scripting in hitachi:vantara pentaho (medium 5.4)
- [CVE-2020-24668](https://insights.sbomify.com/CVE-2020-24668/): Cross-site scripting in tracefinancial:crestbridge (medium 5.4)
- [CVE-2020-24667](https://insights.sbomify.com/CVE-2020-24667/): SQL injection in tracefinanacial:crestbridge (high 8.8)
- [CVE-2020-24666](https://insights.sbomify.com/CVE-2020-24666/): Cross-site scripting in hitachi:vantara pentaho (medium 5.4)
- [CVE-2020-24665](https://insights.sbomify.com/CVE-2020-24665/): XML external entity in hitachi:vantara pentaho (medium 6.5)
- [CVE-2020-24664](https://insights.sbomify.com/CVE-2020-24664/): Cross-site scripting in hitachi:vantara pentaho (medium 5.4)
- [CVE-2020-24663](https://insights.sbomify.com/CVE-2020-24663/): Cross-site scripting in tracefinanacial:crestbridge (medium 5.4)
- [CVE-2020-24662](https://insights.sbomify.com/CVE-2020-24662/): Cross-site scripting in smartstream:transaction lifecycle management reconciliations-premium (medium 5.4)
- [CVE-2020-24661](https://insights.sbomify.com/CVE-2020-24661/): Security feature bypass in fedoraproject:fedora (medium 5.9)
- [CVE-2020-24660](https://insights.sbomify.com/CVE-2020-24660/): Lack of URL normalization may lead to authorization bypass when URL access rules are used (critical 9.8)
- [CVE-2020-24659](https://insights.sbomify.com/CVE-2020-24659/): Null dereference in canonical:ubuntu linux (high 7.5)
- [CVE-2020-24658](https://insights.sbomify.com/CVE-2020-24658/): Security feature bypass in arm:arm compiler (high 7.8)
- [CVE-2020-24656](https://insights.sbomify.com/CVE-2020-24656/): XML external entity in maltego:maltego (medium 6.5)
- [CVE-2020-24655](https://insights.sbomify.com/CVE-2020-24655/): Race condition in twilio:authy 2-factor authentication (medium 5.1)
- [CVE-2020-24654](https://insights.sbomify.com/CVE-2020-24654/): Path traversal in canonical:ubuntu linux (low 3.3)
- [CVE-2020-24653](https://insights.sbomify.com/CVE-2020-24653/): Expo on iOS is insecure due incorrect security attribute application (critical 9.8)
- [CVE-2020-24652](https://insights.sbomify.com/CVE-2020-24652/): Code injection in HPE Intelligent Management Center (iMC) (critical 9.8)
- [CVE-2020-24651](https://insights.sbomify.com/CVE-2020-24651/): Code injection in HPE Intelligent Management Center (iMC) (critical 9.8)
- [CVE-2020-24650](https://insights.sbomify.com/CVE-2020-24650/): Code injection in HPE Intelligent Management Center (iMC) (critical 9.8)
- [CVE-2020-24649](https://insights.sbomify.com/CVE-2020-24649/): Code injection in HPE Intelligent Management Center (iMC) (critical 9.8)
- [CVE-2020-24648](https://insights.sbomify.com/CVE-2020-24648/): Deserialization in HPE Intelligent Management Center (iMC) (critical 9.8)
- [CVE-2020-24647](https://insights.sbomify.com/CVE-2020-24647/): Code injection in HPE Intelligent Management Center (iMC) (critical 9.8)
- [CVE-2020-24646](https://insights.sbomify.com/CVE-2020-24646/): Memory corruption in HPE Intelligent Management Center (iMC) (critical 9.8)
- [CVE-2020-24641](https://insights.sbomify.com/CVE-2020-24641/): Server-side request forgery in Aruba AirWave Glass Software (high 7.5)
- [CVE-2020-24640](https://insights.sbomify.com/CVE-2020-24640/): Command injection in Aruba AirWave Glass Software (critical 9.8)
- [CVE-2020-24639](https://insights.sbomify.com/CVE-2020-24639/): Deserialization in Aruba AirWave Glass Software (critical 9.8)
- [CVE-2020-24638](https://insights.sbomify.com/CVE-2020-24638/): Command injection in Aruba AirWave Glass Software (high 7.2)
- [CVE-2020-24637](https://insights.sbomify.com/CVE-2020-24637/): Security feature bypass in Aruba 7000 Series Mobility Controllers (high 7.2)
- [CVE-2020-24636](https://insights.sbomify.com/CVE-2020-24636/): Command injection in Aruba Instant Access Points (critical 9.8)
- [CVE-2020-24635](https://insights.sbomify.com/CVE-2020-24635/): Command injection in Aruba Instant Access Points (high 7.2)
- [CVE-2020-24634](https://insights.sbomify.com/CVE-2020-24634/): Command injection in Aruba 7000 Series Mobility Controllers (critical 9.8)
- [CVE-2020-24633](https://insights.sbomify.com/CVE-2020-24633/): Memory corruption in Aruba 7000 Series Mobility Controllers (critical 9.8)
- [CVE-2020-24632](https://insights.sbomify.com/CVE-2020-24632/): Command injection in Aruba Airwave Software (high 7.2)
- [CVE-2020-24631](https://insights.sbomify.com/CVE-2020-24631/): Command injection in Aruba Airwave Software (high 7.2)
- [CVE-2020-24630](https://insights.sbomify.com/CVE-2020-24630/): Privilege escalation in HPE Intelligent Management Center (iMC) (high 8.8)
- [CVE-2020-24629](https://insights.sbomify.com/CVE-2020-24629/): Auth bypass in HPE Intelligent Management Center (iMC) (critical 9.8)
- [CVE-2020-24628](https://insights.sbomify.com/CVE-2020-24628/): Code injection in HPE KVM IP Console Switches (high 8.8)
- [CVE-2020-24627](https://insights.sbomify.com/CVE-2020-24627/): Cross-site scripting in HPE KVM IP Console Switches (medium 5.4)
- [CVE-2020-24626](https://insights.sbomify.com/CVE-2020-24626/): Path traversal in HPE Pay Per Use (PPU) Utility Computing Service (UCS) Meter (critical 9.8)
- [CVE-2020-24625](https://insights.sbomify.com/CVE-2020-24625/): Path traversal in HPE Pay Per Use (PPU) Utility Computing Service (UCS) Meter (high 7.5)
- [CVE-2020-24624](https://insights.sbomify.com/CVE-2020-24624/): Path traversal in HPE Pay Per Use (PPU) Utility Computing Service (UCS) Meter (high 7.5)
- [CVE-2020-24623](https://insights.sbomify.com/CVE-2020-24623/): SQL injection in HPE Universal API Framework for VMware ESXi (OVA) in HPE Universal API Framework for VMware Esxi v2.5.2 and HPE Universal API Framework for Microsoft Hyper-V (VHD) (medium 6.5)
- [CVE-2020-24622](https://insights.sbomify.com/CVE-2020-24622/): Information disclosure in sonatype:nexus (medium 4.9)
- [CVE-2020-24621](https://insights.sbomify.com/CVE-2020-24621/): Path traversal in openmrs:htmlformentry (high 8.8)
- [CVE-2020-24620](https://insights.sbomify.com/CVE-2020-24620/): Weak cryptography in unisys:stealth (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/120/