# Vulnerabilities published in 2020


- [CVE-2020-24456](https://insights.sbomify.com/CVE-2020-24456/): Misconfiguration in Intel(R) Board ID Tool (high 7.8)
- [CVE-2020-24455](https://insights.sbomify.com/CVE-2020-24455/): Privilege escalation in TPM2 source (medium 6.7)
- [CVE-2020-24454](https://insights.sbomify.com/CVE-2020-24454/): XML external entity in Intel(R) Quartus(R) Prime Pro Edition and Intel(R) Quartus(R) Prime Standard Edition (high 7.5)
- [CVE-2020-24453](https://insights.sbomify.com/CVE-2020-24453/): Privilege escalation in Intel(R) EPID SDK (high 7.8)
- [CVE-2020-24452](https://insights.sbomify.com/CVE-2020-24452/): Denial of service in Intel(R) SGX Platform Software for Windows* (medium 5.5)
- [CVE-2020-24451](https://insights.sbomify.com/CVE-2020-24451/): Privilege escalation in Intel(R) Optane(TM) DC Persistent Memory installer for Windows* (high 7.3)
- [CVE-2020-24450](https://insights.sbomify.com/CVE-2020-24450/): Privilege escalation in Intel(R) Graphics Drivers (high 7.8)
- [CVE-2020-24448](https://insights.sbomify.com/CVE-2020-24448/): Denial of service in Intel(R) Graphics Drivers (medium 5.5)
- [CVE-2020-24447](https://insights.sbomify.com/CVE-2020-24447/): Uncontrolled Search Path Element vulnerability in Lightroom Classic 10.0 (high 7.0)
- [CVE-2020-24445](https://insights.sbomify.com/CVE-2020-24445/): Cross-site Scripting Vulnerability in Commenting Function of Adobe Experience Manager (AEM) (critical 9.0)
- [CVE-2020-24444](https://insights.sbomify.com/CVE-2020-24444/): Blind SSRF in Forms add-on for AEM (medium 5.8)
- [CVE-2020-24443](https://insights.sbomify.com/CVE-2020-24443/): Reflected Cross-Site Scripting (XSS) in Adobe Connect (medium 6.1)
- [CVE-2020-24442](https://insights.sbomify.com/CVE-2020-24442/): Reflected Cross-Site Scripting (XSS) in Adobe Connect (medium 6.1)
- [CVE-2020-24441](https://insights.sbomify.com/CVE-2020-24441/): Improper Access Control in Adobe Acrobat Reader for Android (medium 5.5)
- [CVE-2020-24440](https://insights.sbomify.com/CVE-2020-24440/): Uncontrolled Search Path Element in Adobe Prelude for Windows (high 7.0)
- [CVE-2020-24439](https://insights.sbomify.com/CVE-2020-24439/): Acrobat Reader DC for macOS Signature Validation Bypass (low 2.8)
- [CVE-2020-24438](https://insights.sbomify.com/CVE-2020-24438/): Acrobat Reader DC Use-After-Free Vulnerability Could Lead to Information Disclosure (low 3.3)
- [CVE-2020-24437](https://insights.sbomify.com/CVE-2020-24437/): Acrobat Reader DC Use-After-Free Vulnerability Could Lead to Arbitrary Code Execution (high 7.8)
- [CVE-2020-24436](https://insights.sbomify.com/CVE-2020-24436/): Acrobat Pro DC PDF Export Out-Of-Bounds Write Vulnerability Could Lead to Arbitrary Code Execution (high 7.8)
- [CVE-2020-24435](https://insights.sbomify.com/CVE-2020-24435/): Acrobat Reader DC Heap-based Buffer Overflow Could Lead to Arbitrary Code Execution (high 7.8)
- [CVE-2020-24434](https://insights.sbomify.com/CVE-2020-24434/): Acrobat Pro DC Out-Of-Bounds Read Vulnerability Could Lead to Information Disclosure (low 3.3)
- [CVE-2020-24433](https://insights.sbomify.com/CVE-2020-24433/): Adobe Acrobat Reader DC Local Privilege Escalation via Installer Component (high 7.8)
- [CVE-2020-24432](https://insights.sbomify.com/CVE-2020-24432/): Acrobat Reader DC Arbitrary JavaScript Execution in PDF Documents (medium 6.7)
- [CVE-2020-24431](https://insights.sbomify.com/CVE-2020-24431/): Acrobat Reader DC for macOS Dynamic Library Injection Vulnerability (medium 4.4)
- [CVE-2020-24430](https://insights.sbomify.com/CVE-2020-24430/): Acrobat Pro DC Use-After-Free vulnerability Could Lead to Arbitrary Code Execution (high 7.8)
- [CVE-2020-24429](https://insights.sbomify.com/CVE-2020-24429/): Acrobat Reader DC for macOS Signature Verification Bypass Could Lead to Privilege Escalation (high 7.7)
- [CVE-2020-24428](https://insights.sbomify.com/CVE-2020-24428/): Acrobat Reader DC for macOS Race Condition Vulnerability Could Lead to Privilege Escalation (high 7.7)
- [CVE-2020-24427](https://insights.sbomify.com/CVE-2020-24427/): Acrobat Reader DC Codec Input Validation Vulnerability Could Lead to Information Disclosure (low 3.3)
- [CVE-2020-24426](https://insights.sbomify.com/CVE-2020-24426/): Acrobat Reader DC Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2020-24425](https://insights.sbomify.com/CVE-2020-24425/): Privilege escalation vulnerability in Dreamweaver version 20.2 (high 7.5)
- [CVE-2020-24424](https://insights.sbomify.com/CVE-2020-24424/): Uncontrolled Search Path in Adobe Premiere Pro for Windows (high 7.0)
- [CVE-2020-24423](https://insights.sbomify.com/CVE-2020-24423/): Uncontrolled Search Path in Adobe Media Encoder for Windows (high 7.0)
- [CVE-2020-24422](https://insights.sbomify.com/CVE-2020-24422/): Uncontrolled Search Path in Creative Cloud Desktop Application (high 7.0)
- [CVE-2020-24421](https://insights.sbomify.com/CVE-2020-24421/): Adobe InDesign 15.1.2 NULL Pointer Dereference Bug (medium 5.5)
- [CVE-2020-24420](https://insights.sbomify.com/CVE-2020-24420/): Uncontrolled Search Path Element in Adobe Photoshop for Windows (high 7.0)
- [CVE-2020-24419](https://insights.sbomify.com/CVE-2020-24419/): Uncontrolled Search Path Element in Adobe After Effects for Windows (high 7.0)
- [CVE-2020-24418](https://insights.sbomify.com/CVE-2020-24418/): Adobe After Effects Out-of-Bounds Read Vulnerability (high 7.8)
- [CVE-2020-24416](https://insights.sbomify.com/CVE-2020-24416/): Blind stored XSS in Marketo Sales insight plugin for SalesForce (high 7.5)
- [CVE-2020-24415](https://insights.sbomify.com/CVE-2020-24415/): Adobe Illustrator Memory Corruption Vulnerability (high 7.8)
- [CVE-2020-24414](https://insights.sbomify.com/CVE-2020-24414/): Adobe Illustrator Memory Corruption Vulnerability (high 7.8)
- [CVE-2020-24413](https://insights.sbomify.com/CVE-2020-24413/): Adobe Illustrator Memory Corruption Vulnerability (high 7.8)
- [CVE-2020-24412](https://insights.sbomify.com/CVE-2020-24412/): Adobe Illustrator Memory Corruption Vulnerability (high 7.8)
- [CVE-2020-24411](https://insights.sbomify.com/CVE-2020-24411/): Adobe Illustrator PDF File Parsing Out-Of-Bounds Write Vulnerability (high 7.8)
- [CVE-2020-24410](https://insights.sbomify.com/CVE-2020-24410/): Adobe Illustrator PDF File Parsing Out-Of-Bounds Read Vulnerability (high 7.8)
- [CVE-2020-24409](https://insights.sbomify.com/CVE-2020-24409/): Adobe Illustrator PDF File Parsing Out-Of-Bounds Read Vulnerability (high 7.8)
- [CVE-2020-24408](https://insights.sbomify.com/CVE-2020-24408/): Stored XSS in customer address upload feature (medium 6.1)
- [CVE-2020-24407](https://insights.sbomify.com/CVE-2020-24407/): Arbitrary code execution via file import functionality (critical 9.1)
- [CVE-2020-24406](https://insights.sbomify.com/CVE-2020-24406/): Document root path disclosure on Maintenance page (low 3.7)
- [CVE-2020-24405](https://insights.sbomify.com/CVE-2020-24405/): Incorrect permissions in Inventory module could lead to unauthorized modification of inventory stock data (medium 4.3)
- [CVE-2020-24404](https://insights.sbomify.com/CVE-2020-24404/): Incorrect permissions in Integrations component could lead to unauthorized deletion of cmsPages via REST API (low 2.7)
- [CVE-2020-24403](https://insights.sbomify.com/CVE-2020-24403/): Incorrect permissions could lead to unauthorized modification of inventory source data via REST API (low 2.7)
- [CVE-2020-24402](https://insights.sbomify.com/CVE-2020-24402/): Magento incorrect permissions vulnerability in the Integrations component (medium 4.9)
- [CVE-2020-24401](https://insights.sbomify.com/CVE-2020-24401/): Incorrect permissions following the deletion of a user role or deactivation of a user (medium 6.5)
- [CVE-2020-24400](https://insights.sbomify.com/CVE-2020-24400/): SQL injection allows arbitrary read from database (high 7.1)
- [CVE-2020-24397](https://insights.sbomify.com/CVE-2020-24397/): Integer overflow in zohocorp:manageengine desktop central (high 7.2)
- [CVE-2020-24396](https://insights.sbomify.com/CVE-2020-24396/): Hardcoded credentials in hom.ee:brain cube core (high 7.5)
- [CVE-2020-24395](https://insights.sbomify.com/CVE-2020-24395/): Security feature bypass in hom.ee:brain cube core (medium 6.8)
- [CVE-2020-24394](https://insights.sbomify.com/CVE-2020-24394/): Misconfiguration in canonical:ubuntu linux (high 7.1)
- [CVE-2020-24393](https://insights.sbomify.com/CVE-2020-24393/): Improper Certificate Validation in TweetStream (medium 5.9)
- [CVE-2020-24392](https://insights.sbomify.com/CVE-2020-24392/): Improper Certificate Validation in twitter-stream (medium 5.9)
- [CVE-2020-24391](https://insights.sbomify.com/CVE-2020-24391/): Remote code execution in mongo-express (critical 9.8)
- [CVE-2020-24390](https://insights.sbomify.com/CVE-2020-24390/): Cross-site scripting in eyesofnetwork:eyesofnetwork (medium 6.1)
- [CVE-2020-24388](https://insights.sbomify.com/CVE-2020-24388/): Memory corruption in fedoraproject:fedora (high 7.5)
- [CVE-2020-24387](https://insights.sbomify.com/CVE-2020-24387/): Memory corruption in fedoraproject:fedora (high 7.5)
- [CVE-2020-24386](https://insights.sbomify.com/CVE-2020-24386/): Information disclosure in debian:debian linux (medium 6.8)
- [CVE-2020-24385](https://insights.sbomify.com/CVE-2020-24385/): Null dereference in freebsd:freebsd (medium 5.5)
- [CVE-2020-24384](https://insights.sbomify.com/CVE-2020-24384/): Code injection in a10networks:advanced core operating system (critical 9.8)
- [CVE-2020-24383](https://insights.sbomify.com/CVE-2020-24383/): Memory corruption in butok:fnet (critical 9.1)
- [CVE-2020-24381](https://insights.sbomify.com/CVE-2020-24381/): Information disclosure in gunet:open eclass platform (high 7.5)
- [CVE-2020-24379](https://insights.sbomify.com/CVE-2020-24379/): XML external entity in canonical:ubuntu linux (critical 9.8)
- [CVE-2020-24377](https://insights.sbomify.com/CVE-2020-24377/): Other in free:freebox delta firmware (critical 9.6)
- [CVE-2020-24376](https://insights.sbomify.com/CVE-2020-24376/): Other in free:freebox delta firmware (critical 9.6)
- [CVE-2020-24375](https://insights.sbomify.com/CVE-2020-24375/): Security feature bypass in free:freebox server (medium 6.5)
- [CVE-2020-24374](https://insights.sbomify.com/CVE-2020-24374/): Other in free:freebox hd firmware (critical 9.6)
- [CVE-2020-24373](https://insights.sbomify.com/CVE-2020-24373/): Cross-site request forgery in free:freebox delta firmware (high 8.8)
- [CVE-2020-24372](https://insights.sbomify.com/CVE-2020-24372/): Memory corruption in luajit:luajit (high 7.5)
- [CVE-2020-24371](https://insights.sbomify.com/CVE-2020-24371/): Memory corruption in lua:lua (medium 5.3)
- [CVE-2020-24370](https://insights.sbomify.com/CVE-2020-24370/): Integer overflow in debian:debian linux (medium 5.3)
- [CVE-2020-24369](https://insights.sbomify.com/CVE-2020-24369/): Null dereference in lua:lua (high 7.5)
- [CVE-2020-24368](https://insights.sbomify.com/CVE-2020-24368/): Path traversal in debian:debian linux (high 7.5)
- [CVE-2020-24367](https://insights.sbomify.com/CVE-2020-24367/): Privilege escalation in bluestacks:bluestacks (high 7.8)
- [CVE-2020-24366](https://insights.sbomify.com/CVE-2020-24366/): Information disclosure in jetbrains:youtrack (low 3.3)
- [CVE-2020-24365](https://insights.sbomify.com/CVE-2020-24365/): Command injection in gemteks:wrtm-127acn firmware (high 8.8)
- [CVE-2020-24364](https://insights.sbomify.com/CVE-2020-24364/): Command injection in ethz:minetime (high 8.8)
- [CVE-2020-24363](https://insights.sbomify.com/CVE-2020-24363/): TP-link TL-WA855RE Missing Authentication for Critical Function (high 8.8, exploited in the wild)
- [CVE-2020-24361](https://insights.sbomify.com/CVE-2020-24361/): Command injection in debian:debian linux (critical 9.8)
- [CVE-2020-24360](https://insights.sbomify.com/CVE-2020-24360/): Denial of service in arista:eos (high 7.4)
- [CVE-2020-24359](https://insights.sbomify.com/CVE-2020-24359/): Improper Input Validation in vault-ssh-helper (high 7.5)
- [CVE-2020-24356](https://insights.sbomify.com/CVE-2020-24356/): Local Privilege Escalation in cloudflared (medium 6.4)
- [CVE-2020-24355](https://insights.sbomify.com/CVE-2020-24355/): Privilege escalation in zyxel:vmg5313-b30b firmware (critical 9.8)
- [CVE-2020-24354](https://insights.sbomify.com/CVE-2020-24354/): Command injection in zyxel:vmg5313-b30b firmware (high 8.8)
- [CVE-2020-24353](https://insights.sbomify.com/CVE-2020-24353/): Cross-site scripting in pega:pega platform (medium 6.1)
- [CVE-2020-24352](https://insights.sbomify.com/CVE-2020-24352/): Memory corruption in qemu:qemu (medium 5.5)
- [CVE-2020-24349](https://insights.sbomify.com/CVE-2020-24349/): Use after free in f5:njs (medium 5.5)
- [CVE-2020-24348](https://insights.sbomify.com/CVE-2020-24348/): Memory corruption in f5:njs (medium 5.5)
- [CVE-2020-24347](https://insights.sbomify.com/CVE-2020-24347/): Memory corruption in f5:njs (medium 5.5)
- [CVE-2020-24346](https://insights.sbomify.com/CVE-2020-24346/): Use after free in f5:njs (high 7.8)
- [CVE-2020-24345](https://insights.sbomify.com/CVE-2020-24345/): Denial of service in jerryscript:jerryscript (high 7.8)
- [CVE-2020-24344](https://insights.sbomify.com/CVE-2020-24344/): Memory corruption in jerryscript:jerryscript (high 7.1)
- [CVE-2020-24343](https://insights.sbomify.com/CVE-2020-24343/): Use after free in artifex:mujs (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/122/