# Vulnerabilities published in 2020


- [CVE-2020-24342](https://insights.sbomify.com/CVE-2020-24342/): Memory corruption in fedoraproject:fedora (high 7.8)
- [CVE-2020-24341](https://insights.sbomify.com/CVE-2020-24341/): Memory corruption in altran:picotcp (critical 9.1)
- [CVE-2020-24340](https://insights.sbomify.com/CVE-2020-24340/): Memory corruption in altran:picotcp (high 7.5)
- [CVE-2020-24339](https://insights.sbomify.com/CVE-2020-24339/): Memory corruption in altran:picotcp (high 7.5)
- [CVE-2020-24338](https://insights.sbomify.com/CVE-2020-24338/): Memory corruption in altran:picotcp (critical 9.8)
- [CVE-2020-24337](https://insights.sbomify.com/CVE-2020-24337/): Denial of service in altran:picotcp (high 7.5)
- [CVE-2020-24336](https://insights.sbomify.com/CVE-2020-24336/): Memory corruption in contiki-ng:contiki-ng (critical 9.8)
- [CVE-2020-24335](https://insights.sbomify.com/CVE-2020-24335/): Memory corruption in uip project:uip (high 7.5)
- [CVE-2020-24334](https://insights.sbomify.com/CVE-2020-24334/): Memory corruption in uip project:uip (high 8.2)
- [CVE-2020-24333](https://insights.sbomify.com/CVE-2020-24333/): Missing authorization in arista:cloudvision portal (medium 6.5)
- [CVE-2020-24332](https://insights.sbomify.com/CVE-2020-24332/): Other in fedoraproject:fedora (medium 5.5)
- [CVE-2020-24331](https://insights.sbomify.com/CVE-2020-24331/): Privilege escalation in fedoraproject:fedora (high 7.8)
- [CVE-2020-24330](https://insights.sbomify.com/CVE-2020-24330/): Privilege escalation in fedoraproject:fedora (high 7.8)
- [CVE-2020-24327](https://insights.sbomify.com/CVE-2020-24327/): Server-side request forgery in discourse:discourse (medium 5.3)
- [CVE-2020-24316](https://insights.sbomify.com/CVE-2020-24316/): Cross-site scripting in admin menu project:admin menu (medium 6.1)
- [CVE-2020-24315](https://insights.sbomify.com/CVE-2020-24315/): SQL injection in wordpress poll project:wordpress poll (high 7.5)
- [CVE-2020-24314](https://insights.sbomify.com/CVE-2020-24314/): Cross-site scripting in rss feed widget project:rss feed widget (medium 6.1)
- [CVE-2020-24313](https://insights.sbomify.com/CVE-2020-24313/): Cross-site scripting in etoilewebdesign:ultimate appointment booking \& scheduling (medium 6.1)
- [CVE-2020-24312](https://insights.sbomify.com/CVE-2020-24312/): Information disclosure in filemanagerpro:file manager (high 7.5)
- [CVE-2020-24307](https://insights.sbomify.com/CVE-2020-24307/): Privilege escalation in mremoteng:mremoteng (high 7.8)
- [CVE-2020-24303](https://insights.sbomify.com/CVE-2020-24303/): Grafana XSS via a query alias for the ElasticSearch datasource (medium 6.1)
- [CVE-2020-24301](https://insights.sbomify.com/CVE-2020-24301/): Cross-site scripting in hapifhir:testpage overlay (medium 6.1)
- [CVE-2020-24297](https://insights.sbomify.com/CVE-2020-24297/): Command injection in tp-link:tl-wpa4220 firmware (high 8.8)
- [CVE-2020-24295](https://insights.sbomify.com/CVE-2020-24295/): Memory corruption in freeimage project:freeimage (high 8.8)
- [CVE-2020-24294](https://insights.sbomify.com/CVE-2020-24294/): Memory corruption in freeimage project:freeimage (medium 6.5)
- [CVE-2020-24293](https://insights.sbomify.com/CVE-2020-24293/): Memory corruption in freeimage project:freeimage (high 8.8)
- [CVE-2020-24292](https://insights.sbomify.com/CVE-2020-24292/): Memory corruption in freeimage project:freeimage (high 8.8)
- [CVE-2020-24285](https://insights.sbomify.com/CVE-2020-24285/): Information disclosure in intelbras:tip200 firmware (high 7.5)
- [CVE-2020-24275](https://insights.sbomify.com/CVE-2020-24275/): Code injection in swoole:swoole (medium 6.5)
- [CVE-2020-24271](https://insights.sbomify.com/CVE-2020-24271/): Cross-site request forgery in easycms:easycms (high 8.8)
- [CVE-2020-24266](https://insights.sbomify.com/CVE-2020-24266/): Memory corruption in broadcom:tcpreplay (high 7.5)
- [CVE-2020-24265](https://insights.sbomify.com/CVE-2020-24265/): Memory corruption in broadcom:tcpreplay (high 7.5)
- [CVE-2020-24264](https://insights.sbomify.com/CVE-2020-24264/): Missing authorization in portainer:portainer (critical 9.8)
- [CVE-2020-24263](https://insights.sbomify.com/CVE-2020-24263/): Privilege escalation in portainer:portainer (high 8.8)
- [CVE-2020-24246](https://insights.sbomify.com/CVE-2020-24246/): Information disclosure in peplink:balance 1350 firmware (high 7.5)
- [CVE-2020-24242](https://insights.sbomify.com/CVE-2020-24242/): Memory corruption in nasm:netwide assembler (medium 5.5)
- [CVE-2020-24241](https://insights.sbomify.com/CVE-2020-24241/): Use after free in nasm:netwide assembler (medium 5.5)
- [CVE-2020-24240](https://insights.sbomify.com/CVE-2020-24240/): Use after free in gnu:bison (medium 5.5)
- [CVE-2020-24231](https://insights.sbomify.com/CVE-2020-24231/): Missing authorization in jumpmind:symmetricds (critical 9.8)
- [CVE-2020-24227](https://insights.sbomify.com/CVE-2020-24227/): Information disclosure in playgroundsessions:playground sessions (high 7.5)
- [CVE-2020-24223](https://insights.sbomify.com/CVE-2020-24223/): Cross-site scripting in mara cms project:mara cms (medium 6.1)
- [CVE-2020-24222](https://insights.sbomify.com/CVE-2020-24222/): Memory corruption in rockcarry:ffjpeg (high 7.8)
- [CVE-2020-24221](https://insights.sbomify.com/CVE-2020-24221/): Denial of service in miniupnp project:ngiflib (medium 5.5)
- [CVE-2020-24220](https://insights.sbomify.com/CVE-2020-24220/): Command injection in shopxo:shopxo (high 8.8)
- [CVE-2020-24219](https://insights.sbomify.com/CVE-2020-24219/): Path traversal in szuray:iptv\/h.264 video encoder firmware (high 7.5)
- [CVE-2020-24218](https://insights.sbomify.com/CVE-2020-24218/): Hardcoded credentials in szuray:iptv\/h.264 video encoder firmware (critical 9.8)
- [CVE-2020-24217](https://insights.sbomify.com/CVE-2020-24217/): Missing authorization in jtechdigital:h.264 iptv encoder 1080p\@60hz firmware (critical 9.8)
- [CVE-2020-24216](https://insights.sbomify.com/CVE-2020-24216/): Auth bypass in jtechdigital:h.264 iptv encoder 1080p\@60hz firmware (high 7.5)
- [CVE-2020-24215](https://insights.sbomify.com/CVE-2020-24215/): Hardcoded credentials in jtechdigital:h.264 iptv encoder 1080p\@60hz firmware (critical 9.8)
- [CVE-2020-24214](https://insights.sbomify.com/CVE-2020-24214/): Memory corruption in jtechdigital:h.264 iptv encoder 1080p\@60hz firmware (critical 9.8)
- [CVE-2020-24213](https://insights.sbomify.com/CVE-2020-24213/): Integer overflow in ygopro:ygocore (high 7.5)
- [CVE-2020-24208](https://insights.sbomify.com/CVE-2020-24208/): SQL injection in online shopping alphaware project:online shopping alphaware (critical 9.8)
- [CVE-2020-24203](https://insights.sbomify.com/CVE-2020-24203/): File upload in projectworlds:travel management system (critical 9.8)
- [CVE-2020-24202](https://insights.sbomify.com/CVE-2020-24202/): File upload in projectworlds:house rental and property listing project (critical 9.8)
- [CVE-2020-24199](https://insights.sbomify.com/CVE-2020-24199/): File upload in projectworlds:car rental project (critical 9.8)
- [CVE-2020-24198](https://insights.sbomify.com/CVE-2020-24198/): Cross-site scripting in stock management system project:stock management system (medium 6.1)
- [CVE-2020-24197](https://insights.sbomify.com/CVE-2020-24197/): SQL injection in stock management system project:stock management system (critical 9.8)
- [CVE-2020-24196](https://insights.sbomify.com/CVE-2020-24196/): File upload in online bike rental project:online bike rental (high 7.2)
- [CVE-2020-24195](https://insights.sbomify.com/CVE-2020-24195/): File upload in online bike rental project:online bike rental (critical 9.1)
- [CVE-2020-24194](https://insights.sbomify.com/CVE-2020-24194/): Cross-site scripting in daily tracker system project:daily tracker system (medium 6.1)
- [CVE-2020-24193](https://insights.sbomify.com/CVE-2020-24193/): SQL injection in daily tracker system project:daily tracker system (critical 9.8)
- [CVE-2020-24188](https://insights.sbomify.com/CVE-2020-24188/): Cross-site scripting in unitedplanet:intrexx (medium 6.1)
- [CVE-2020-24187](https://insights.sbomify.com/CVE-2020-24187/): Null dereference in jerryscript:jerryscript (medium 5.5)
- [CVE-2020-24186](https://insights.sbomify.com/CVE-2020-24186/): File upload in gvectors:wpdiscuz (critical 10.0)
- [CVE-2020-24175](https://insights.sbomify.com/CVE-2020-24175/): Memory corruption in yz1:yz1 (high 7.8)
- [CVE-2020-24165](https://insights.sbomify.com/CVE-2020-24165/): Other in debian:debian linux (high 8.8)
- [CVE-2020-24164](https://insights.sbomify.com/CVE-2020-24164/): Gadget chain attack in Nippy (high 7.8)
- [CVE-2020-24162](https://insights.sbomify.com/CVE-2020-24162/): Other in tencent:tencent (high 7.8)
- [CVE-2020-24161](https://insights.sbomify.com/CVE-2020-24161/): Other in 163:netease mail master (high 7.8)
- [CVE-2020-24160](https://insights.sbomify.com/CVE-2020-24160/): Other in tencent:tim (high 7.8)
- [CVE-2020-24159](https://insights.sbomify.com/CVE-2020-24159/): Other in 163:netease youdao dictionary (high 7.8)
- [CVE-2020-24158](https://insights.sbomify.com/CVE-2020-24158/): Other in 360:speed browser (high 7.8)
- [CVE-2020-24149](https://insights.sbomify.com/CVE-2020-24149/): Server-side request forgery in secondline:podcast importer secondline (high 7.5)
- [CVE-2020-24148](https://insights.sbomify.com/CVE-2020-24148/): Server-side request forgery in mooveagency:import xml and rss feeds (critical 9.1)
- [CVE-2020-24147](https://insights.sbomify.com/CVE-2020-24147/): Server-side request forgery in xylusthemes:wp smart import (critical 9.1)
- [CVE-2020-24146](https://insights.sbomify.com/CVE-2020-24146/): Path traversal in cminds:cm download manager (high 8.1)
- [CVE-2020-24145](https://insights.sbomify.com/CVE-2020-24145/): Cross-site scripting in cminds:cm download manager (medium 6.1)
- [CVE-2020-24144](https://insights.sbomify.com/CVE-2020-24144/): Path traversal in media file organizer project:media file organizer (high 8.6)
- [CVE-2020-24143](https://insights.sbomify.com/CVE-2020-24143/): Path traversal in ninjateam:video downloader for tiktok (high 7.5)
- [CVE-2020-24142](https://insights.sbomify.com/CVE-2020-24142/): Server-side request forgery in ninjateam:video downloader for tiktok (critical 9.8)
- [CVE-2020-24141](https://insights.sbomify.com/CVE-2020-24141/): Server-side request forgery in wp-downloadmanager project:wp-downloadmanager (medium 5.3)
- [CVE-2020-24140](https://insights.sbomify.com/CVE-2020-24140/): Server-side request forgery in wcms:wcms (high 8.3)
- [CVE-2020-24139](https://insights.sbomify.com/CVE-2020-24139/): Server-side request forgery in wcms:wcms (high 8.3)
- [CVE-2020-24138](https://insights.sbomify.com/CVE-2020-24138/): Cross-site scripting in wcms:wcms (medium 6.1)
- [CVE-2020-24137](https://insights.sbomify.com/CVE-2020-24137/): Path traversal in wcms:wcms (medium 5.3)
- [CVE-2020-24136](https://insights.sbomify.com/CVE-2020-24136/): Path traversal in wcms:wcms (high 8.6)
- [CVE-2020-24135](https://insights.sbomify.com/CVE-2020-24135/): Cross-site scripting in wcms:wcms (medium 6.1)
- [CVE-2020-24133](https://insights.sbomify.com/CVE-2020-24133/): Memory corruption in radare:radare2-extras (critical 9.8)
- [CVE-2020-24130](https://insights.sbomify.com/CVE-2020-24130/): Cross-site request forgery in ponzu-cms:ponzu (high 8.1)
- [CVE-2020-24119](https://insights.sbomify.com/CVE-2020-24119/): Memory corruption in fedoraproject:fedora (high 7.1)
- [CVE-2020-24115](https://insights.sbomify.com/CVE-2020-24115/): Hardcoded credentials in online book store project:online book store (critical 9.8)
- [CVE-2020-24113](https://insights.sbomify.com/CVE-2020-24113/): Path traversal in yealink:w60b firmware (critical 9.1)
- [CVE-2020-24104](https://insights.sbomify.com/CVE-2020-24104/): Cross-site scripting in pix-link:lv-wr07 firmware (medium 6.1)
- [CVE-2020-24102](https://insights.sbomify.com/CVE-2020-24102/): Directory Traversal vulnerability in Punkbuster pbsv.d64 2.351, allows remote attackers to execute arbitrary code. (high 7.6)
- [CVE-2020-24089](https://insights.sbomify.com/CVE-2020-24089/): Denial of service in iobit:malware fighter (medium 5.5)
- [CVE-2020-24088](https://insights.sbomify.com/CVE-2020-24088/): Privilege escalation in foxconn:live update utility (high 7.8)
- [CVE-2020-24085](https://insights.sbomify.com/CVE-2020-24085/): Cross-site scripting in misp-project:misp (medium 6.1)
- [CVE-2020-24075](https://insights.sbomify.com/CVE-2020-24075/): Cross-site scripting in laborator:kalium (medium 6.1)
- [CVE-2020-24074](https://insights.sbomify.com/CVE-2020-24074/): Memory corruption in silk-v3-decoder project:silk-v3-decoder (critical 9.8)
- [CVE-2020-24063](https://insights.sbomify.com/CVE-2020-24063/): Server-side request forgery in canto:canto (high 7.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/123/