# Vulnerabilities published in 2020


- [CVE-2020-23234](https://insights.sbomify.com/CVE-2020-23234/): Cross Site Scripting in LavaLite CMS (medium 4.8)
- [CVE-2020-2323](https://insights.sbomify.com/CVE-2020-2323/): Missing permission checks in Jenkins Chaos Monkey Plugin (medium 5.3)
- [CVE-2020-23226](https://insights.sbomify.com/CVE-2020-23226/): Cross-site scripting in cacti:cacti (medium 6.1)
- [CVE-2020-2322](https://insights.sbomify.com/CVE-2020-2322/): Missing permission checks in Jenkins Chaos Monkey Plugin (high 7.5)
- [CVE-2020-23219](https://insights.sbomify.com/CVE-2020-23219/): Code injection in monstra:monstra cms (high 8.8)
- [CVE-2020-23217](https://insights.sbomify.com/CVE-2020-23217/): Cross-site scripting in phplist:phplist (medium 5.4)
- [CVE-2020-23214](https://insights.sbomify.com/CVE-2020-23214/): Cross-site scripting in phplist:phplist (medium 5.4)
- [CVE-2020-2321](https://insights.sbomify.com/CVE-2020-2321/): CSRF vulnerability in Jenkins Shelve Project Plugin (high 8.1)
- [CVE-2020-23209](https://insights.sbomify.com/CVE-2020-23209/): Cross-site scripting in phplist:phplist (medium 5.4)
- [CVE-2020-23208](https://insights.sbomify.com/CVE-2020-23208/): Cross-site scripting in phplist:phplist (medium 5.4)
- [CVE-2020-23207](https://insights.sbomify.com/CVE-2020-23207/): Cross-site scripting in phplist:phplist (medium 5.4)
- [CVE-2020-23205](https://insights.sbomify.com/CVE-2020-23205/): Cross-site scripting in monstra:monstra cms (medium 5.4)
- [CVE-2020-2320](https://insights.sbomify.com/CVE-2020-2320/): Jenkins Plugin Installation Manager Tool did not verify plugin downloads (critical 9.8)
- [CVE-2020-23194](https://insights.sbomify.com/CVE-2020-23194/): Cross-site scripting in phplist:phplist (medium 5.4)
- [CVE-2020-23192](https://insights.sbomify.com/CVE-2020-23192/): Cross-site scripting in phplist:phplist (medium 5.4)
- [CVE-2020-23190](https://insights.sbomify.com/CVE-2020-23190/): Cross-site scripting in phplist:phplist (medium 5.4)
- [CVE-2020-2319](https://insights.sbomify.com/CVE-2020-2319/): Password stored in plain text by Jenkins VMware Lab Manager Slaves Plugin (medium 6.5)
- [CVE-2020-23185](https://insights.sbomify.com/CVE-2020-23185/): Cross-site scripting in php-fusion:php-fusion (medium 5.4)
- [CVE-2020-23184](https://insights.sbomify.com/CVE-2020-23184/): Cross-site scripting in php-fusion:php-fusion (medium 5.4)
- [CVE-2020-23182](https://insights.sbomify.com/CVE-2020-23182/): Open redirect in php-fusion:php-fusion (medium 5.4)
- [CVE-2020-23181](https://insights.sbomify.com/CVE-2020-23181/): Cross-site scripting in php-fusion:php-fusion (medium 5.4)
- [CVE-2020-2318](https://insights.sbomify.com/CVE-2020-2318/): Passwords stored in plain text by Mail Commander Plugin for Jenkins-ci Plugin (medium 6.5)
- [CVE-2020-23179](https://insights.sbomify.com/CVE-2020-23179/): Cross-site scripting in php-fusion:php-fusion (medium 5.4)
- [CVE-2020-23178](https://insights.sbomify.com/CVE-2020-23178/): Auth bypass in php-fusion:php-fusion (medium 5.4)
- [CVE-2020-23172](https://insights.sbomify.com/CVE-2020-23172/): Path traversal in kuba project:kuba (medium 5.5)
- [CVE-2020-23171](https://insights.sbomify.com/CVE-2020-23171/): Path traversal in nim-lang:nim-lang (medium 5.5)
- [CVE-2020-2317](https://insights.sbomify.com/CVE-2020-2317/): Stored XSS vulnerability in Jenkins FindBugs Plugin (medium 5.4)
- [CVE-2020-23162](https://insights.sbomify.com/CVE-2020-23162/): Weak cryptography in pyres:termod4 firmware (high 7.5)
- [CVE-2020-23161](https://insights.sbomify.com/CVE-2020-23161/): Path traversal in pyres:termod4 firmware (medium 6.5)
- [CVE-2020-23160](https://insights.sbomify.com/CVE-2020-23160/): Command injection in pyres:termod4 firmware (high 8.8)
- [CVE-2020-2316](https://insights.sbomify.com/CVE-2020-2316/): Stored XSS vulnerability in Jenkins Static Analysis Utilities Plugin (medium 5.4)
- [CVE-2020-23151](https://insights.sbomify.com/CVE-2020-23151/): Command injection in rconfig:rconfig (critical 9.8)
- [CVE-2020-23150](https://insights.sbomify.com/CVE-2020-23150/): SQL injection in rconfig:rconfig (high 7.5)
- [CVE-2020-2315](https://insights.sbomify.com/CVE-2020-2315/): XXE vulnerability in Jenkins Visualworks Store Plugin (medium 6.5)
- [CVE-2020-23149](https://insights.sbomify.com/CVE-2020-23149/): SQL injection in rconfig:rconfig (high 7.5)
- [CVE-2020-23148](https://insights.sbomify.com/CVE-2020-23148/): Other in rconfig:rconfig (high 7.5)
- [CVE-2020-23140](https://insights.sbomify.com/CVE-2020-23140/): Auth bypass in microweber:microweber (high 8.1)
- [CVE-2020-2314](https://insights.sbomify.com/CVE-2020-2314/): Password stored in plain text by Jenkins AppSpider Plugin (medium 5.5)
- [CVE-2020-23139](https://insights.sbomify.com/CVE-2020-23139/): Auth bypass in microweber:microweber (medium 5.5)
- [CVE-2020-23138](https://insights.sbomify.com/CVE-2020-23138/): File upload in microweber:microweber (critical 9.8)
- [CVE-2020-23136](https://insights.sbomify.com/CVE-2020-23136/): Microweber Insufficient Session Expiry (medium 5.5)
- [CVE-2020-2313](https://insights.sbomify.com/CVE-2020-2313/): Missing permission checks in Jenkins Azure Key Vault Plugin allow enumerating credentials IDs (medium 4.3)
- [CVE-2020-23128](https://insights.sbomify.com/CVE-2020-23128/): Privilege escalation in chamilo:chamilo lms (medium 4.9)
- [CVE-2020-23127](https://insights.sbomify.com/CVE-2020-23127/): Cross-site request forgery in chamilo:chamilo lms (high 8.8)
- [CVE-2020-23126](https://insights.sbomify.com/CVE-2020-23126/): Cross-site scripting in chamilo:chamilo lms (medium 6.1)
- [CVE-2020-2312](https://insights.sbomify.com/CVE-2020-2312/): Password written to the build log by Jenkins SQLPlus Script Runner Plugin (medium 6.5)
- [CVE-2020-2311](https://insights.sbomify.com/CVE-2020-2311/): Missing permission check in Jenkins AWS Global Configuration Plugin allows replacing plugin configuration (medium 4.3)
- [CVE-2020-23109](https://insights.sbomify.com/CVE-2020-23109/): Memory corruption in struktur:libheif (high 8.1)
- [CVE-2020-2310](https://insights.sbomify.com/CVE-2020-2310/): Missing permission checks in Jenkins Ansible Plugin allow enumerating credentials IDs (medium 4.3)
- [CVE-2020-2309](https://insights.sbomify.com/CVE-2020-2309/): Missing authorization in Jenkins Kubernetes Plugin (medium 4.3)
- [CVE-2020-23083](https://insights.sbomify.com/CVE-2020-23083/): File upload in guojusoft:jeecg (critical 9.8)
- [CVE-2020-2308](https://insights.sbomify.com/CVE-2020-2308/): Missing Authorization in Jenkins Kubernetes Plugin (medium 4.3)
- [CVE-2020-23079](https://insights.sbomify.com/CVE-2020-23079/): Server-side request forgery in halo:halo (high 7.5)
- [CVE-2020-2307](https://insights.sbomify.com/CVE-2020-2307/): Exposure of Sensitive Information to an Unauthorized Actor in Jenkins Kubernetes Plugin (medium 4.3)
- [CVE-2020-23069](https://insights.sbomify.com/CVE-2020-23069/): Path traversal in webtareas project:webtareas (medium 6.5)
- [CVE-2020-23065](https://insights.sbomify.com/CVE-2020-23065/): Cross-site scripting in ibexa:ezpublish legacy (medium 5.4)
- [CVE-2020-23061](https://insights.sbomify.com/CVE-2020-23061/): Path traversal in dropouts:super backup (high 7.5)
- [CVE-2020-23060](https://insights.sbomify.com/CVE-2020-23060/): Memory corruption in tonec:internet download manager (high 7.1)
- [CVE-2020-2306](https://insights.sbomify.com/CVE-2020-2306/): Missing Authorization in Jenkins Mercurial Plugin (medium 4.3)
- [CVE-2020-23058](https://insights.sbomify.com/CVE-2020-23058/): Auth bypass in file explorer project:file explorer (medium 4.6)
- [CVE-2020-23055](https://insights.sbomify.com/CVE-2020-23055/): Cross-site scripting in lancom-systems:lcos (medium 5.4)
- [CVE-2020-23054](https://insights.sbomify.com/CVE-2020-23054/): Cross-site scripting in user-agent switcher and manager project:user-agent switcher and manager (medium 6.1)
- [CVE-2020-23052](https://insights.sbomify.com/CVE-2020-23052/): Cross-site scripting in catalyst:mahara (medium 5.4)
- [CVE-2020-23051](https://insights.sbomify.com/CVE-2020-23051/): Cross-site scripting in user registration \& login and user management system with admin panel project:user registration \& login and user management system with admin panel (medium 6.1)
- [CVE-2020-23050](https://insights.sbomify.com/CVE-2020-23050/): Cross-site scripting in taotesting:tao assessment platform (high 8.0)
- [CVE-2020-2305](https://insights.sbomify.com/CVE-2020-2305/): XXE vulnerability in Jenkins Mercurial Plugin (medium 6.5)
- [CVE-2020-23049](https://insights.sbomify.com/CVE-2020-23049/): Cross-site scripting in forkcms (medium 5.4)
- [CVE-2020-23048](https://insights.sbomify.com/CVE-2020-23048/): Cross-site scripting in seeddms:seeddms (medium 6.1)
- [CVE-2020-23047](https://insights.sbomify.com/CVE-2020-23047/): Cross-site scripting in macs cms project:macs cms (medium 6.1)
- [CVE-2020-23046](https://insights.sbomify.com/CVE-2020-23046/): Cross-site scripting in dedecms:dedecms (medium 6.1)
- [CVE-2020-23045](https://insights.sbomify.com/CVE-2020-23045/): SQL injection in macs cms project:macs cms (high 7.2)
- [CVE-2020-23044](https://insights.sbomify.com/CVE-2020-23044/): Cross-site scripting in dedecms:dedecms (medium 5.4)
- [CVE-2020-23043](https://insights.sbomify.com/CVE-2020-23043/): File upload in air sender project:air sender (high 8.8)
- [CVE-2020-23042](https://insights.sbomify.com/CVE-2020-23042/): Cross-site scripting in dropouts:super backup (medium 6.1)
- [CVE-2020-23041](https://insights.sbomify.com/CVE-2020-23041/): Cross-site scripting in dropouts:air share (medium 6.1)
- [CVE-2020-23040](https://insights.sbomify.com/CVE-2020-23040/): Path traversal in sky file project:sky file (high 7.5)
- [CVE-2020-2304](https://insights.sbomify.com/CVE-2020-2304/): XXE vulnerability in Jenkins Subversion Plugin (medium 6.5)
- [CVE-2020-23039](https://insights.sbomify.com/CVE-2020-23039/): Cross-site scripting in newsoftwares:folder lock (medium 5.4)
- [CVE-2020-23038](https://insights.sbomify.com/CVE-2020-23038/): Information disclosure in kumilabs:swift file transfer (high 7.5)
- [CVE-2020-23037](https://insights.sbomify.com/CVE-2020-23037/): Code injection in portable:playable (critical 9.8)
- [CVE-2020-23036](https://insights.sbomify.com/CVE-2020-23036/): Weak cryptography in medianavi:smacom (medium 5.9)
- [CVE-2020-2303](https://insights.sbomify.com/CVE-2020-2303/): CSRF vulnerability in Jenkins Active Directory Plugin (medium 4.3)
- [CVE-2020-23026](https://insights.sbomify.com/CVE-2020-23026/): Null dereference in dhrystone project:dhrystone (high 7.5)
- [CVE-2020-2302](https://insights.sbomify.com/CVE-2020-2302/): Missing permission check in Jenkins Active Directory Plugin allows accessing domain health check page (medium 4.3)
- [CVE-2020-23015](https://insights.sbomify.com/CVE-2020-23015/): Open redirect in opnsense:opnsense (medium 6.1)
- [CVE-2020-23014](https://insights.sbomify.com/CVE-2020-23014/): Cross-site scripting in apfell project:apfell (medium 5.4)
- [CVE-2020-2301](https://insights.sbomify.com/CVE-2020-2301/): Authentication cache in Active Directory Jenkins Plugin allows logging in with any password (critical 9.8)
- [CVE-2020-2300](https://insights.sbomify.com/CVE-2020-2300/): Improper Authentication (empty password) in Jenkins Active Directory Plugin (critical 9.8)
- [CVE-2020-2299](https://insights.sbomify.com/CVE-2020-2299/): Improper Authentication in Jenkins Active Directory Plugin (critical 9.8)
- [CVE-2020-22987](https://insights.sbomify.com/CVE-2020-22987/): Cross-site scripting in microstrategy:microstrategy web sdk (medium 6.1)
- [CVE-2020-22986](https://insights.sbomify.com/CVE-2020-22986/): Cross-site scripting in microstrategy:microstrategy web sdk (medium 6.1)
- [CVE-2020-22985](https://insights.sbomify.com/CVE-2020-22985/): Cross-site scripting in microstrategy:microstrategy web sdk (medium 6.1)
- [CVE-2020-22984](https://insights.sbomify.com/CVE-2020-22984/): Cross-site scripting in microstrategy:microstrategy web sdk (medium 6.1)
- [CVE-2020-22983](https://insights.sbomify.com/CVE-2020-22983/): Server-side request forgery in microstrategy:microstrategy web (high 8.1)
- [CVE-2020-2298](https://insights.sbomify.com/CVE-2020-2298/): XXE vulnerability in Jenkins Nerrvana Plugin (medium 6.5)
- [CVE-2020-2297](https://insights.sbomify.com/CVE-2020-2297/): Access token stored in plain text by Jenkins SMS Notification Plugin (low 3.3)
- [CVE-2020-2296](https://insights.sbomify.com/CVE-2020-2296/): CSRF vulnerability in Jenkins Shared Objects Plugin (medium 4.3)
- [CVE-2020-2295](https://insights.sbomify.com/CVE-2020-2295/): CSRF vulnerability in Jenkins Maven Cascade Release Plugin (medium 6.5)
- [CVE-2020-2294](https://insights.sbomify.com/CVE-2020-2294/): Missing permission checks in Jenkins Maven Cascade Release Plugin (medium 6.5)
- [CVE-2020-22937](https://insights.sbomify.com/CVE-2020-22937/): Code injection in phome:empirecms (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/127/