# Vulnerabilities published in 2020


- [CVE-2020-2293](https://insights.sbomify.com/CVE-2020-2293/): Arbitrary file read vulnerability in Jenkins Persona Plugin (medium 6.5)
- [CVE-2020-2292](https://insights.sbomify.com/CVE-2020-2292/): Stored XSS vulnerability in Jenkins Release Plugin (medium 5.4)
- [CVE-2020-22916](https://insights.sbomify.com/CVE-2020-22916/): Denial of service in tukaani:xz (medium 5.5)
- [CVE-2020-2291](https://insights.sbomify.com/CVE-2020-2291/): Password stored in plain text by Jenkins couchdb-statistics Plugin (low 3.3)
- [CVE-2020-22907](https://insights.sbomify.com/CVE-2020-22907/): Memory corruption in jsish:jsish (high 7.5)
- [CVE-2020-2290](https://insights.sbomify.com/CVE-2020-2290/): Stored XSS vulnerability in Jenkins Active Choices Plugin (medium 5.4)
- [CVE-2020-2289](https://insights.sbomify.com/CVE-2020-2289/): Stored XSS vulnerability in Jenkins Active Choices Plugin (medium 5.4)
- [CVE-2020-22886](https://insights.sbomify.com/CVE-2020-22886/): Memory corruption in artifex:mujs (high 7.5)
- [CVE-2020-22885](https://insights.sbomify.com/CVE-2020-22885/): Memory corruption in artifex:mujs (high 7.5)
- [CVE-2020-22884](https://insights.sbomify.com/CVE-2020-22884/): Memory corruption in espruino:espruino (critical 9.8)
- [CVE-2020-22882](https://insights.sbomify.com/CVE-2020-22882/): Denial of service in moddable:moddable (high 7.5)
- [CVE-2020-2288](https://insights.sbomify.com/CVE-2020-2288/): Incorrect default pattern in Jenkins Audit Trail Plugin (medium 5.3)
- [CVE-2020-22876](https://insights.sbomify.com/CVE-2020-22876/): Memory corruption in quickjs project:quickjs (high 7.5)
- [CVE-2020-22875](https://insights.sbomify.com/CVE-2020-22875/): Integer overflow in jsish:jsish (critical 9.8)
- [CVE-2020-22874](https://insights.sbomify.com/CVE-2020-22874/): Integer overflow in jsish:jsish (critical 9.8)
- [CVE-2020-22873](https://insights.sbomify.com/CVE-2020-22873/): Memory corruption in jsish:jsish (critical 9.8)
- [CVE-2020-2287](https://insights.sbomify.com/CVE-2020-2287/): Request logging bypass in Jenkins Audit Trail Plugin (medium 5.3)
- [CVE-2020-22864](https://insights.sbomify.com/CVE-2020-22864/): Cross site scripting in froala-editor (medium 6.1)
- [CVE-2020-2286](https://insights.sbomify.com/CVE-2020-2286/): Improper authorization due to caching in Jenkins Role-based Authorization Strategy Plugin (high 8.8)
- [CVE-2020-2285](https://insights.sbomify.com/CVE-2020-2285/): Missing permission check in Jenkins Liquibase Runner Plugin allows enumerating credentials IDs (medium 4.3)
- [CVE-2020-22848](https://insights.sbomify.com/CVE-2020-22848/): Code injection in chshcms:cscms (critical 9.8)
- [CVE-2020-22845](https://insights.sbomify.com/CVE-2020-22845/): Memory corruption in mikrotik:routeros (high 7.5)
- [CVE-2020-22844](https://insights.sbomify.com/CVE-2020-22844/): Memory corruption in mikrotik:routeros (high 7.5)
- [CVE-2020-22842](https://insights.sbomify.com/CVE-2020-22842/): Cross-site scripting in cmsmadesimple:cms made simple (medium 5.4)
- [CVE-2020-22841](https://insights.sbomify.com/CVE-2020-22841/): Cross-site scripting in b2evolution:b2evolution (medium 4.8)
- [CVE-2020-22840](https://insights.sbomify.com/CVE-2020-22840/): Open redirect in b2evolution:b2evolution (medium 6.1)
- [CVE-2020-2284](https://insights.sbomify.com/CVE-2020-2284/): XXE vulnerability in Jenkins Liquibase Runner Plugin (high 7.1)
- [CVE-2020-22839](https://insights.sbomify.com/CVE-2020-22839/): Cross-site scripting in b2evolution:b2evolution cms (medium 6.1)
- [CVE-2020-2283](https://insights.sbomify.com/CVE-2020-2283/): Stored XSS vulnerability in Jenkins Liquibase Runner Plugin (medium 5.4)
- [CVE-2020-22820](https://insights.sbomify.com/CVE-2020-22820/): SQL injection in mkcms project:mkcms (critical 9.8)
- [CVE-2020-2282](https://insights.sbomify.com/CVE-2020-2282/): Missing permission check in Jenkins Implied Labels Plugin allows reconfiguring the plugin (medium 4.3)
- [CVE-2020-22819](https://insights.sbomify.com/CVE-2020-22819/): SQL injection in mkcms project:mkcms (critical 9.8)
- [CVE-2020-22818](https://insights.sbomify.com/CVE-2020-22818/): SQL injection in mkcms project:mkcms (critical 9.8)
- [CVE-2020-2281](https://insights.sbomify.com/CVE-2020-2281/): CSRF vulnerability in Jenkins Lockable Resources Plugin (medium 5.4)
- [CVE-2020-22809](https://insights.sbomify.com/CVE-2020-22809/): Privilege escalation in windscribe:windscribe (high 7.8)
- [CVE-2020-22808](https://insights.sbomify.com/CVE-2020-22808/): Cross-site scripting in fecmall project:fecmall (medium 6.1)
- [CVE-2020-22807](https://insights.sbomify.com/CVE-2020-22807/): SQL injection in vtiger:vtiger crm (critical 9.8)
- [CVE-2020-2280](https://insights.sbomify.com/CVE-2020-2280/): CSRF vulnerability in Jenkins warnings Plugin allows remote code execution (high 8.8)
- [CVE-2020-22790](https://insights.sbomify.com/CVE-2020-22790/): Cross-site scripting in safe:fme server (medium 5.4)
- [CVE-2020-2279](https://insights.sbomify.com/CVE-2020-2279/): Sandbox bypass vulnerability in Jenkins Script Security Plugin (critical 9.9)
- [CVE-2020-22789](https://insights.sbomify.com/CVE-2020-22789/): Cross-site scripting in safe:fme server (medium 6.1)
- [CVE-2020-22785](https://insights.sbomify.com/CVE-2020-22785/): Denial of service in etherpad:etherpad (high 7.5)
- [CVE-2020-22784](https://insights.sbomify.com/CVE-2020-22784/): Security feature bypass in etherpad:ueberdb (high 7.5)
- [CVE-2020-22783](https://insights.sbomify.com/CVE-2020-22783/): Information disclosure in etherpad:etherpad (medium 6.5)
- [CVE-2020-22782](https://insights.sbomify.com/CVE-2020-22782/): Denial of service in etherpad:etherpad (high 7.5)
- [CVE-2020-22781](https://insights.sbomify.com/CVE-2020-22781/): Denial of service in etherpad:etherpad (high 7.5)
- [CVE-2020-2278](https://insights.sbomify.com/CVE-2020-2278/): Arbitrary file write vulnerability in Jenkins Storable Configs Plugin (medium 6.5)
- [CVE-2020-2277](https://insights.sbomify.com/CVE-2020-2277/): Arbitrary file read vulnerability in Jenkins Storable Configs Plugin (medium 6.5)
- [CVE-2020-22765](https://insights.sbomify.com/CVE-2020-22765/): NukeViet Cross-site Scripting via the editor in the News module (medium 6.1)
- [CVE-2020-22761](https://insights.sbomify.com/CVE-2020-22761/): Cross-site request forgery in flatpress:flatpress (high 8.8)
- [CVE-2020-2276](https://insights.sbomify.com/CVE-2020-2276/): System command execution vulnerability in Selection tasks Jenkins Plugin (high 8.8)
- [CVE-2020-22755](https://insights.sbomify.com/CVE-2020-22755/): MCMS vulnerable to arbitrary code execution via crafted thumbnail (high 8.8)
- [CVE-2020-2275](https://insights.sbomify.com/CVE-2020-2275/): Arbitrary file read vulnerability in Copy data to workspace Jenkins Plugin (medium 6.5)
- [CVE-2020-22741](https://insights.sbomify.com/CVE-2020-22741/): Weak cryptography in baidu:xuperchain (high 7.5)
- [CVE-2020-2274](https://insights.sbomify.com/CVE-2020-2274/): Passwords stored in plain text by ElasTest Plugin (medium 5.5)
- [CVE-2020-22732](https://insights.sbomify.com/CVE-2020-22732/): Cross-site scripting in cmsmadesimple:cms made simple (medium 4.8)
- [CVE-2020-2273](https://insights.sbomify.com/CVE-2020-2273/): CSRF vulnerability in Jenkins ElasTest Plugin (medium 4.3)
- [CVE-2020-22724](https://insights.sbomify.com/CVE-2020-22724/): Command injection in mercury:mer1200 firmware (critical 9.8)
- [CVE-2020-22723](https://insights.sbomify.com/CVE-2020-22723/): Cross-site scripting in ljcmsshop project:ljcmsshop (medium 6.1)
- [CVE-2020-22722](https://insights.sbomify.com/CVE-2020-22722/): Privilege escalation in rapidscada:rapid scada (high 7.8)
- [CVE-2020-22721](https://insights.sbomify.com/CVE-2020-22721/): File upload in pnotes.net project:pnotes.net (high 7.8)
- [CVE-2020-2272](https://insights.sbomify.com/CVE-2020-2272/): Missing permission checks in Jenkins ElasTest Plugin (medium 4.3)
- [CVE-2020-22719](https://insights.sbomify.com/CVE-2020-22719/): Cross-site scripting in shimo:document (medium 5.4)
- [CVE-2020-2271](https://insights.sbomify.com/CVE-2020-2271/): Stored XSS vulnerability in Locked Files Report Plugin (medium 5.4)
- [CVE-2020-2270](https://insights.sbomify.com/CVE-2020-2270/): Stored XSS vulnerability in ClearCase Release Plugin (medium 5.4)
- [CVE-2020-2269](https://insights.sbomify.com/CVE-2020-2269/): Stored XSS vulnerability in chosen-views-tabbar Plugin (medium 5.4)
- [CVE-2020-2268](https://insights.sbomify.com/CVE-2020-2268/): CSRF vulnerability in MongoDB Plugin (high 8.8)
- [CVE-2020-22679](https://insights.sbomify.com/CVE-2020-22679/): Denial of service in gpac:gpac (medium 5.5)
- [CVE-2020-22678](https://insights.sbomify.com/CVE-2020-22678/): Memory corruption in gpac:gpac (medium 5.5)
- [CVE-2020-22677](https://insights.sbomify.com/CVE-2020-22677/): Memory corruption in gpac:gpac (medium 5.5)
- [CVE-2020-22675](https://insights.sbomify.com/CVE-2020-22675/): Memory corruption in gpac:gpac (medium 5.5)
- [CVE-2020-22674](https://insights.sbomify.com/CVE-2020-22674/): Null dereference in gpac:gpac (medium 5.5)
- [CVE-2020-22673](https://insights.sbomify.com/CVE-2020-22673/): Denial of service in gpac:gpac (medium 5.5)
- [CVE-2020-2267](https://insights.sbomify.com/CVE-2020-2267/): Missing permission checks in MongoDB Plugin (medium 4.3)
- [CVE-2020-22669](https://insights.sbomify.com/CVE-2020-22669/): Security feature bypass in debian:debian linux (critical 9.8)
- [CVE-2020-22662](https://insights.sbomify.com/CVE-2020-22662/): Command injection in ruckuswireless:r310 firmware (high 7.5)
- [CVE-2020-22661](https://insights.sbomify.com/CVE-2020-22661/): Missing authorization in ruckuswireless:r310 firmware (medium 6.5)
- [CVE-2020-22660](https://insights.sbomify.com/CVE-2020-22660/): Security feature bypass in ruckuswireless:r310 firmware (high 7.5)
- [CVE-2020-2266](https://insights.sbomify.com/CVE-2020-2266/): Stored XSS vulnerability in Description Column Plugin (medium 5.4)
- [CVE-2020-22659](https://insights.sbomify.com/CVE-2020-22659/): Security feature bypass in ruckuswireless:r310 firmware (high 7.5)
- [CVE-2020-22658](https://insights.sbomify.com/CVE-2020-22658/): Security feature bypass in ruckuswireless:r310 firmware (critical 9.8)
- [CVE-2020-22657](https://insights.sbomify.com/CVE-2020-22657/): Auth bypass in ruckuswireless:r310 firmware (critical 9.1)
- [CVE-2020-22656](https://insights.sbomify.com/CVE-2020-22656/): Security feature bypass in ruckuswireless:r310 firmware (high 7.5)
- [CVE-2020-22655](https://insights.sbomify.com/CVE-2020-22655/): Missing authorization in ruckuswireless:r310 firmware (high 7.5)
- [CVE-2020-22654](https://insights.sbomify.com/CVE-2020-22654/): Security feature bypass in ruckuswireless:r310 firmware (critical 9.8)
- [CVE-2020-22653](https://insights.sbomify.com/CVE-2020-22653/): Security feature bypass in ruckuswireless:r310 firmware (critical 9.8)
- [CVE-2020-22650](https://insights.sbomify.com/CVE-2020-22650/): Denial of service in att:alienvault ossim (high 7.5)
- [CVE-2020-2265](https://insights.sbomify.com/CVE-2020-2265/): Stored XSS vulnerability in Coverage/Complexity Scatter Plot Plugin (medium 5.4)
- [CVE-2020-22647](https://insights.sbomify.com/CVE-2020-22647/): Information disclosure in smartconrtactgames project:smartconrtactgames (critical 9.1)
- [CVE-2020-22643](https://insights.sbomify.com/CVE-2020-22643/): Feehi CMS arbitrary file upload vulnerability (high 7.2)
- [CVE-2020-2264](https://insights.sbomify.com/CVE-2020-2264/): Stored XSS vulnerability in Custom Job Icon Plugin (medium 5.4)
- [CVE-2020-2263](https://insights.sbomify.com/CVE-2020-2263/): Stored XSS vulnerability in Radiator View Plugin (medium 5.4)
- [CVE-2020-22628](https://insights.sbomify.com/CVE-2020-22628/): Memory corruption in libraw:libraw (medium 6.5)
- [CVE-2020-22623](https://insights.sbomify.com/CVE-2020-22623/): Path traversal in insightsoftware:jreport (high 7.5)
- [CVE-2020-2262](https://insights.sbomify.com/CVE-2020-2262/): Stored XSS vulnerability in android-lint Plugin (medium 5.4)
- [CVE-2020-22617](https://insights.sbomify.com/CVE-2020-22617/): Use after free in ardour:ardour (critical 9.8)
- [CVE-2020-22612](https://insights.sbomify.com/CVE-2020-22612/): Code injection in mybb:mybb (critical 9.8)
- [CVE-2020-2261](https://insights.sbomify.com/CVE-2020-2261/): OS command execution vulnerability in Perfecto Plugin (high 8.8)
- [CVE-2020-22609](https://insights.sbomify.com/CVE-2020-22609/): Cross-site scripting in enhancesoft:osticket (medium 6.1)
- [CVE-2020-22608](https://insights.sbomify.com/CVE-2020-22608/): Cross-site scripting in enhancesoft:osticket (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/128/