# Vulnerabilities published in 2020 - [CVE-2020-21991](https://insights.sbomify.com/CVE-2020-21991/): Auth bypass in ave:53ab-wbs firmware (critical 9.8) - [CVE-2020-21990](https://insights.sbomify.com/CVE-2020-21990/): Missing authorization in domoticz:mydomoathome (high 7.5) - [CVE-2020-2199](https://insights.sbomify.com/CVE-2020-2199/): XSS vulnerability in Jenkins Subversion Partial Release Manager Plugin (medium 6.1) - [CVE-2020-21989](https://insights.sbomify.com/CVE-2020-21989/): Cross-site request forgery in homeautomation project:homeautomation (high 8.8) - [CVE-2020-21987](https://insights.sbomify.com/CVE-2020-21987/): Cross-site scripting in homeautomation project:homeautomation (medium 6.1) - [CVE-2020-2198](https://insights.sbomify.com/CVE-2020-2198/): Missing permission check in Jenkins Project Inheritance Plugin (medium 6.5) - [CVE-2020-21976](https://insights.sbomify.com/CVE-2020-21976/): File upload in newsone cms project:newsone cms (high 8.8) - [CVE-2020-2197](https://insights.sbomify.com/CVE-2020-2197/): Missing permission check in Jenkins Project Inheritance Plugin (medium 4.3) - [CVE-2020-21967](https://insights.sbomify.com/CVE-2020-21967/): File upload in prestashop:prestashop (medium 4.8) - [CVE-2020-2196](https://insights.sbomify.com/CVE-2020-2196/): Complete lack of CSRF protection in Jenkins Selenium Plugin can lead to OS command injection (high 8.0) - [CVE-2020-2195](https://insights.sbomify.com/CVE-2020-2195/): Stored XSS vulnerability in Jenkins Compact Columns Plugin (medium 5.4) - [CVE-2020-2194](https://insights.sbomify.com/CVE-2020-2194/): Stored XSS vulnerability in Jenkins ECharts API Plugin (medium 5.4) - [CVE-2020-21937](https://insights.sbomify.com/CVE-2020-21937/): Command injection in motorola:cx2 firmware (critical 9.8) - [CVE-2020-21936](https://insights.sbomify.com/CVE-2020-21936/): Missing authorization in motorola:cx2 firmware (medium 5.3) - [CVE-2020-21935](https://insights.sbomify.com/CVE-2020-21935/): Command injection in motorola:cx2 firmware (critical 9.8) - [CVE-2020-21934](https://insights.sbomify.com/CVE-2020-21934/): Auth bypass in motorola:cx2 firmware (high 7.5) - [CVE-2020-21933](https://insights.sbomify.com/CVE-2020-21933/): Information disclosure in motorola:cx2 firmware (high 7.5) - [CVE-2020-21932](https://insights.sbomify.com/CVE-2020-21932/): Auth bypass in motorola:cx2 firmware (medium 5.3) - [CVE-2020-21930](https://insights.sbomify.com/CVE-2020-21930/): Cross-site scripting in eyoucms:eyoucms (medium 5.4) - [CVE-2020-2193](https://insights.sbomify.com/CVE-2020-2193/): Stored XSS vulnerability in Jenkins ECharts API Plugin (medium 5.4) - [CVE-2020-21929](https://insights.sbomify.com/CVE-2020-21929/): Cross-site scripting in eyoucms:eyoucms (medium 5.4) - [CVE-2020-2192](https://insights.sbomify.com/CVE-2020-2192/): CSRF vulnerability in Jenkins Swarm Plugin (medium 6.5) - [CVE-2020-21913](https://insights.sbomify.com/CVE-2020-21913/): Use after free in debian:debian linux (medium 5.5) - [CVE-2020-2191](https://insights.sbomify.com/CVE-2020-2191/): Improper permission checks in Jenkins Swarm Plugin (medium 4.3) - [CVE-2020-2190](https://insights.sbomify.com/CVE-2020-2190/): Improper Neutralization of Input During Web Page Generation in Jenkins Script Security Plugin (medium 5.4) - [CVE-2020-21896](https://insights.sbomify.com/CVE-2020-21896/): Use after free in artifex:mupdf (medium 5.5) - [CVE-2020-21890](https://insights.sbomify.com/CVE-2020-21890/): Memory corruption in artifex:ghostscript (high 7.8) - [CVE-2020-2189](https://insights.sbomify.com/CVE-2020-2189/): RCE vulnerability in SCM Filter Jervis Plugin (high 8.8) - [CVE-2020-21884](https://insights.sbomify.com/CVE-2020-21884/): Cross-site request forgery in indionetworks:unibox u1000 firmware (high 8.8) - [CVE-2020-21883](https://insights.sbomify.com/CVE-2020-21883/): Command injection in indionetworks:unibox u1000 firmware (high 8.8) - [CVE-2020-21881](https://insights.sbomify.com/CVE-2020-21881/): Cross-site request forgery in duxcms project:duxcms (medium 6.5) - [CVE-2020-2188](https://insights.sbomify.com/CVE-2020-2188/): Users with Overall/Read access can enumerate credentials IDs in Amazon EC2 Plugin (medium 4.3) - [CVE-2020-2187](https://insights.sbomify.com/CVE-2020-2187/): Lack of SSL/TLS certificate and hostname validation in Amazon EC2 Plugin (medium 5.6) - [CVE-2020-21865](https://insights.sbomify.com/CVE-2020-21865/): Code injection in thinkphp50-cms project:thinkphp50-cms (critical 9.8) - [CVE-2020-21862](https://insights.sbomify.com/CVE-2020-21862/): Path traversal in duxcms project:duxcms (high 8.1) - [CVE-2020-21861](https://insights.sbomify.com/CVE-2020-21861/): File upload in duxcms project:duxcms (high 8.8) - [CVE-2020-2186](https://insights.sbomify.com/CVE-2020-2186/): CSRF vulnerability in Amazon EC2 Plugin (medium 4.3) - [CVE-2020-21854](https://insights.sbomify.com/CVE-2020-21854/): Cross-site scripting in tidesec:wdscanner (medium 6.1) - [CVE-2020-2185](https://insights.sbomify.com/CVE-2020-2185/): Missing SSH host key validation in Jenkins Amazon EC2 Plugin (medium 5.6) - [CVE-2020-21845](https://insights.sbomify.com/CVE-2020-21845/): Cross-site scripting in codoforum:codoforum (medium 6.1) - [CVE-2020-21844](https://insights.sbomify.com/CVE-2020-21844/): Memory corruption in gnu:libredwg (high 8.8) - [CVE-2020-21843](https://insights.sbomify.com/CVE-2020-21843/): Memory corruption in gnu:libredwg (high 8.8) - [CVE-2020-21842](https://insights.sbomify.com/CVE-2020-21842/): Memory corruption in gnu:libredwg (high 8.8) - [CVE-2020-21841](https://insights.sbomify.com/CVE-2020-21841/): Memory corruption in gnu:libredwg (high 8.8) - [CVE-2020-21840](https://insights.sbomify.com/CVE-2020-21840/): Memory corruption in gnu:libredwg (high 8.8) - [CVE-2020-2184](https://insights.sbomify.com/CVE-2020-2184/): CSRF vulnerability in Jenkins CVS Plugin (medium 4.3) - [CVE-2020-21839](https://insights.sbomify.com/CVE-2020-21839/): Denial of service in gnu:libredwg (medium 6.5) - [CVE-2020-21838](https://insights.sbomify.com/CVE-2020-21838/): Memory corruption in gnu:libredwg (high 8.8) - [CVE-2020-21836](https://insights.sbomify.com/CVE-2020-21836/): Memory corruption in gnu:libredwg (high 8.8) - [CVE-2020-21835](https://insights.sbomify.com/CVE-2020-21835/): Null dereference in gnu:libredwg (medium 6.5) - [CVE-2020-21834](https://insights.sbomify.com/CVE-2020-21834/): Null dereference in gnu:libredwg (medium 6.5) - [CVE-2020-21833](https://insights.sbomify.com/CVE-2020-21833/): Memory corruption in gnu:libredwg (high 8.8) - [CVE-2020-21832](https://insights.sbomify.com/CVE-2020-21832/): Memory corruption in gnu:libredwg (high 8.8) - [CVE-2020-21831](https://insights.sbomify.com/CVE-2020-21831/): Memory corruption in gnu:libredwg (high 8.8) - [CVE-2020-21830](https://insights.sbomify.com/CVE-2020-21830/): Memory corruption in gnu:libredwg (high 8.8) - [CVE-2020-2183](https://insights.sbomify.com/CVE-2020-2183/): Improper permission checks in Jenkins Copy Artifact Plugin (medium 6.5) - [CVE-2020-21827](https://insights.sbomify.com/CVE-2020-21827/): Memory corruption in gnu:libredwg (high 7.8) - [CVE-2020-2182](https://insights.sbomify.com/CVE-2020-2182/): Improper masking of some secrets in Jenkins Credentials Binding Plugin (medium 4.3) - [CVE-2020-21819](https://insights.sbomify.com/CVE-2020-21819/): Memory corruption in gnu:libredwg (high 8.8) - [CVE-2020-21818](https://insights.sbomify.com/CVE-2020-21818/): Memory corruption in gnu:libredwg (high 8.8) - [CVE-2020-21817](https://insights.sbomify.com/CVE-2020-21817/): Null dereference in gnu:libredwg (medium 6.5) - [CVE-2020-21816](https://insights.sbomify.com/CVE-2020-21816/): Memory corruption in gnu:libredwg (high 8.8) - [CVE-2020-21815](https://insights.sbomify.com/CVE-2020-21815/): Null dereference in gnu:libredwg (medium 6.5) - [CVE-2020-21814](https://insights.sbomify.com/CVE-2020-21814/): Memory corruption in gnu:libredwg (high 8.8) - [CVE-2020-21813](https://insights.sbomify.com/CVE-2020-21813/): Memory corruption in gnu:libredwg (high 7.8) - [CVE-2020-2181](https://insights.sbomify.com/CVE-2020-2181/): Secrets are not masked by Jenkins Credentials Binding Plugin in builds without build steps (medium 6.5) - [CVE-2020-21809](https://insights.sbomify.com/CVE-2020-21809/): NukeViet SQL Injection vulnerability (critical 9.8) - [CVE-2020-21808](https://insights.sbomify.com/CVE-2020-21808/): NukeViet SQL Injection vulnerability via topicsid parameter (critical 9.8) - [CVE-2020-21806](https://insights.sbomify.com/CVE-2020-21806/): SQL injection in ectouch:ectouch (critical 9.8) - [CVE-2020-2180](https://insights.sbomify.com/CVE-2020-2180/): RCE vulnerability in Jenkins AWS SAM Plugin (high 8.8) - [CVE-2020-2179](https://insights.sbomify.com/CVE-2020-2179/): RCE vulnerability in Jenkins Yaml Axis Plugin (high 8.8) - [CVE-2020-21788](https://insights.sbomify.com/CVE-2020-21788/): Server-side request forgery in crmeb:crmeb (medium 4.3) - [CVE-2020-21787](https://insights.sbomify.com/CVE-2020-21787/): File upload in crmeb:crmeb (critical 9.8) - [CVE-2020-21786](https://insights.sbomify.com/CVE-2020-21786/): Path traversal in ibos:ibos (critical 9.8) - [CVE-2020-21785](https://insights.sbomify.com/CVE-2020-21785/): Command injection in ibos:ibos (high 8.8) - [CVE-2020-21784](https://insights.sbomify.com/CVE-2020-21784/): Code injection in phpwcms:phpwcms (critical 9.8) - [CVE-2020-21783](https://insights.sbomify.com/CVE-2020-21783/): Cross-site scripting in ibos:ibos (medium 6.1) - [CVE-2020-2178](https://insights.sbomify.com/CVE-2020-2178/): XXE vulnerability in Jenkins Parasoft Findings Plugin (high 7.1) - [CVE-2020-2177](https://insights.sbomify.com/CVE-2020-2177/): Credentials stored in plain text by Jenkins Copr Plugin (medium 4.3) - [CVE-2020-2176](https://insights.sbomify.com/CVE-2020-2176/): XSS vulnerability in Jenkins useMango Runner Plugin (medium 5.4) - [CVE-2020-2175](https://insights.sbomify.com/CVE-2020-2175/): Stored XSS vulnerability in Jenkins FitNesse Plugin (medium 5.4) - [CVE-2020-2174](https://insights.sbomify.com/CVE-2020-2174/): Reflected XSS vulnerability in Jenkins AWSEB Deployment Plugin (medium 6.1) - [CVE-2020-21733](https://insights.sbomify.com/CVE-2020-21733/): Cross-site scripting in sagemcom:f\@st 3686 firmware (medium 6.1) - [CVE-2020-21732](https://insights.sbomify.com/CVE-2020-21732/): Cross-site scripting in rukovoditel:rukovoditel (medium 6.1) - [CVE-2020-21731](https://insights.sbomify.com/CVE-2020-21731/): Cross-site scripting in gazie project:gazie (medium 6.1) - [CVE-2020-2173](https://insights.sbomify.com/CVE-2020-2173/): XSS vulnerability in Jenkins Gatling Plugin (medium 5.4) - [CVE-2020-21729](https://insights.sbomify.com/CVE-2020-21729/): Cross-site scripting in jeecms:jeecms x (medium 5.4) - [CVE-2020-21726](https://insights.sbomify.com/CVE-2020-21726/): SQL injection in opensns:opensns (critical 9.8) - [CVE-2020-21725](https://insights.sbomify.com/CVE-2020-21725/): SQL injection in opensns:opensns (critical 9.8) - [CVE-2020-21724](https://insights.sbomify.com/CVE-2020-21724/): Memory corruption in ogg video tools project:ogg video tools (high 7.8) - [CVE-2020-21723](https://insights.sbomify.com/CVE-2020-21723/): Memory corruption in ogg video tools project:ogg video tools (medium 5.5) - [CVE-2020-21722](https://insights.sbomify.com/CVE-2020-21722/): Memory corruption in ogg video tools project:ogg video tools (high 7.8) - [CVE-2020-2172](https://insights.sbomify.com/CVE-2020-2172/): XXE vulnerability in Jenkins Code Coverage API Plugin (medium 6.5) - [CVE-2020-21710](https://insights.sbomify.com/CVE-2020-21710/): Denial of service in artifex:ghostscript (medium 5.5) - [CVE-2020-2171](https://insights.sbomify.com/CVE-2020-2171/): XXE vulnerability in Jenkins RapidDeploy Plugin (high 8.8) - [CVE-2020-2170](https://insights.sbomify.com/CVE-2020-2170/): Stored XSS vulnerability in Jenkins RapidDeploy Plugin (medium 5.4) - [CVE-2020-21699](https://insights.sbomify.com/CVE-2020-21699/): Integer overflow in alibaba:tengine (high 7.5) - [CVE-2020-21697](https://insights.sbomify.com/CVE-2020-21697/): Use after free in debian:debian linux (medium 6.5) - [CVE-2020-2169](https://insights.sbomify.com/CVE-2020-2169/): Reflected XSS vulnerability in Jenkins Queue cleanup Plugin (medium 6.1) - [CVE-2020-21688](https://insights.sbomify.com/CVE-2020-21688/): Use after free in debian:debian linux (high 8.8) --- From sbomify Insights: https://insights.sbomify.com/years/2020/page/131/