# Vulnerabilities published in 2020


- [CVE-2020-2149](https://insights.sbomify.com/CVE-2020-2149/): Credentials transmitted in plain text by Repository Connector Plugin (medium 5.3)
- [CVE-2020-21489](https://insights.sbomify.com/CVE-2020-21489/): Liufee CMS File Upload vulnerability (critical 9.8)
- [CVE-2020-21487](https://insights.sbomify.com/CVE-2020-21487/): Cross-site scripting in netgate:pfsense (critical 9.6)
- [CVE-2020-21486](https://insights.sbomify.com/CVE-2020-21486/): SQL injection in phpok:phpok (high 7.5)
- [CVE-2020-21485](https://insights.sbomify.com/CVE-2020-21485/): Alluxio Cross Site Scripting vulnerability (medium 6.1)
- [CVE-2020-21483](https://insights.sbomify.com/CVE-2020-21483/): File upload in jizhicms:jizhicms (high 7.2)
- [CVE-2020-21482](https://insights.sbomify.com/CVE-2020-21482/): Cross-site scripting in rgcms project:rgcms (medium 5.4)
- [CVE-2020-21481](https://insights.sbomify.com/CVE-2020-21481/): File upload in rgcms project:rgcms (high 7.2)
- [CVE-2020-21480](https://insights.sbomify.com/CVE-2020-21480/): File upload in rgcms project:rgcms (high 7.2)
- [CVE-2020-2148](https://insights.sbomify.com/CVE-2020-2148/): Missing permission checks in Mac Plugin (medium 4.3)
- [CVE-2020-21474](https://insights.sbomify.com/CVE-2020-21474/): File upload in nucleuscms:nucleuscms (critical 9.8)
- [CVE-2020-2147](https://insights.sbomify.com/CVE-2020-2147/): CSRF vulnerability in Mac Plugin (medium 4.3)
- [CVE-2020-21469](https://insights.sbomify.com/CVE-2020-21469/): Denial of service in postgresql:postgresql (medium 4.4)
- [CVE-2020-21468](https://insights.sbomify.com/CVE-2020-21468/): Denial of service in redislabs:redis (high 7.5)
- [CVE-2020-2146](https://insights.sbomify.com/CVE-2020-2146/): Missing SSH host key validation in Mac Plugin (high 7.4)
- [CVE-2020-21452](https://insights.sbomify.com/CVE-2020-21452/): File upload in uniview:isc2500-s firmware (critical 9.8)
- [CVE-2020-2145](https://insights.sbomify.com/CVE-2020-2145/): Credentials stored in plain text by Zephyr Enterprise Test Management Plugin (medium 5.5)
- [CVE-2020-2144](https://insights.sbomify.com/CVE-2020-2144/): XXE vulnerability in Rundeck Plugin (high 7.1)
- [CVE-2020-21434](https://insights.sbomify.com/CVE-2020-21434/): Cross-site scripting in maccms:maccms (medium 5.4)
- [CVE-2020-21431](https://insights.sbomify.com/CVE-2020-21431/): Path traversal in hongcms project:hongcms (medium 6.5)
- [CVE-2020-2143](https://insights.sbomify.com/CVE-2020-2143/): Credentials transmitted in plain text by Jenkins Logstash Plugin (medium 5.3)
- [CVE-2020-21428](https://insights.sbomify.com/CVE-2020-21428/): Memory corruption in freeimage project:freeimage (low 3.3)
- [CVE-2020-21427](https://insights.sbomify.com/CVE-2020-21427/): Memory corruption in freeimage project:freeimage (high 7.8)
- [CVE-2020-21426](https://insights.sbomify.com/CVE-2020-21426/): Memory corruption in freeimage project:freeimage (high 7.8)
- [CVE-2020-2142](https://insights.sbomify.com/CVE-2020-2142/): Missing permission checks in Jenkins P4 Plugin (medium 4.3)
- [CVE-2020-2141](https://insights.sbomify.com/CVE-2020-2141/): CSRF vulnerability in Jenkins P4 Plugin (medium 4.3)
- [CVE-2020-21406](https://insights.sbomify.com/CVE-2020-21406/): Denial of service in rk max smart tv box project:rk max smart tv box firmware (high 7.5)
- [CVE-2020-21405](https://insights.sbomify.com/CVE-2020-21405/): Other in h96tvbox:h96 pro plus firmware (high 7.5)
- [CVE-2020-21400](https://insights.sbomify.com/CVE-2020-21400/): SQL injection in phpmywind:phpmywind (high 7.2)
- [CVE-2020-2140](https://insights.sbomify.com/CVE-2020-2140/): XSS vulnerability in Jenkins Audit Trail Plugin (medium 6.1)
- [CVE-2020-21394](https://insights.sbomify.com/CVE-2020-21394/): SQL injection in crmeb:crmeb (high 8.8)
- [CVE-2020-2139](https://insights.sbomify.com/CVE-2020-2139/): Arbitrary file write vulnerability in Jenkins Cobertura Plugin (medium 6.5)
- [CVE-2020-21387](https://insights.sbomify.com/CVE-2020-21387/): Cross-site scripting in maccms:maccms (medium 6.1)
- [CVE-2020-21386](https://insights.sbomify.com/CVE-2020-21386/): Cross-site request forgery in maccms:maccms (high 8.8)
- [CVE-2020-2138](https://insights.sbomify.com/CVE-2020-2138/): XXE vulnerability in Jenkins Cobertura Plugin (high 7.1)
- [CVE-2020-21378](https://insights.sbomify.com/CVE-2020-21378/): SQL injection in seacms:seacms (critical 9.8)
- [CVE-2020-21377](https://insights.sbomify.com/CVE-2020-21377/): SQL injection in yunyecms:yunyecms (critical 9.8)
- [CVE-2020-2137](https://insights.sbomify.com/CVE-2020-2137/): Stored XSS vulnerability in Jenkins Timestamper Plugin (medium 4.8)
- [CVE-2020-21366](https://insights.sbomify.com/CVE-2020-21366/): Cross-site request forgery in njtech:greencms (high 8.0)
- [CVE-2020-21365](https://insights.sbomify.com/CVE-2020-21365/): Path traversal in debian:debian linux (high 7.5)
- [CVE-2020-21363](https://insights.sbomify.com/CVE-2020-21363/): Path traversal in maccms:maccms (medium 6.5)
- [CVE-2020-21362](https://insights.sbomify.com/CVE-2020-21362/): Cross-site scripting in maccms:maccms (medium 5.4)
- [CVE-2020-2136](https://insights.sbomify.com/CVE-2020-2136/): Improper Neutralization of Input During Web Page Generation in Jenkins Git Plugin (medium 5.4)
- [CVE-2020-21359](https://insights.sbomify.com/CVE-2020-21359/): File upload in maccms:maccms (critical 9.8)
- [CVE-2020-21358](https://insights.sbomify.com/CVE-2020-21358/): Cross-site request forgery in wagecms project:wage-cms (medium 6.5)
- [CVE-2020-21357](https://insights.sbomify.com/CVE-2020-21357/): Cross-site scripting in popojicms:popojicms (medium 6.1)
- [CVE-2020-21356](https://insights.sbomify.com/CVE-2020-21356/): Information disclosure in popojicms:popojicms (medium 5.3)
- [CVE-2020-21353](https://insights.sbomify.com/CVE-2020-21353/): Cross-site scripting in get-simple:getsimplecms (medium 5.4)
- [CVE-2020-2135](https://insights.sbomify.com/CVE-2020-2135/): Sandbox bypass vulnerability in Script Security Plugin (high 8.8)
- [CVE-2020-21345](https://insights.sbomify.com/CVE-2020-21345/): Cross-site scripting in halo:halo (medium 6.1)
- [CVE-2020-21342](https://insights.sbomify.com/CVE-2020-21342/): Missing authorization in zzcms:zzcms (high 7.5)
- [CVE-2020-2134](https://insights.sbomify.com/CVE-2020-2134/): Sandbox bypass vulnerability in Script Security Plugin (high 8.8)
- [CVE-2020-21333](https://insights.sbomify.com/CVE-2020-21333/): Cross-site scripting in publiccms:publiccms (medium 5.4)
- [CVE-2020-2133](https://insights.sbomify.com/CVE-2020-2133/): Password stored in plain text by Applatix Plugin (medium 6.5)
- [CVE-2020-21325](https://insights.sbomify.com/CVE-2020-21325/): File upload in wuzhicms:wuzhicms (high 8.8)
- [CVE-2020-21322](https://insights.sbomify.com/CVE-2020-21322/): Arbitrary Code Execution in feehi/cms (critical 9.8)
- [CVE-2020-21321](https://insights.sbomify.com/CVE-2020-21321/): Cross-site request forgery in emlog:emlog (medium 4.3)
- [CVE-2020-2132](https://insights.sbomify.com/CVE-2020-2132/): Password stored in plain text by Parasoft Environment Manager Plugin (medium 6.5)
- [CVE-2020-21316](https://insights.sbomify.com/CVE-2020-21316/): Cross-site scripting in zrlog:zrlog (medium 6.1)
- [CVE-2020-2131](https://insights.sbomify.com/CVE-2020-2131/): Passwords stored in plain text by Harvest SCM Plugin (medium 6.5)
- [CVE-2020-2130](https://insights.sbomify.com/CVE-2020-2130/): Passwords stored in plain text by Harvest SCM Plugin (medium 6.5)
- [CVE-2020-2129](https://insights.sbomify.com/CVE-2020-2129/): Plaintext Storage of a Password in Jenkins Eagle Tester Plugin (medium 6.5)
- [CVE-2020-2128](https://insights.sbomify.com/CVE-2020-2128/): Password stored in plain text by ECX Copy Data Management Plugin (medium 4.3)
- [CVE-2020-2127](https://insights.sbomify.com/CVE-2020-2127/): Credential stored in plain text by BMC Release Package and Deployment Plugin (medium 4.3)
- [CVE-2020-21268](https://insights.sbomify.com/CVE-2020-21268/): Cross-site scripting in easycorp:zentao (medium 6.1)
- [CVE-2020-21266](https://insights.sbomify.com/CVE-2020-21266/): Cross-site scripting in broadleafcommerce:broadleaf commerce (medium 6.1)
- [CVE-2020-2126](https://insights.sbomify.com/CVE-2020-2126/): Token stored in plain text by DigitalOcean Plugin (medium 4.3)
- [CVE-2020-21252](https://insights.sbomify.com/CVE-2020-21252/): Cross-site request forgery in hongcms project:hongcms (high 8.8)
- [CVE-2020-21250](https://insights.sbomify.com/CVE-2020-21250/): File upload in cszcms:csz cms (critical 9.8)
- [CVE-2020-2125](https://insights.sbomify.com/CVE-2020-2125/): Credentials stored in plain text by debian-package-builder Plugin (medium 4.3)
- [CVE-2020-21246](https://insights.sbomify.com/CVE-2020-21246/): YiiCMS Cross Site Scripting vulnerability (medium 5.4)
- [CVE-2020-21244](https://insights.sbomify.com/CVE-2020-21244/): Path traversal in frontaccounting:frontaccounting (medium 4.9)
- [CVE-2020-2124](https://insights.sbomify.com/CVE-2020-2124/): Password stored in plain text by Dynamic Extended Choice Parameter Plugin (medium 4.3)
- [CVE-2020-21238](https://insights.sbomify.com/CVE-2020-21238/): Auth bypass in chshcms:cscms (critical 9.8)
- [CVE-2020-21237](https://insights.sbomify.com/CVE-2020-21237/): Auth bypass in 8cms:ljcms (critical 9.8)
- [CVE-2020-21236](https://insights.sbomify.com/CVE-2020-21236/): Cross-site request forgery in damicms:damicms (high 8.8)
- [CVE-2020-2123](https://insights.sbomify.com/CVE-2020-2123/): RCE vulnerability in RadarGun Plugin (high 8.8)
- [CVE-2020-21228](https://insights.sbomify.com/CVE-2020-21228/): Cross-site scripting in jizhicms:jizhicms (medium 6.1)
- [CVE-2020-21224](https://insights.sbomify.com/CVE-2020-21224/): Command injection in inspur:clusterengine (critical 9.8)
- [CVE-2020-2122](https://insights.sbomify.com/CVE-2020-2122/): Stored XSS vulnerability in Jenkins brakeman Plugin (medium 5.4)
- [CVE-2020-21219](https://insights.sbomify.com/CVE-2020-21219/): Cross-site scripting in netgate:acme (medium 6.1)
- [CVE-2020-2121](https://insights.sbomify.com/CVE-2020-2121/): RCE vulnerability in Google Kubernetes Engine Plugin (high 8.8)
- [CVE-2020-2120](https://insights.sbomify.com/CVE-2020-2120/): XXE vulnerability in FitNesse Plugin (high 8.8)
- [CVE-2020-2119](https://insights.sbomify.com/CVE-2020-2119/): Client secret transmitted in plain text by Azure AD Plugin (medium 5.3)
- [CVE-2020-21180](https://insights.sbomify.com/CVE-2020-21180/): SQL injection in koa2-blog project:koa2-blog (critical 9.8)
- [CVE-2020-2118](https://insights.sbomify.com/CVE-2020-2118/): Users with Overall/Read access can enumerate credential IDs in Pipeline GitHub Notify Step Plugin (medium 4.3)
- [CVE-2020-21179](https://insights.sbomify.com/CVE-2020-21179/): SQL injection in koa2-blog project:koa2-blog (critical 9.8)
- [CVE-2020-21176](https://insights.sbomify.com/CVE-2020-21176/): SQL Injection in thinkjs (critical 9.8)
- [CVE-2020-21174](https://insights.sbomify.com/CVE-2020-21174/): liufee CMS File Upload vulnerability (critical 9.8)
- [CVE-2020-2117](https://insights.sbomify.com/CVE-2020-2117/): Missing permission checks in Pipeline GitHub Notify Step Plugin allows capturing credentials (medium 4.3)
- [CVE-2020-21161](https://insights.sbomify.com/CVE-2020-21161/): Cross-site scripting in ruckuswireless:zonedirector firmware (medium 6.1)
- [CVE-2020-2116](https://insights.sbomify.com/CVE-2020-2116/): CSRF vulnerability in Pipeline GitHub Notify Step Plugin allows capturing credentials (high 8.8)
- [CVE-2020-21152](https://insights.sbomify.com/CVE-2020-21152/): SQL injection in inxedu:inxedu (critical 9.8)
- [CVE-2020-2115](https://insights.sbomify.com/CVE-2020-2115/): XXE vulnerability in NUnit Plugin (high 8.8)
- [CVE-2020-21147](https://insights.sbomify.com/CVE-2020-21147/): Cross-site scripting in rockoa:rockoa (medium 4.8)
- [CVE-2020-21146](https://insights.sbomify.com/CVE-2020-21146/): Feehi CMS vulnerable to Cross-site Scripting in Username Field (medium 6.1)
- [CVE-2020-21142](https://insights.sbomify.com/CVE-2020-21142/): Cross-site scripting in ipfire:ipfire (medium 6.1)
- [CVE-2020-21141](https://insights.sbomify.com/CVE-2020-21141/): Cross-site request forgery in idreamsoft:icms (high 8.8)
- [CVE-2020-2114](https://insights.sbomify.com/CVE-2020-2114/): Jenkins S3 Publisher Plugin transmits credentials in plain text during configuration (high 7.5)
- [CVE-2020-21139](https://insights.sbomify.com/CVE-2020-21139/): Cross-site request forgery in ec cloud e-commerce system project:ec cloud e-commerce system (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/133/