# Vulnerabilities published in 2020


- [CVE-2020-21133](https://insights.sbomify.com/CVE-2020-21133/): SQL injection in metinfo:metinfo (critical 9.8)
- [CVE-2020-21132](https://insights.sbomify.com/CVE-2020-21132/): SQL injection in metinfo:metinfo (critical 9.8)
- [CVE-2020-21131](https://insights.sbomify.com/CVE-2020-21131/): SQL injection in metinfo:metinfo (high 7.2)
- [CVE-2020-21130](https://insights.sbomify.com/CVE-2020-21130/): Cross-site scripting in hisiphp:hisiphp (medium 6.1)
- [CVE-2020-2113](https://insights.sbomify.com/CVE-2020-2113/): Jenkins Git Parameter Plugin vulnerable to stored cross-site scripting (XSS) (medium 5.4)
- [CVE-2020-21127](https://insights.sbomify.com/CVE-2020-21127/): SQL injection in metinfo:metinfo (critical 9.8)
- [CVE-2020-21126](https://insights.sbomify.com/CVE-2020-21126/): Cross-site request forgery in metinfo:metinfo (high 8.8)
- [CVE-2020-21125](https://insights.sbomify.com/CVE-2020-21125/): Remote code execution in UReport (critical 9.8)
- [CVE-2020-21124](https://insights.sbomify.com/CVE-2020-21124/): Missing authorization in ureport project:ureport (critical 9.8)
- [CVE-2020-21122](https://insights.sbomify.com/CVE-2020-21122/): Server-Side Request Forgery in UReport (medium 5.3)
- [CVE-2020-21121](https://insights.sbomify.com/CVE-2020-21121/): SQL injection in kliqqi:kliqqi cms (critical 9.8)
- [CVE-2020-21120](https://insights.sbomify.com/CVE-2020-21120/): SQL injection in uqcms:uqcms (critical 9.8)
- [CVE-2020-2112](https://insights.sbomify.com/CVE-2020-2112/): Jenkins Git Parameter Plugin vulnerable to Stored cross-site scripting (XSS) (medium 5.4)
- [CVE-2020-21119](https://insights.sbomify.com/CVE-2020-21119/): SQL injection in kliqqi:kliqqi cms (critical 9.8)
- [CVE-2020-2111](https://insights.sbomify.com/CVE-2020-2111/): Subversion Plugin stored XSS vulnerability (medium 5.4)
- [CVE-2020-21101](https://insights.sbomify.com/CVE-2020-21101/): Cross-site scripting in screenly:screenly (medium 5.4)
- [CVE-2020-2110](https://insights.sbomify.com/CVE-2020-2110/): Improper Input Validation in Jenkins Script Security Plugin (high 8.8)
- [CVE-2020-2109](https://insights.sbomify.com/CVE-2020-2109/): Improper Input Validation in Jenkins Pipeline: Groovy Plugin (high 8.8)
- [CVE-2020-21088](https://insights.sbomify.com/CVE-2020-21088/): Cross-site scripting in x2engine:x2crm (medium 4.8)
- [CVE-2020-21087](https://insights.sbomify.com/CVE-2020-21087/): Cross-site scripting in x2engine:x2crm (medium 6.1)
- [CVE-2020-21082](https://insights.sbomify.com/CVE-2020-21082/): Cross-site scripting in maccms:maccms (medium 6.1)
- [CVE-2020-21081](https://insights.sbomify.com/CVE-2020-21081/): Cross-site request forgery in maccms:maccms (medium 6.5)
- [CVE-2020-2108](https://insights.sbomify.com/CVE-2020-2108/): XXE vulnerability in Jenkins WebSphere Deployer Plugin (high 7.6)
- [CVE-2020-2107](https://insights.sbomify.com/CVE-2020-2107/): Fortify Plugin stored credentials in plain text (medium 4.3)
- [CVE-2020-21066](https://insights.sbomify.com/CVE-2020-21066/): Memory corruption in axiosys:bento4 (medium 6.5)
- [CVE-2020-21060](https://insights.sbomify.com/CVE-2020-21060/): SQL injection in phpmywind:phpmywind (high 8.8)
- [CVE-2020-2106](https://insights.sbomify.com/CVE-2020-2106/): Stored XSS vulnerability in Code Coverage API Plugin (medium 5.4)
- [CVE-2020-21058](https://insights.sbomify.com/CVE-2020-21058/): Cross-site scripting in typora:typora (medium 6.1)
- [CVE-2020-21057](https://insights.sbomify.com/CVE-2020-21057/): Path traversal in fusionpbx:fusionpbx (high 8.1)
- [CVE-2020-21056](https://insights.sbomify.com/CVE-2020-21056/): Path traversal in fusionpbx:fusionpbx (medium 4.3)
- [CVE-2020-21055](https://insights.sbomify.com/CVE-2020-21055/): Path traversal in fusionpbx:fusionpbx (medium 6.5)
- [CVE-2020-21054](https://insights.sbomify.com/CVE-2020-21054/): Cross-site scripting in fusionpbx:fusionpbx (medium 6.1)
- [CVE-2020-21053](https://insights.sbomify.com/CVE-2020-21053/): Cross-site scripting in fusionpbx:fusionpbx (medium 6.1)
- [CVE-2020-21052](https://insights.sbomify.com/CVE-2020-21052/): Cross-site scripting in zrlog:zrlog (medium 6.1)
- [CVE-2020-21050](https://insights.sbomify.com/CVE-2020-21050/): Memory corruption in saitoha:libsixel (medium 6.5)
- [CVE-2020-2105](https://insights.sbomify.com/CVE-2020-2105/): Jenkins REST APIs vulnerable to clickjacking (medium 5.4)
- [CVE-2020-21049](https://insights.sbomify.com/CVE-2020-21049/): Memory corruption in saitoha:libsixel (medium 6.5)
- [CVE-2020-21048](https://insights.sbomify.com/CVE-2020-21048/): Denial of service in saitoha:libsixel (medium 6.5)
- [CVE-2020-21047](https://insights.sbomify.com/CVE-2020-21047/): Memory corruption in elfutils project:elfutils (medium 5.5)
- [CVE-2020-21046](https://insights.sbomify.com/CVE-2020-21046/): Privilege escalation in softonic:eagleget (high 7.8)
- [CVE-2020-21041](https://insights.sbomify.com/CVE-2020-21041/): Memory corruption in debian:debian linux (high 7.5)
- [CVE-2020-2104](https://insights.sbomify.com/CVE-2020-2104/): Memory usage graphs accessible to anyone with Overall/Read (medium 4.3)
- [CVE-2020-21038](https://insights.sbomify.com/CVE-2020-21038/): Open redirect in typecho:typecho (medium 6.1)
- [CVE-2020-2103](https://insights.sbomify.com/CVE-2020-2103/): Jenkins Diagnostic page exposed session cookies (medium 5.4)
- [CVE-2020-2102](https://insights.sbomify.com/CVE-2020-2102/): Non-constant time HMAC comparison (medium 5.3)
- [CVE-2020-21016](https://insights.sbomify.com/CVE-2020-21016/): Code injection in dlink:dir-846 firmware (critical 9.8)
- [CVE-2020-21014](https://insights.sbomify.com/CVE-2020-21014/): Path traversal in emlog:emlog (medium 6.5)
- [CVE-2020-21013](https://insights.sbomify.com/CVE-2020-21013/): SQL injection in emlog:emlog (high 7.2)
- [CVE-2020-21012](https://insights.sbomify.com/CVE-2020-21012/): SQL injection in nikhil-bhalerao:hotel and lodge management system (critical 9.8)
- [CVE-2020-2101](https://insights.sbomify.com/CVE-2020-2101/): Non-constant time comparison of inbound TCP agent connection secret (medium 5.3)
- [CVE-2020-21005](https://insights.sbomify.com/CVE-2020-21005/): File upload in wellcms:wellcms (medium 6.5)
- [CVE-2020-21003](https://insights.sbomify.com/CVE-2020-21003/): Cross-site scripting in pbootcms:pbootcms (medium 4.8)
- [CVE-2020-2100](https://insights.sbomify.com/CVE-2020-2100/): Jenkins vulnerable to UDP amplification reflection attack (medium 5.8)
- [CVE-2020-20990](https://insights.sbomify.com/CVE-2020-20990/): Cross-site scripting in domainmod:domainmod (medium 5.4)
- [CVE-2020-2099](https://insights.sbomify.com/CVE-2020-2099/): Inbound TCP Agent Protocol/3 authentication bypass in Jenkins (high 8.6)
- [CVE-2020-20989](https://insights.sbomify.com/CVE-2020-20989/): Cross-site request forgery in domainmod:domainmod (medium 4.3)
- [CVE-2020-20988](https://insights.sbomify.com/CVE-2020-20988/): Cross-site scripting in domainmod:domainmod (medium 5.4)
- [CVE-2020-20982](https://insights.sbomify.com/CVE-2020-20982/): Cross-site scripting in wdja:wdja cms (critical 9.6)
- [CVE-2020-20981](https://insights.sbomify.com/CVE-2020-20981/): SQL injection in metinfo:metinfo (high 7.5)
- [CVE-2020-2098](https://insights.sbomify.com/CVE-2020-2098/): CSRF vulnerability in Jenkins Sounds Plugin allow OS command execution (high 8.8)
- [CVE-2020-20979](https://insights.sbomify.com/CVE-2020-20979/): File upload in 8cms:ljcms (critical 9.8)
- [CVE-2020-20977](https://insights.sbomify.com/CVE-2020-20977/): Cross-site scripting in ukcms:ukcms (medium 5.4)
- [CVE-2020-20975](https://insights.sbomify.com/CVE-2020-20975/): SQL injection in gxlcms:gxlcms (critical 9.8)
- [CVE-2020-20971](https://insights.sbomify.com/CVE-2020-20971/): Cross-site request forgery in pbootcms:pbootcms (high 8.8)
- [CVE-2020-2097](https://insights.sbomify.com/CVE-2020-2097/): Missing permission checks in Jenkins Sounds Plugin allow OS command execution (high 8.8)
- [CVE-2020-20969](https://insights.sbomify.com/CVE-2020-20969/): File upload in pluck-cms:pluck (high 7.2)
- [CVE-2020-2096](https://insights.sbomify.com/CVE-2020-2096/): Reflected XSS vulnerability in Jenkins gitlab-hook Plugin (medium 6.1)
- [CVE-2020-20951](https://insights.sbomify.com/CVE-2020-20951/): Command injection in pluck-cms:pluck (critical 9.8)
- [CVE-2020-20950](https://insights.sbomify.com/CVE-2020-20950/): Weak cryptography in ietf:public key cryptography standards \#1 (medium 5.9)
- [CVE-2020-2095](https://insights.sbomify.com/CVE-2020-2095/): Redgate SQL Change Automation Plugin stored credentials in plain text (medium 4.3)
- [CVE-2020-20949](https://insights.sbomify.com/CVE-2020-20949/): Weak cryptography in ietf:public key cryptography standards \#1 (medium 5.9)
- [CVE-2020-20948](https://insights.sbomify.com/CVE-2020-20948/): Path traversal in jeecg:jeecg (high 7.5)
- [CVE-2020-20946](https://insights.sbomify.com/CVE-2020-20946/): Cross-site scripting in qibosoft:qibosoft (medium 5.4)
- [CVE-2020-20945](https://insights.sbomify.com/CVE-2020-20945/): Cross-site request forgery in qibosoft:qibosoft (high 8.8)
- [CVE-2020-20944](https://insights.sbomify.com/CVE-2020-20944/): Path traversal in qibosoft:qibosoft (critical 9.1)
- [CVE-2020-20943](https://insights.sbomify.com/CVE-2020-20943/): Cross-site request forgery in qibosoft:qibosoft (medium 4.3)
- [CVE-2020-2094](https://insights.sbomify.com/CVE-2020-2094/): Missing permission checks in Health Advisor by CloudBees Plugin (medium 4.3)
- [CVE-2020-2093](https://insights.sbomify.com/CVE-2020-2093/): CSRF vulnerability in Health Advisor by CloudBees Plugin (high 8.8)
- [CVE-2020-2092](https://insights.sbomify.com/CVE-2020-2092/): XXE vulnerability in Jenkins Robot Framework Plugin (high 8.8)
- [CVE-2020-20919](https://insights.sbomify.com/CVE-2020-20919/): File upload in pluck-cms:pluck (high 7.2)
- [CVE-2020-20918](https://insights.sbomify.com/CVE-2020-20918/): Code injection in pluck-cms:pluck (high 7.2)
- [CVE-2020-20915](https://insights.sbomify.com/CVE-2020-20915/): SQL injection in publiccms:publiccms (critical 9.8)
- [CVE-2020-20914](https://insights.sbomify.com/CVE-2020-20914/): SQL injection in publiccms:publiccms (critical 9.8)
- [CVE-2020-20913](https://insights.sbomify.com/CVE-2020-20913/): Ming-Soft MCMS vulnerable to SQL injection (critical 9.8)
- [CVE-2020-2091](https://insights.sbomify.com/CVE-2020-2091/): Missing permission checks in Jenkins Amazon EC2 Plugin (high 8.1)
- [CVE-2020-20908](https://insights.sbomify.com/CVE-2020-20908/): Cross-site scripting in akaunting:akaunting (medium 5.4)
- [CVE-2020-20907](https://insights.sbomify.com/CVE-2020-20907/): Path traversal in metinfo:metinfo (critical 9.1)
- [CVE-2020-20902](https://insights.sbomify.com/CVE-2020-20902/): Memory corruption in ffmpeg:ffmpeg (medium 6.5)
- [CVE-2020-2090](https://insights.sbomify.com/CVE-2020-2090/): CSRF vulnerability in Jenkins Amazon EC2 Plugin (high 8.8)
- [CVE-2020-20898](https://insights.sbomify.com/CVE-2020-20898/): Integer overflow in ffmpeg:ffmpeg (high 8.8)
- [CVE-2020-20896](https://insights.sbomify.com/CVE-2020-20896/): Null dereference in ffmpeg:ffmpeg (high 8.8)
- [CVE-2020-20892](https://insights.sbomify.com/CVE-2020-20892/): Denial of service in ffmpeg:ffmpeg (high 8.8)
- [CVE-2020-20891](https://insights.sbomify.com/CVE-2020-20891/): Memory corruption in ffmpeg:ffmpeg (high 8.8)
- [CVE-2020-20813](https://insights.sbomify.com/CVE-2020-20813/): Denial of service in openvpn:openvpn (high 7.5)
- [CVE-2020-20808](https://insights.sbomify.com/CVE-2020-20808/): Cross-site scripting in qibosoft:qibosoft (medium 6.1)
- [CVE-2020-20800](https://insights.sbomify.com/CVE-2020-20800/): SQL injection in metinfo:metinfo (critical 9.8)
- [CVE-2020-20799](https://insights.sbomify.com/CVE-2020-20799/): Cross-site scripting in jeecms:jeecms (medium 5.4)
- [CVE-2020-20797](https://insights.sbomify.com/CVE-2020-20797/): SQL injection in flamecms project:flamecms (critical 9.8)
- [CVE-2020-20796](https://insights.sbomify.com/CVE-2020-20796/): SQL injection in flamecms project:flamecms (critical 9.8)
- [CVE-2020-20781](https://insights.sbomify.com/CVE-2020-20781/): Cross-site scripting in ucms project:ucms (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/134/