# Vulnerabilities published in 2020


- [CVE-2020-2039](https://insights.sbomify.com/CVE-2020-2039/): PAN-OS: Management web interface denial-of-service (DoS) through unauthenticated file upload (medium 5.3)
- [CVE-2020-20389](https://insights.sbomify.com/CVE-2020-20389/): Cross-site scripting in get-simple:getsimplecms (medium 4.8)
- [CVE-2020-2038](https://insights.sbomify.com/CVE-2020-2038/): PAN-OS: OS command injection vulnerability in the management web interface (high 7.2)
- [CVE-2020-2037](https://insights.sbomify.com/CVE-2020-2037/): PAN-OS: OS command injection vulnerability in the management web interface (high 7.2)
- [CVE-2020-20363](https://insights.sbomify.com/CVE-2020-20363/): Cross-site scripting in pbootcms:pbootcms (medium 4.8)
- [CVE-2020-2036](https://insights.sbomify.com/CVE-2020-2036/): PAN-OS: Reflected Cross-Site Scripting (XSS) vulnerability in management web interface (high 8.8)
- [CVE-2020-2035](https://insights.sbomify.com/CVE-2020-2035/): PAN-OS: URL filtering policy is not enforced on TLS handshakes for decrypted HTTPS sessions (low 3.0)
- [CVE-2020-20349](https://insights.sbomify.com/CVE-2020-20349/): Cross-site scripting in wtcms project:wtcms (medium 5.4)
- [CVE-2020-20348](https://insights.sbomify.com/CVE-2020-20348/): Cross-site scripting in wtcms project:wtcms (medium 5.4)
- [CVE-2020-20347](https://insights.sbomify.com/CVE-2020-20347/): Cross-site scripting in wtcms project:wtcms (medium 5.4)
- [CVE-2020-20345](https://insights.sbomify.com/CVE-2020-20345/): Cross-site scripting in wtcms project:wtcms (medium 5.4)
- [CVE-2020-20344](https://insights.sbomify.com/CVE-2020-20344/): Cross-site scripting in wtcms project:wtcms (medium 5.4)
- [CVE-2020-20343](https://insights.sbomify.com/CVE-2020-20343/): Cross-site request forgery in wtcms project:wtcms (medium 6.5)
- [CVE-2020-20341](https://insights.sbomify.com/CVE-2020-20341/): Server-side request forgery in yzmcms:yzmcms (high 7.5)
- [CVE-2020-20340](https://insights.sbomify.com/CVE-2020-20340/): SQL injection in s-cms:s-cms (high 7.5)
- [CVE-2020-2034](https://insights.sbomify.com/CVE-2020-2034/): PAN-OS: OS command injection vulnerability in GlobalProtect portal (high 8.1)
- [CVE-2020-20335](https://insights.sbomify.com/CVE-2020-20335/): Memory corruption in kilo project:kilo (high 7.5)
- [CVE-2020-2033](https://insights.sbomify.com/CVE-2020-2033/): GlobalProtect App: Missing certificate validation vulnerability can disclose pre-logon authentication cookie (medium 5.3)
- [CVE-2020-2032](https://insights.sbomify.com/CVE-2020-2032/): GlobalProtect App: File race condition vulnerability leads to local privilege escalation during upgrade (high 7.0)
- [CVE-2020-2031](https://insights.sbomify.com/CVE-2020-2031/): PAN-OS: Integer underflow in the management interface (medium 4.9)
- [CVE-2020-20300](https://insights.sbomify.com/CVE-2020-20300/): SQL injection in weiphp:weiphp (critical 9.8)
- [CVE-2020-2030](https://insights.sbomify.com/CVE-2020-2030/): PAN-OS: OS command injection vulnerability in the management interface (high 7.2)
- [CVE-2020-20299](https://insights.sbomify.com/CVE-2020-20299/): Missing authorization in weiphp:weiphp (high 7.5)
- [CVE-2020-20298](https://insights.sbomify.com/CVE-2020-20298/): Code injection in zzzcms:zzzphp (critical 9.8)
- [CVE-2020-20296](https://insights.sbomify.com/CVE-2020-20296/): SQL injection in cmswing:cmswing (critical 9.8)
- [CVE-2020-20295](https://insights.sbomify.com/CVE-2020-20295/): SQL injection in cmswing:cmswing (critical 9.8)
- [CVE-2020-20294](https://insights.sbomify.com/CVE-2020-20294/): Command injection in cmswing:cmswing (critical 9.8)
- [CVE-2020-20290](https://insights.sbomify.com/CVE-2020-20290/): Path traversal in yccms:yccms (high 7.5)
- [CVE-2020-2029](https://insights.sbomify.com/CVE-2020-2029/): PAN-OS: OS command injection vulnerability in management interface certificate generator (high 7.2)
- [CVE-2020-20289](https://insights.sbomify.com/CVE-2020-20289/): SQL injection in yccms:yccms (critical 9.8)
- [CVE-2020-20287](https://insights.sbomify.com/CVE-2020-20287/): File upload in yccms:yccms (critical 9.8)
- [CVE-2020-20285](https://insights.sbomify.com/CVE-2020-20285/): Cross-site scripting in zzcms:zzcms (medium 5.4)
- [CVE-2020-2028](https://insights.sbomify.com/CVE-2020-2028/): PAN-OS: OS command injection vulnerability in FIPS-CC mode certificate verification (high 7.2)
- [CVE-2020-20277](https://insights.sbomify.com/CVE-2020-20277/): Path traversal in troglobit:uftpd (critical 9.8)
- [CVE-2020-20276](https://insights.sbomify.com/CVE-2020-20276/): Memory corruption in troglobit:uftpd (critical 9.8)
- [CVE-2020-2027](https://insights.sbomify.com/CVE-2020-2027/): PAN-OS: Buffer overflow in authd authentication response (high 7.2)
- [CVE-2020-20269](https://insights.sbomify.com/CVE-2020-20269/): Cross-site scripting in caret:caret (critical 9.8)
- [CVE-2020-20267](https://insights.sbomify.com/CVE-2020-20267/): Memory corruption in mikrotik:routeros (medium 6.5)
- [CVE-2020-20266](https://insights.sbomify.com/CVE-2020-20266/): Null dereference in mikrotik:routeros (medium 6.5)
- [CVE-2020-20265](https://insights.sbomify.com/CVE-2020-20265/): Memory corruption in mikrotik:routeros (medium 6.5)
- [CVE-2020-20264](https://insights.sbomify.com/CVE-2020-20264/): Denial of service in mikrotik:routeros (medium 6.5)
- [CVE-2020-20262](https://insights.sbomify.com/CVE-2020-20262/): Denial of service in mikrotik:routeros (medium 6.5)
- [CVE-2020-2026](https://insights.sbomify.com/CVE-2020-2026/): Kata Containers - Guests can trick the kata-runtime into mounting the container image on any host path (high 7.8)
- [CVE-2020-20254](https://insights.sbomify.com/CVE-2020-20254/): Null dereference in mikrotik:routeros (medium 6.5)
- [CVE-2020-20253](https://insights.sbomify.com/CVE-2020-20253/): Denial of service in mikrotik:routeros (medium 6.5)
- [CVE-2020-20252](https://insights.sbomify.com/CVE-2020-20252/): Null dereference in mikrotik:routeros (medium 6.5)
- [CVE-2020-20250](https://insights.sbomify.com/CVE-2020-20250/): Null dereference in mikrotik:routeros (medium 6.5)
- [CVE-2020-2025](https://insights.sbomify.com/CVE-2020-2025/): Kata Containers - Cloud Hypervisor guests persist filesystem changes to the underlying host image file (high 8.8)
- [CVE-2020-20249](https://insights.sbomify.com/CVE-2020-20249/): Memory corruption in mikrotik:routeros (medium 6.5)
- [CVE-2020-20248](https://insights.sbomify.com/CVE-2020-20248/): Denial of service in mikrotik:routeros (medium 6.5)
- [CVE-2020-20247](https://insights.sbomify.com/CVE-2020-20247/): Memory corruption in mikrotik:routeros (medium 6.5)
- [CVE-2020-20246](https://insights.sbomify.com/CVE-2020-20246/): Memory corruption in mikrotik:routeros (medium 6.5)
- [CVE-2020-20245](https://insights.sbomify.com/CVE-2020-20245/): Memory corruption in mikrotik:routeros (medium 6.5)
- [CVE-2020-2024](https://insights.sbomify.com/CVE-2020-2024/): Kata Containers - Guests can trick the kata-runtime into unmounting any mount point on the host (medium 6.5)
- [CVE-2020-20237](https://insights.sbomify.com/CVE-2020-20237/): Memory corruption in mikrotik:routeros (medium 6.5)
- [CVE-2020-20236](https://insights.sbomify.com/CVE-2020-20236/): Memory corruption in mikrotik:routeros (medium 6.5)
- [CVE-2020-20231](https://insights.sbomify.com/CVE-2020-20231/): Null dereference in mikrotik:routeros (medium 6.5)
- [CVE-2020-20230](https://insights.sbomify.com/CVE-2020-20230/): Denial of service in mikrotik:routeros (medium 6.5)
- [CVE-2020-2023](https://insights.sbomify.com/CVE-2020-2023/): Kata Containers - Containers have access to the guest root filesystem device (low 3.8)
- [CVE-2020-20227](https://insights.sbomify.com/CVE-2020-20227/): Memory corruption in mikrotik:routeros (medium 6.5)
- [CVE-2020-20225](https://insights.sbomify.com/CVE-2020-20225/): Denial of service in mikrotik:routeros (medium 6.5)
- [CVE-2020-20222](https://insights.sbomify.com/CVE-2020-20222/): Null dereference in mikrotik:routeros (medium 6.5)
- [CVE-2020-20221](https://insights.sbomify.com/CVE-2020-20221/): Denial of service in mikrotik:routeros (medium 6.5)
- [CVE-2020-20220](https://insights.sbomify.com/CVE-2020-20220/): Null dereference in mikrotik:routeros (medium 6.5)
- [CVE-2020-2022](https://insights.sbomify.com/CVE-2020-2022/): PAN-OS: Panorama session disclosure during context switch into managed device (high 7.5)
- [CVE-2020-20219](https://insights.sbomify.com/CVE-2020-20219/): Null dereference in mikrotik:routeros (medium 6.5)
- [CVE-2020-20218](https://insights.sbomify.com/CVE-2020-20218/): Memory corruption in mikrotik:routeros (medium 6.5)
- [CVE-2020-20217](https://insights.sbomify.com/CVE-2020-20217/): Denial of service in mikrotik:routeros (medium 6.5)
- [CVE-2020-20216](https://insights.sbomify.com/CVE-2020-20216/): Null dereference in mikrotik:routeros (medium 6.5)
- [CVE-2020-20215](https://insights.sbomify.com/CVE-2020-20215/): Memory corruption in mikrotik:routeros (medium 6.5)
- [CVE-2020-20214](https://insights.sbomify.com/CVE-2020-20214/): Denial of service in mikrotik:routeros (medium 6.5)
- [CVE-2020-20213](https://insights.sbomify.com/CVE-2020-20213/): Denial of service in mikrotik:routeros (medium 6.5)
- [CVE-2020-20212](https://insights.sbomify.com/CVE-2020-20212/): Null dereference in mikrotik:routeros (medium 6.5)
- [CVE-2020-20211](https://insights.sbomify.com/CVE-2020-20211/): Denial of service in mikrotik:routeros (medium 6.5)
- [CVE-2020-20210](https://insights.sbomify.com/CVE-2020-20210/): File upload in bludit:bludit (high 8.8)
- [CVE-2020-2021](https://insights.sbomify.com/CVE-2020-2021/): Palo Alto Networks PAN-OS Authentication Bypass (critical 10.0, exploited in the wild)
- [CVE-2020-2020](https://insights.sbomify.com/CVE-2020-2020/): Cortex XDR Agent: Exceptional condition denial-of-service (DoS) (medium 5.5)
- [CVE-2020-20189](https://insights.sbomify.com/CVE-2020-20189/): SQL injection in newpk project:newpk (critical 9.8)
- [CVE-2020-20184](https://insights.sbomify.com/CVE-2020-20184/): Command injection in liftoffsoftware:gateone (critical 9.8)
- [CVE-2020-20183](https://insights.sbomify.com/CVE-2020-20183/): Missing authorization in zyxel:p1302-t10 v3 firmware (high 7.5)
- [CVE-2020-2018](https://insights.sbomify.com/CVE-2020-2018/): PAN-OS: Panorama authentication bypass vulnerability (critical 9.0)
- [CVE-2020-20178](https://insights.sbomify.com/CVE-2020-20178/): Denial of service in whohas project:whohas (high 7.5)
- [CVE-2020-2017](https://insights.sbomify.com/CVE-2020-2017/): PAN-OS: DOM-Based cross site scripting vulnerability in management web interface (high 8.8)
- [CVE-2020-2016](https://insights.sbomify.com/CVE-2020-2016/): PAN-OS: Temporary file race condition vulnerability in PAN-OS leads to local privilege escalation (high 7.0)
- [CVE-2020-2015](https://insights.sbomify.com/CVE-2020-2015/): PAN-OS: Buffer overflow in the management server (high 8.8)
- [CVE-2020-20142](https://insights.sbomify.com/CVE-2020-20142/): Cross-site scripting in flexmonster:pivot table \& charts (medium 6.1)
- [CVE-2020-20141](https://insights.sbomify.com/CVE-2020-20141/): Cross-site scripting in flexmonster:pivot table \& charts (medium 6.1)
- [CVE-2020-20140](https://insights.sbomify.com/CVE-2020-20140/): Cross-site scripting in flexmonster:pivot table \& charts (medium 6.1)
- [CVE-2020-2014](https://insights.sbomify.com/CVE-2020-2014/): PAN-OS: OS injection vulnerability in PAN-OS management server (high 8.8)
- [CVE-2020-20139](https://insights.sbomify.com/CVE-2020-20139/): Cross-site scripting in flexmonster:pivot table \& charts (medium 6.1)
- [CVE-2020-20138](https://insights.sbomify.com/CVE-2020-20138/): Cross-site scripting in cmsmadesimple:cms made simple (medium 6.1)
- [CVE-2020-20136](https://insights.sbomify.com/CVE-2020-20136/): QuantConnect Lean vulnerable to insecure deserialization (critical 9.8)
- [CVE-2020-20131](https://insights.sbomify.com/CVE-2020-20131/): Cross-site scripting in laracms project:laracms (medium 5.4)
- [CVE-2020-2013](https://insights.sbomify.com/CVE-2020-2013/): PAN-OS: Panorama context switch session cookie disclosure (high 8.3)
- [CVE-2020-20129](https://insights.sbomify.com/CVE-2020-20129/): Cross-site Scripting in LaraCMS (medium 5.4)
- [CVE-2020-20128](https://insights.sbomify.com/CVE-2020-20128/): Information disclosure in laracms project:laracms (high 7.5)
- [CVE-2020-20125](https://insights.sbomify.com/CVE-2020-20125/): Cross-site scripting in earclink:espcms-p8 (medium 6.1)
- [CVE-2020-20124](https://insights.sbomify.com/CVE-2020-20124/): Code injection in wuzhicms:wuzhicms (high 8.8)
- [CVE-2020-20122](https://insights.sbomify.com/CVE-2020-20122/): SQL injection in wuzhicms:wuzhicms (critical 9.8)
- [CVE-2020-20120](https://insights.sbomify.com/CVE-2020-20120/): SQL Injection in topthink/thinkphp (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/136/