# Vulnerabilities published in 2020


- [CVE-2020-2012](https://insights.sbomify.com/CVE-2020-2012/): PAN-OS: Panorama: XML external entity reference ('XXE') vulnerability leads the to information leak (high 7.5)
- [CVE-2020-20118](https://insights.sbomify.com/CVE-2020-20118/): Memory corruption in avast:antivirus (medium 5.5)
- [CVE-2020-2011](https://insights.sbomify.com/CVE-2020-2011/): PAN-OS: Panorama registration denial of service (high 7.5)
- [CVE-2020-2010](https://insights.sbomify.com/CVE-2020-2010/): PAN-OS: Authenticated user command injection vulnerability (high 7.2)
- [CVE-2020-20096](https://insights.sbomify.com/CVE-2020-20096/): Other in whatsapp:whatsapp (medium 6.5)
- [CVE-2020-20095](https://insights.sbomify.com/CVE-2020-20095/): Other in apple:imessage (medium 6.5)
- [CVE-2020-20094](https://insights.sbomify.com/CVE-2020-20094/): Other in facebook:instagram (medium 6.5)
- [CVE-2020-20093](https://insights.sbomify.com/CVE-2020-20093/): Other in facebook:messenger (medium 6.5)
- [CVE-2020-20092](https://insights.sbomify.com/CVE-2020-20092/): File upload in articlecms project:articlecms (critical 9.8)
- [CVE-2020-2009](https://insights.sbomify.com/CVE-2020-2009/): PAN-OS: Panorama SD WAN arbitrary file creation (high 7.2)
- [CVE-2020-2008](https://insights.sbomify.com/CVE-2020-2008/): PAN-OS: OS command injection or arbitrary file deletion vulnerability (high 7.2)
- [CVE-2020-20070](https://insights.sbomify.com/CVE-2020-20070/): Cross-site scripting in diaowen:dwsurvey (medium 6.1)
- [CVE-2020-2007](https://insights.sbomify.com/CVE-2020-2007/): PAN-OS: OS command injection in management server (high 7.2)
- [CVE-2020-20067](https://insights.sbomify.com/CVE-2020-20067/): File upload in ebcms:ebcms (high 8.8)
- [CVE-2020-2006](https://insights.sbomify.com/CVE-2020-2006/): PAN-OS: Buffer overflow in management server payload parser (high 7.2)
- [CVE-2020-2005](https://insights.sbomify.com/CVE-2020-2005/): PAN-OS: GlobalProtect Clientless VPN session hijacking (high 7.1)
- [CVE-2020-2004](https://insights.sbomify.com/CVE-2020-2004/): GlobalProtect App: Passwords may be logged in clear text while collecting troubleshooting logs (medium 6.8)
- [CVE-2020-2003](https://insights.sbomify.com/CVE-2020-2003/): PAN-OS: Authenticated administrator can delete arbitrary system file (medium 6.5)
- [CVE-2020-20021](https://insights.sbomify.com/CVE-2020-20021/): Denial of service in mikrotik:routeros (high 7.5)
- [CVE-2020-2002](https://insights.sbomify.com/CVE-2020-2002/): PAN-OS: Spoofed Kerberos key distribution center authentication bypass (high 8.1)
- [CVE-2020-20012](https://insights.sbomify.com/CVE-2020-20012/): Path traversal in sudytech:webplus pro (critical 9.8)
- [CVE-2020-2001](https://insights.sbomify.com/CVE-2020-2001/): PAN-OS: Panorama External control of file vulnerability leads to privilege escalation (high 8.1)
- [CVE-2020-2000](https://insights.sbomify.com/CVE-2020-2000/): PAN-OS: OS command injection and memory corruption vulnerability (high 7.2)
- [CVE-2020-1999](https://insights.sbomify.com/CVE-2020-1999/): PAN-OS: Threat signatures are evaded by specifically crafted packets (medium 5.3)
- [CVE-2020-1998](https://insights.sbomify.com/CVE-2020-1998/): PAN-OS: Improper SAML SSO authorization of shared local users (medium 5.4)
- [CVE-2020-1997](https://insights.sbomify.com/CVE-2020-1997/): PAN-OS: GlobalProtect registration open redirect (medium 5.3)
- [CVE-2020-19964](https://insights.sbomify.com/CVE-2020-19964/): Cross-site request forgery in phpmywind:phpmywind (medium 6.5)
- [CVE-2020-19962](https://insights.sbomify.com/CVE-2020-19962/): Cross-site scripting in chaoji cms project:chaoji cms (medium 5.4)
- [CVE-2020-19961](https://insights.sbomify.com/CVE-2020-19961/): SQL injection in zzcms:zzcms (high 7.5)
- [CVE-2020-19960](https://insights.sbomify.com/CVE-2020-19960/): SQL injection in zzcms:zzcms (high 7.5)
- [CVE-2020-1996](https://insights.sbomify.com/CVE-2020-1996/): PAN-OS: Panorama management server log injection (medium 5.3)
- [CVE-2020-19959](https://insights.sbomify.com/CVE-2020-19959/): SQL injection in zzcms:zzcms (high 7.5)
- [CVE-2020-19957](https://insights.sbomify.com/CVE-2020-19957/): SQL injection in zzcms:zzcms (high 7.5)
- [CVE-2020-19954](https://insights.sbomify.com/CVE-2020-19954/): XML external entity in s-cms:s-cms (high 7.5)
- [CVE-2020-19952](https://insights.sbomify.com/CVE-2020-19952/): Cross-site scripting in jbt:live \(github-flavored\) markdown editor (medium 6.1)
- [CVE-2020-19951](https://insights.sbomify.com/CVE-2020-19951/): Cross-site request forgery in yzmcms:yzmcms (high 8.8)
- [CVE-2020-19950](https://insights.sbomify.com/CVE-2020-19950/): Cross-site scripting in yzmcms:yzmcms (medium 4.8)
- [CVE-2020-1995](https://insights.sbomify.com/CVE-2020-1995/): PAN-OS: Management server rasmgr denial of service (medium 4.9)
- [CVE-2020-19949](https://insights.sbomify.com/CVE-2020-19949/): Cross-site scripting in yzmcms:yzmcms (medium 4.8)
- [CVE-2020-19947](https://insights.sbomify.com/CVE-2020-19947/): Cross-site scripting in markdown edit project:markdown edit (critical 9.6)
- [CVE-2020-1994](https://insights.sbomify.com/CVE-2020-1994/): PAN-OS: Predictable temporary file vulnerability (medium 4.1)
- [CVE-2020-1993](https://insights.sbomify.com/CVE-2020-1993/): PAN-OS: GlobalProtect Portal PHP session fixation vulnerability (low 3.7)
- [CVE-2020-19924](https://insights.sbomify.com/CVE-2020-19924/): Cross-site scripting in issuehunt:boostnote (medium 5.4)
- [CVE-2020-1992](https://insights.sbomify.com/CVE-2020-1992/): PAN-OS on PA-7000 Series: Varrcvr daemon network-based denial of service or privilege escalation (high 8.1)
- [CVE-2020-19915](https://insights.sbomify.com/CVE-2020-19915/): Cross-site scripting in wuzhicms:wuzhicms (medium 6.1)
- [CVE-2020-19914](https://insights.sbomify.com/CVE-2020-19914/): Cross-site scripting in xiuno:xiunobbs (medium 6.1)
- [CVE-2020-1991](https://insights.sbomify.com/CVE-2020-1991/): Traps: Insecure temporary file vulnerability may allow privilege escalation on Windows (high 7.8)
- [CVE-2020-19909](https://insights.sbomify.com/CVE-2020-19909/): Integer overflow in haxx:curl (low 3.3)
- [CVE-2020-19907](https://insights.sbomify.com/CVE-2020-19907/): Command injection in mitre:caldera (high 8.8)
- [CVE-2020-19902](https://insights.sbomify.com/CVE-2020-19902/): Path traversal in wcms:wcms (critical 9.8)
- [CVE-2020-1990](https://insights.sbomify.com/CVE-2020-1990/): PAN-OS: Buffer overflow in the management server (high 7.2)
- [CVE-2020-19897](https://insights.sbomify.com/CVE-2020-19897/): Cross-site scripting in wuzhicms:wuzhicms (medium 6.1)
- [CVE-2020-19896](https://insights.sbomify.com/CVE-2020-19896/): Code injection in 1234n:minicms (critical 9.8)
- [CVE-2020-19891](https://insights.sbomify.com/CVE-2020-19891/): File upload in dbhcms project:dbhcms (high 7.2)
- [CVE-2020-19890](https://insights.sbomify.com/CVE-2020-19890/): Path traversal in dbhcms project:dbhcms (medium 4.9)
- [CVE-2020-1989](https://insights.sbomify.com/CVE-2020-1989/): Global Protect Agent: Incorrect privilege assignment allows local privilege escalation (high 7.0)
- [CVE-2020-19889](https://insights.sbomify.com/CVE-2020-19889/): Cross-site request forgery in dbhcms project:dbhcms (high 8.8)
- [CVE-2020-19888](https://insights.sbomify.com/CVE-2020-19888/): Missing authorization in dbhcms project:dbhcms (medium 5.9)
- [CVE-2020-19887](https://insights.sbomify.com/CVE-2020-19887/): Cross-site scripting in dbhcms project:dbhcms (medium 4.8)
- [CVE-2020-19886](https://insights.sbomify.com/CVE-2020-19886/): Cross-site request forgery in dbhcms project:dbhcms (high 8.1)
- [CVE-2020-19885](https://insights.sbomify.com/CVE-2020-19885/): Cross-site scripting in dbhcms project:dbhcms (medium 4.8)
- [CVE-2020-19884](https://insights.sbomify.com/CVE-2020-19884/): Cross-site scripting in dbhcms project:dbhcms (medium 4.8)
- [CVE-2020-19883](https://insights.sbomify.com/CVE-2020-19883/): Cross-site scripting in dbhcms project:dbhcms (medium 4.8)
- [CVE-2020-19882](https://insights.sbomify.com/CVE-2020-19882/): Cross-site scripting in dbhcms project:dbhcms (medium 4.8)
- [CVE-2020-19881](https://insights.sbomify.com/CVE-2020-19881/): Cross-site scripting in dbhcms project:dbhcms (medium 4.8)
- [CVE-2020-19880](https://insights.sbomify.com/CVE-2020-19880/): Cross-site scripting in dbhcms project:dbhcms (medium 6.1)
- [CVE-2020-1988](https://insights.sbomify.com/CVE-2020-1988/): Global Protect Agent: Local privilege escalation due to an unquoted search path vulnerability (medium 4.2)
- [CVE-2020-19879](https://insights.sbomify.com/CVE-2020-19879/): Cross-site scripting in dbhcms project:dbhcms (medium 6.1)
- [CVE-2020-19878](https://insights.sbomify.com/CVE-2020-19878/): Information disclosure in dbhcms project:dbhcms (high 7.5)
- [CVE-2020-19877](https://insights.sbomify.com/CVE-2020-19877/): Path traversal in dbhcms project:dbhcms (medium 5.3)
- [CVE-2020-1987](https://insights.sbomify.com/CVE-2020-1987/): Global Protect Agent: VPN cookie local information disclosure (low 3.9)
- [CVE-2020-19861](https://insights.sbomify.com/CVE-2020-19861/): Memory corruption in nlnetlabs:ldns (high 7.5)
- [CVE-2020-19860](https://insights.sbomify.com/CVE-2020-19860/): Memory corruption in nlnetlabs:ldns (medium 6.5)
- [CVE-2020-1986](https://insights.sbomify.com/CVE-2020-1986/): Secdo: Local authenticated users can cause Windows system crash (medium 5.5)
- [CVE-2020-19858](https://insights.sbomify.com/CVE-2020-19858/): Path traversal in plutinosoft:platinum (high 7.5)
- [CVE-2020-19855](https://insights.sbomify.com/CVE-2020-19855/): Cross-site scripting in phpwcms:phpwcms (medium 6.1)
- [CVE-2020-19853](https://insights.sbomify.com/CVE-2020-19853/): SQL injection in bluecms project:bluecms (critical 9.8)
- [CVE-2020-19850](https://insights.sbomify.com/CVE-2020-19850/): Directus API vulnerable to denial of service (medium 6.5)
- [CVE-2020-1985](https://insights.sbomify.com/CVE-2020-1985/): Secdo: Incorrect Default Permissions (high 7.8)
- [CVE-2020-1984](https://insights.sbomify.com/CVE-2020-1984/): Secdo: Privilege escalation via hardcoded script path (high 7.8)
- [CVE-2020-1983](https://insights.sbomify.com/CVE-2020-1983/): libslirp: use after free vulnerability cause a denial of service. (high 7.5)
- [CVE-2020-19825](https://insights.sbomify.com/CVE-2020-19825/): Cross-site Scripting in kimai/kimai (critical 9.6)
- [CVE-2020-19824](https://insights.sbomify.com/CVE-2020-19824/): Race condition in mpv:mpv (high 7.0)
- [CVE-2020-19822](https://insights.sbomify.com/CVE-2020-19822/): Code injection in zzcms:zzcms (high 7.2)
- [CVE-2020-19821](https://insights.sbomify.com/CVE-2020-19821/): SQL injection in wdoyo:doyocms (high 8.8)
- [CVE-2020-1982](https://insights.sbomify.com/CVE-2020-1982/): PAN-OS: TLS 1.0 usage for certain communications with Palo Alto Networks cloud delivered services (medium 4.8)
- [CVE-2020-1981](https://insights.sbomify.com/CVE-2020-1981/): PAN-OS: Predictable temporary filename vulnerability allows local privilege escalation (high 7.0)
- [CVE-2020-19803](https://insights.sbomify.com/CVE-2020-19803/): Cross-site request forgery in doyocms project:doyocms (high 8.8)
- [CVE-2020-19802](https://insights.sbomify.com/CVE-2020-19802/): File upload in doyocms project:doyocms (critical 9.8)
- [CVE-2020-1980](https://insights.sbomify.com/CVE-2020-1980/): PAN-OS: Shell injection vulnerability in PAN-OS CLI allows execution of shell commands (high 7.8)
- [CVE-2020-1979](https://insights.sbomify.com/CVE-2020-1979/): PAN-OS: A format string vulnerability in PAN-OS log daemon (logd) on Panorama allows local privilege escalation (high 8.1)
- [CVE-2020-19786](https://insights.sbomify.com/CVE-2020-19786/): File upload in cszcms:csz cms (high 8.8)
- [CVE-2020-1978](https://insights.sbomify.com/CVE-2020-1978/): VM-Series on Microsoft Azure: Inadvertent collection of credentials in Tech support files on HA configured VMs (medium 5.8)
- [CVE-2020-19778](https://insights.sbomify.com/CVE-2020-19778/): Missing authorization in shopxo:shopxo (critical 9.8)
- [CVE-2020-19770](https://insights.sbomify.com/CVE-2020-19770/): Cross-site scripting in wuzhicms:wuzhicms (medium 5.4)
- [CVE-2020-1977](https://insights.sbomify.com/CVE-2020-1977/): Expedition Migration Tool: Insufficient Cross Site Request Forgery protection. (high 7.5)
- [CVE-2020-19769](https://insights.sbomify.com/CVE-2020-19769/): Business logic in rtb1 project:rtb1 (high 7.5)
- [CVE-2020-19768](https://insights.sbomify.com/CVE-2020-19768/): Business logic in tokensale project:tokensale (high 7.5)
- [CVE-2020-19767](https://insights.sbomify.com/CVE-2020-19767/): Business logic in zeroxracer project:zeroxracer (high 7.5)
- [CVE-2020-19766](https://insights.sbomify.com/CVE-2020-19766/): Business logic in tokenerc20 project:tokenerc20 (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/137/