# Vulnerabilities published in 2020


- [CVE-2020-19765](https://insights.sbomify.com/CVE-2020-19765/): Race condition in proofofdiligencetoken project:proofofdiligencetoken (high 7.5)
- [CVE-2020-19762](https://insights.sbomify.com/CVE-2020-19762/): Cross-site scripting in carrier:webctrl system (medium 6.1)
- [CVE-2020-1976](https://insights.sbomify.com/CVE-2020-1976/): GlobalProtect on MacOS: Local denial-of-service (DoS) vulnerability. (medium 4.7)
- [CVE-2020-19752](https://insights.sbomify.com/CVE-2020-19752/): Null dereference in fedoraproject:fedora (high 7.5)
- [CVE-2020-19751](https://insights.sbomify.com/CVE-2020-19751/): Memory corruption in gpac:gpac (critical 9.1)
- [CVE-2020-19750](https://insights.sbomify.com/CVE-2020-19750/): Memory corruption in gpac:gpac (high 7.5)
- [CVE-2020-1975](https://insights.sbomify.com/CVE-2020-1975/): Missing XML Validation in PAN-OS Web Interface (medium 6.8)
- [CVE-2020-19726](https://insights.sbomify.com/CVE-2020-19726/): Memory corruption in gnu:binutils (high 8.8)
- [CVE-2020-19725](https://insights.sbomify.com/CVE-2020-19725/): Use after free in microsoft:z3 (high 7.8)
- [CVE-2020-19724](https://insights.sbomify.com/CVE-2020-19724/): Denial of service in gnu:binutils (medium 5.5)
- [CVE-2020-19722](https://insights.sbomify.com/CVE-2020-19722/): Null dereference in axiosys:bento4 (medium 6.5)
- [CVE-2020-19721](https://insights.sbomify.com/CVE-2020-19721/): Memory corruption in axiosys:bento4 (medium 6.5)
- [CVE-2020-19720](https://insights.sbomify.com/CVE-2020-19720/): Null dereference in axiosys:bento4 (medium 6.5)
- [CVE-2020-19719](https://insights.sbomify.com/CVE-2020-19719/): Memory corruption in axiosys:bento4 (medium 6.5)
- [CVE-2020-19718](https://insights.sbomify.com/CVE-2020-19718/): Null dereference in axiosys:bento4 (medium 6.5)
- [CVE-2020-19717](https://insights.sbomify.com/CVE-2020-19717/): Null dereference in axiosys:bento4 (medium 6.5)
- [CVE-2020-19716](https://insights.sbomify.com/CVE-2020-19716/): Memory corruption in debian:debian linux (medium 6.5)
- [CVE-2020-1971](https://insights.sbomify.com/CVE-2020-1971/): EDIPARTYNAME NULL pointer dereference (medium 5.9)
- [CVE-2020-19709](https://insights.sbomify.com/CVE-2020-19709/): Cross-site scripting in feehicms (medium 6.1)
- [CVE-2020-19705](https://insights.sbomify.com/CVE-2020-19705/): SQL injection in thinkphp-zcms project:thinkphp-zcms (critical 9.8)
- [CVE-2020-19704](https://insights.sbomify.com/CVE-2020-19704/): Cross-site scripting in spring-boot-admin project:spring-boot-admin (medium 5.4)
- [CVE-2020-19703](https://insights.sbomify.com/CVE-2020-19703/): Cross-site scripting in dzzoffice:dzzoffice (medium 6.1)
- [CVE-2020-19699](https://insights.sbomify.com/CVE-2020-19699/): Cross-site scripting in kiftd project:kiftd (medium 6.1)
- [CVE-2020-19698](https://insights.sbomify.com/CVE-2020-19698/): Pandao Editor.md vulnerable to cross-site scripting (XSS) in editor parameter (medium 6.1)
- [CVE-2020-19697](https://insights.sbomify.com/CVE-2020-19697/): Pandao Editor.md vulnerable to cross-site scripting (XSS) in iframe src parameter (medium 6.1)
- [CVE-2020-19695](https://insights.sbomify.com/CVE-2020-19695/): Memory corruption in f5:njs (critical 9.8)
- [CVE-2020-19693](https://insights.sbomify.com/CVE-2020-19693/): Memory corruption in espruino:espruino (critical 9.8)
- [CVE-2020-19692](https://insights.sbomify.com/CVE-2020-19692/): Memory corruption in f5:njs (critical 9.8)
- [CVE-2020-19683](https://insights.sbomify.com/CVE-2020-19683/): Cross-site scripting in zzzcms:zzzcms (medium 5.4)
- [CVE-2020-19682](https://insights.sbomify.com/CVE-2020-19682/): Cross-site request forgery in zzzcms:zzzcms (high 8.8)
- [CVE-2020-1968](https://insights.sbomify.com/CVE-2020-1968/): Raccoon attack (low 3.7)
- [CVE-2020-19678](https://insights.sbomify.com/CVE-2020-19678/): Path traversal in oisf:suricata (high 7.5)
- [CVE-2020-19676](https://insights.sbomify.com/CVE-2020-19676/): Incorrect Access Control in Nacos (medium 5.3)
- [CVE-2020-19672](https://insights.sbomify.com/CVE-2020-19672/): File upload in niushop:niushop (critical 9.8)
- [CVE-2020-19670](https://insights.sbomify.com/CVE-2020-19670/): Auth bypass in niushop:niushop (medium 4.9)
- [CVE-2020-1967](https://insights.sbomify.com/CVE-2020-1967/): Segmentation fault in SSL_check_chain (high 7.5)
- [CVE-2020-19669](https://insights.sbomify.com/CVE-2020-19669/): Cross-site request forgery in eyoucms:eyoucms (high 8.8)
- [CVE-2020-19668](https://insights.sbomify.com/CVE-2020-19668/): Memory corruption in saitoha:libsixel (medium 6.5)
- [CVE-2020-19667](https://insights.sbomify.com/CVE-2020-19667/): Memory corruption in debian:debian linux (high 7.8)
- [CVE-2020-19664](https://insights.sbomify.com/CVE-2020-19664/): Command injection in draytek:vigor2960 firmware (high 8.8)
- [CVE-2020-19660](https://insights.sbomify.com/CVE-2020-19660/): Cross-site scripting in ipandao:editor.md (medium 6.1)
- [CVE-2020-19643](https://insights.sbomify.com/CVE-2020-19643/): Cross-site scripting in insma:wifi mini spy 1080p hd security ip camera firmware (medium 6.1)
- [CVE-2020-19642](https://insights.sbomify.com/CVE-2020-19642/): File upload in insma:wifi mini spy 1080p hd security ip camera firmware (medium 6.2)
- [CVE-2020-19641](https://insights.sbomify.com/CVE-2020-19641/): Privilege escalation in insma:wifi mini spy 1080p hd security ip camera firmware (high 8.8)
- [CVE-2020-19640](https://insights.sbomify.com/CVE-2020-19640/): Missing authorization in insma:wifi mini spy 1080p hd security ip camera firmware (high 7.5)
- [CVE-2020-1964](https://insights.sbomify.com/CVE-2020-1964/): Deserialization of Untrusted Data in Apache Heron (critical 9.8)
- [CVE-2020-19639](https://insights.sbomify.com/CVE-2020-19639/): Cross-site request forgery in insma:wifi mini spy 1080p hd security ip camera firmware (high 8.8)
- [CVE-2020-1963](https://insights.sbomify.com/CVE-2020-1963/): File system access via H2 in Apache Ignite (critical 9.1)
- [CVE-2020-19626](https://insights.sbomify.com/CVE-2020-19626/): Craft CMS Cross-site Scripting Vulnerability (medium 5.4)
- [CVE-2020-19625](https://insights.sbomify.com/CVE-2020-19625/): Code injection in gridx project:gridx (critical 9.8)
- [CVE-2020-19619](https://insights.sbomify.com/CVE-2020-19619/): Cross-site scripting in mblog project:mblog (medium 5.4)
- [CVE-2020-19618](https://insights.sbomify.com/CVE-2020-19618/): Cross-site scripting in mblog project:mblog (medium 5.4)
- [CVE-2020-19617](https://insights.sbomify.com/CVE-2020-19617/): Cross-site scripting in mblog project:mblog (medium 5.4)
- [CVE-2020-19616](https://insights.sbomify.com/CVE-2020-19616/): Cross-site scripting in mblog project:mblog (medium 5.4)
- [CVE-2020-19613](https://insights.sbomify.com/CVE-2020-19613/): Server-side request forgery in flycms project:flycms (high 7.5)
- [CVE-2020-19611](https://insights.sbomify.com/CVE-2020-19611/): Cross-site scripting in racktables project:racktables (medium 6.1)
- [CVE-2020-1961](https://insights.sbomify.com/CVE-2020-1961/): Injection in Apache Syncope (critical 9.8)
- [CVE-2020-19609](https://insights.sbomify.com/CVE-2020-19609/): Memory corruption in artifex:mupdf (medium 5.5)
- [CVE-2020-1960](https://insights.sbomify.com/CVE-2020-1960/): Command injection in Apache Flink (medium 4.7)
- [CVE-2020-19596](https://insights.sbomify.com/CVE-2020-19596/): Memory corruption in coreftp:core ftp (critical 9.8)
- [CVE-2020-19595](https://insights.sbomify.com/CVE-2020-19595/): Memory corruption in coreftp:core ftp (high 7.5)
- [CVE-2020-1959](https://insights.sbomify.com/CVE-2020-1959/): Expression Language Injection in Apache Syncope (critical 9.8)
- [CVE-2020-19587](https://insights.sbomify.com/CVE-2020-19587/): Cross-site scripting in idera:yellowfin business intelligence (medium 5.4)
- [CVE-2020-19586](https://insights.sbomify.com/CVE-2020-19586/): Privilege escalation in yellowfinbi:business intelligence (critical 9.0)
- [CVE-2020-1958](https://insights.sbomify.com/CVE-2020-1958/): Credentials bypass in Apache Druid (medium 6.5)
- [CVE-2020-1957](https://insights.sbomify.com/CVE-2020-1957/): Improper Authentication in Apache Shiro (critical 9.8)
- [CVE-2020-1956](https://insights.sbomify.com/CVE-2020-1956/): Apache Kylin OS Command Injection (high 8.8, exploited in the wild)
- [CVE-2020-19559](https://insights.sbomify.com/CVE-2020-19559/): Deserialization in dieboldnixdorf:agilis xfs for opteva (critical 9.8)
- [CVE-2020-19554](https://insights.sbomify.com/CVE-2020-19554/): Cross-site scripting in manageengine:opmanager (medium 6.1)
- [CVE-2020-19553](https://insights.sbomify.com/CVE-2020-19553/): Cross-site scripting in wuzhicms:wuzhicms (medium 5.4)
- [CVE-2020-19551](https://insights.sbomify.com/CVE-2020-19551/): File upload in wuzhicms:wuzhicms (high 8.8)
- [CVE-2020-1955](https://insights.sbomify.com/CVE-2020-1955/): Auth bypass in Apache CouchDB (critical 9.8)
- [CVE-2020-19547](https://insights.sbomify.com/CVE-2020-19547/): Path traversal in popojicms:popojicms (medium 6.5)
- [CVE-2020-1954](https://insights.sbomify.com/CVE-2020-1954/): Apache CXF JMX Integration is vulnerable to a MITM attack (medium 5.3)
- [CVE-2020-1953](https://insights.sbomify.com/CVE-2020-1953/): Remote code execution in Apache Commons Configuration (critical 10.0)
- [CVE-2020-19527](https://insights.sbomify.com/CVE-2020-19527/): Command injection in idreamsoft:icms (critical 9.8)
- [CVE-2020-1952](https://insights.sbomify.com/CVE-2020-1952/): Improper Certificate Validation in Apache IoTDB (critical 9.8)
- [CVE-2020-19515](https://insights.sbomify.com/CVE-2020-19515/): Cross-site scripting in qdpm:qdpm (medium 6.1)
- [CVE-2020-19513](https://insights.sbomify.com/CVE-2020-19513/): Memory corruption in aida64:aida64 (high 7.8)
- [CVE-2020-19511](https://insights.sbomify.com/CVE-2020-19511/): Cross-site scripting in typesettercms:typesetter (medium 6.1)
- [CVE-2020-19510](https://insights.sbomify.com/CVE-2020-19510/): File upload in textpattern:textpattern (critical 9.8)
- [CVE-2020-1951](https://insights.sbomify.com/CVE-2020-1951/): Infinite Loop in Apache Tika (medium 5.5)
- [CVE-2020-1950](https://insights.sbomify.com/CVE-2020-1950/): Uncontrolled Resource Consumption in Apache Tika (medium 5.5)
- [CVE-2020-19499](https://insights.sbomify.com/CVE-2020-19499/): Memory corruption in struktur:libheif (high 8.8)
- [CVE-2020-19498](https://insights.sbomify.com/CVE-2020-19498/): Denial of service in struktur:libheif (high 8.8)
- [CVE-2020-19497](https://insights.sbomify.com/CVE-2020-19497/): Integer overflow in matio project:matio (high 8.8)
- [CVE-2020-19492](https://insights.sbomify.com/CVE-2020-19492/): Denial of service in sam2p project:sam2p (high 7.8)
- [CVE-2020-19491](https://insights.sbomify.com/CVE-2020-19491/): Memory corruption in sam2p project:sam2p (high 7.8)
- [CVE-2020-19490](https://insights.sbomify.com/CVE-2020-19490/): Integer overflow in tinyexr project:tinyexr (medium 5.5)
- [CVE-2020-1949](https://insights.sbomify.com/CVE-2020-1949/): Cross-site scripting in Apache Sling (medium 6.1)
- [CVE-2020-19488](https://insights.sbomify.com/CVE-2020-19488/): Null dereference in gpac:gpac (medium 5.5)
- [CVE-2020-19481](https://insights.sbomify.com/CVE-2020-19481/): Memory corruption in gpac:gpac (medium 5.5)
- [CVE-2020-1948](https://insights.sbomify.com/CVE-2020-1948/): Deserialization of Untrusted Data in Apache Dubbo (critical 9.8)
- [CVE-2020-19475](https://insights.sbomify.com/CVE-2020-19475/): Memory corruption in flowpaper:pdf2json (medium 5.5)
- [CVE-2020-19474](https://insights.sbomify.com/CVE-2020-19474/): Use after free in flowpaper:pdf2json (medium 5.5)
- [CVE-2020-19473](https://insights.sbomify.com/CVE-2020-19473/): Denial of service in flowpaper:pdf2json (medium 5.5)
- [CVE-2020-19472](https://insights.sbomify.com/CVE-2020-19472/): Memory corruption in flowpaper:pdf2json (medium 5.5)
- [CVE-2020-19471](https://insights.sbomify.com/CVE-2020-19471/): Memory corruption in flowpaper:pdf2json (medium 5.5)
- [CVE-2020-19470](https://insights.sbomify.com/CVE-2020-19470/): Null dereference in flowpaper:pdf2json (medium 5.5)
- [CVE-2020-1947](https://insights.sbomify.com/CVE-2020-1947/): Deserialization of Untrusted Data in Apache ShardingSphere (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/138/