# Vulnerabilities published in 2020


- [CVE-2020-19469](https://insights.sbomify.com/CVE-2020-19469/): Memory corruption in flowpaper:pdf2json (medium 5.5)
- [CVE-2020-19468](https://insights.sbomify.com/CVE-2020-19468/): Null dereference in flowpaper:pdf2json (medium 5.5)
- [CVE-2020-19467](https://insights.sbomify.com/CVE-2020-19467/): Use after free in flowpaper:pdf2json (medium 5.5)
- [CVE-2020-19466](https://insights.sbomify.com/CVE-2020-19466/): Memory corruption in flowpaper:pdf2json (medium 5.5)
- [CVE-2020-19465](https://insights.sbomify.com/CVE-2020-19465/): Memory corruption in flowpaper:pdf2json (medium 5.5)
- [CVE-2020-19464](https://insights.sbomify.com/CVE-2020-19464/): Denial of service in flowpaper:pdf2json (medium 5.5)
- [CVE-2020-19463](https://insights.sbomify.com/CVE-2020-19463/): Denial of service in flowpaper:pdf2json (medium 5.5)
- [CVE-2020-1946](https://insights.sbomify.com/CVE-2020-1946/): Apache SpamAssassin has an OS Command Injection vulnerability (critical 9.8)
- [CVE-2020-19455](https://insights.sbomify.com/CVE-2020-19455/): SQL injection in jdownloads:jdownloads (high 7.5)
- [CVE-2020-19451](https://insights.sbomify.com/CVE-2020-19451/): SQL injection in jdownloads:jdownloads (high 7.5)
- [CVE-2020-19450](https://insights.sbomify.com/CVE-2020-19450/): SQL injection in jdownloads:jdownloads (high 7.5)
- [CVE-2020-1945](https://insights.sbomify.com/CVE-2020-1945/): Sensitive Data Exposure in Apache Ant (medium 6.3)
- [CVE-2020-19447](https://insights.sbomify.com/CVE-2020-19447/): SQL injection in jdownloads:jdownloads (high 7.5)
- [CVE-2020-1944](https://insights.sbomify.com/CVE-2020-1944/): Other in Apache Traffic Server (critical 9.8)
- [CVE-2020-1943](https://insights.sbomify.com/CVE-2020-1943/): Cross-site scripting in Apache OFBiz (medium 6.1)
- [CVE-2020-1942](https://insights.sbomify.com/CVE-2020-1942/): Insertion of Sensitive Information into Log File in Apache NiFi (high 7.5)
- [CVE-2020-19419](https://insights.sbomify.com/CVE-2020-19419/): Missing authorization in emerson:smart wireless gateway 1420 firmware (high 7.5)
- [CVE-2020-19417](https://insights.sbomify.com/CVE-2020-19417/): Privilege escalation in emerson:wireless 1420 gateway firmware (high 8.8)
- [CVE-2020-1941](https://insights.sbomify.com/CVE-2020-1941/): Apache ActiveMQ webconsole admin GUI is open to XSS (medium 6.1)
- [CVE-2020-1940](https://insights.sbomify.com/CVE-2020-1940/): Improper Removal of Sensitive Information Before Storage or Transfer in Apache Jackrabbit Oak (high 7.5)
- [CVE-2020-1939](https://insights.sbomify.com/CVE-2020-1939/): Null dereference in Apache NuttX (incubating) (critical 9.8)
- [CVE-2020-1938](https://insights.sbomify.com/CVE-2020-1938/): Apache Tomcat Improper Privilege Management (critical 9.8, exploited in the wild)
- [CVE-2020-1937](https://insights.sbomify.com/CVE-2020-1937/): SQL Injection in Kylin (high 8.8)
- [CVE-2020-19364](https://insights.sbomify.com/CVE-2020-19364/): File upload in open-emr:openemr (high 8.8)
- [CVE-2020-19363](https://insights.sbomify.com/CVE-2020-19363/): Information disclosure in vtiger:vtiger crm (medium 6.5)
- [CVE-2020-19362](https://insights.sbomify.com/CVE-2020-19362/): Cross-site scripting in vtiger:vtiger crm (medium 6.1)
- [CVE-2020-19361](https://insights.sbomify.com/CVE-2020-19361/): Cross-site scripting in medintux:medintux (medium 6.1)
- [CVE-2020-19360](https://insights.sbomify.com/CVE-2020-19360/): Path traversal in fhem:fhem (high 7.5)
- [CVE-2020-1936](https://insights.sbomify.com/CVE-2020-1936/): Stored XSS in Apache Ambari (medium 6.1)
- [CVE-2020-1935](https://insights.sbomify.com/CVE-2020-1935/): Potential HTTP request smuggling in Apache Tomcat (medium 4.8)
- [CVE-2020-1934](https://insights.sbomify.com/CVE-2020-1934/): Information disclosure in Apache HTTP Server (medium 5.3)
- [CVE-2020-1933](https://insights.sbomify.com/CVE-2020-1933/): Cross-site scripting in Apache NiFi (medium 6.1)
- [CVE-2020-19323](https://insights.sbomify.com/CVE-2020-19323/): Memory corruption in dlink:dir-619l firmware (high 7.5)
- [CVE-2020-19320](https://insights.sbomify.com/CVE-2020-19320/): Memory corruption in dlink:dir-619l firmware (critical 9.8)
- [CVE-2020-1932](https://insights.sbomify.com/CVE-2020-1932/): Information disclosure in Apache Superset (medium 6.5)
- [CVE-2020-19319](https://insights.sbomify.com/CVE-2020-19319/): Memory corruption in dlink:dir-619l firmware (critical 9.8)
- [CVE-2020-19318](https://insights.sbomify.com/CVE-2020-19318/): Memory corruption in dlink:dir-605l firmware (high 8.8)
- [CVE-2020-19316](https://insights.sbomify.com/CVE-2020-19316/): OS Command Injection in Laravel Framework (high 8.8)
- [CVE-2020-1931](https://insights.sbomify.com/CVE-2020-1931/): Command injection in Apache SpamAssassin (high 8.1)
- [CVE-2020-19305](https://insights.sbomify.com/CVE-2020-19305/): Path traversal in metinfo:metinfo (critical 9.8)
- [CVE-2020-19304](https://insights.sbomify.com/CVE-2020-19304/): Path traversal in metinfo:metinfo (high 7.5)
- [CVE-2020-19303](https://insights.sbomify.com/CVE-2020-19303/): File upload in houdunren:hdcms (high 7.8)
- [CVE-2020-19302](https://insights.sbomify.com/CVE-2020-19302/): File upload in vaethink:vaethink (critical 9.8)
- [CVE-2020-19301](https://insights.sbomify.com/CVE-2020-19301/): SQL injection in vaethink:vaethink (critical 9.8)
- [CVE-2020-1930](https://insights.sbomify.com/CVE-2020-1930/): Command injection in Apache SpamAssassin (high 8.1)
- [CVE-2020-19295](https://insights.sbomify.com/CVE-2020-19295/): Cross-site scripting in jeesns:jeesns (medium 6.1)
- [CVE-2020-19294](https://insights.sbomify.com/CVE-2020-19294/): Cross-site scripting in jeesns:jeesns (medium 5.4)
- [CVE-2020-19293](https://insights.sbomify.com/CVE-2020-19293/): Cross-site scripting in jeesns:jeesns (medium 5.4)
- [CVE-2020-19292](https://insights.sbomify.com/CVE-2020-19292/): Cross-site scripting in jeesns:jeesns (medium 5.4)
- [CVE-2020-19291](https://insights.sbomify.com/CVE-2020-19291/): Cross-site scripting in jeesns:jeesns (medium 5.4)
- [CVE-2020-19290](https://insights.sbomify.com/CVE-2020-19290/): Cross-site scripting in jeesns:jeesns (medium 5.4)
- [CVE-2020-1929](https://insights.sbomify.com/CVE-2020-1929/): Improper Certificate Validation in Apache Beam (high 7.5)
- [CVE-2020-19289](https://insights.sbomify.com/CVE-2020-19289/): Cross-site scripting in jeesns:jeesns (medium 5.4)
- [CVE-2020-19288](https://insights.sbomify.com/CVE-2020-19288/): Cross-site scripting in jeesns:jeesns (medium 5.4)
- [CVE-2020-19287](https://insights.sbomify.com/CVE-2020-19287/): Cross-site scripting in jeesns:jeesns (medium 5.4)
- [CVE-2020-19286](https://insights.sbomify.com/CVE-2020-19286/): Cross-site scripting in jeesns:jeesns (medium 5.4)
- [CVE-2020-19285](https://insights.sbomify.com/CVE-2020-19285/): Cross-site scripting in jeesns:jeesns (medium 5.4)
- [CVE-2020-19284](https://insights.sbomify.com/CVE-2020-19284/): Cross-site scripting in jeesns:jeesns (medium 5.4)
- [CVE-2020-19283](https://insights.sbomify.com/CVE-2020-19283/): Cross-site scripting in jeesns:jeesns (medium 6.1)
- [CVE-2020-19282](https://insights.sbomify.com/CVE-2020-19282/): Cross-site scripting in jeesns:jeesns (medium 6.1)
- [CVE-2020-19281](https://insights.sbomify.com/CVE-2020-19281/): Cross-site scripting in jeesns:jeesns (medium 5.4)
- [CVE-2020-19280](https://insights.sbomify.com/CVE-2020-19280/): Cross-site request forgery in jeesns:jeesns (high 8.8)
- [CVE-2020-1928](https://insights.sbomify.com/CVE-2020-1928/): Apache NiFi Insertion of Sensitive Information into Log File (medium 5.3)
- [CVE-2020-19279](https://insights.sbomify.com/CVE-2020-19279/): Path traversal in wide project:wide (critical 9.8)
- [CVE-2020-19278](https://insights.sbomify.com/CVE-2020-19278/): Phachon mm-wiki Cross Site Request Forgery vulnerability (high 8.8)
- [CVE-2020-19277](https://insights.sbomify.com/CVE-2020-19277/): Phachon mm-wiki vulnerable to stored cross-site scripting (XSS) (medium 5.4)
- [CVE-2020-19275](https://insights.sbomify.com/CVE-2020-19275/): Information disclosure in dhcms project:dhcms (medium 5.3)
- [CVE-2020-19274](https://insights.sbomify.com/CVE-2020-19274/): Cross-site scripting in dhcms project:dhcms (medium 6.1)
- [CVE-2020-1927](https://insights.sbomify.com/CVE-2020-1927/): Open redirect in Apache HTTP Server (medium 6.1)
- [CVE-2020-19268](https://insights.sbomify.com/CVE-2020-19268/): Cross-site request forgery in dswjcms project:dswjcms (medium 5.7)
- [CVE-2020-19267](https://insights.sbomify.com/CVE-2020-19267/): File upload in dswjcms project:dswjcms (critical 9.8)
- [CVE-2020-19266](https://insights.sbomify.com/CVE-2020-19266/): Cross-site scripting in dswjcms project:dswjcms (medium 6.1)
- [CVE-2020-19265](https://insights.sbomify.com/CVE-2020-19265/): Cross-site scripting in dswjcms project:dswjcms (medium 6.1)
- [CVE-2020-19264](https://insights.sbomify.com/CVE-2020-19264/): Cross-site request forgery in mipcms:mipcms (medium 6.5)
- [CVE-2020-19263](https://insights.sbomify.com/CVE-2020-19263/): Cross-site request forgery in mipcms:mipcms (high 8.8)
- [CVE-2020-1926](https://insights.sbomify.com/CVE-2020-1926/): Timing attack in Cookie signature verification (medium 5.9)
- [CVE-2020-1925](https://insights.sbomify.com/CVE-2020-1925/): Server-Side Request Forgery (SSRF) in Apache Olingo (high 7.5)
- [CVE-2020-19248](https://insights.sbomify.com/CVE-2020-19248/): Code injection in pbootcms:pbootcms (medium 5.1)
- [CVE-2020-19229](https://insights.sbomify.com/CVE-2020-19229/): Deserialization in jeesite:jeesite (critical 9.8)
- [CVE-2020-19228](https://insights.sbomify.com/CVE-2020-19228/): File upload in bludit:bludit (high 7.2)
- [CVE-2020-19217](https://insights.sbomify.com/CVE-2020-19217/): SQL injection in piwigo:piwigo (high 8.8)
- [CVE-2020-19216](https://insights.sbomify.com/CVE-2020-19216/): SQL injection in piwigo:piwigo (high 8.8)
- [CVE-2020-19215](https://insights.sbomify.com/CVE-2020-19215/): SQL injection in piwigo:piwigo (high 8.8)
- [CVE-2020-19213](https://insights.sbomify.com/CVE-2020-19213/): SQL injection in piwigo:piwigo (critical 9.8)
- [CVE-2020-19212](https://insights.sbomify.com/CVE-2020-19212/): SQL injection in piwigo:piwigo (medium 4.9)
- [CVE-2020-1921](https://insights.sbomify.com/CVE-2020-1921/): Memory corruption in HHVM (high 7.5)
- [CVE-2020-19204](https://insights.sbomify.com/CVE-2020-19204/): Cross-site scripting in ipfire:ipfire (medium 5.4)
- [CVE-2020-19203](https://insights.sbomify.com/CVE-2020-19203/): Cross-site scripting in netgate:pfsense (medium 5.4)
- [CVE-2020-19202](https://insights.sbomify.com/CVE-2020-19202/): Cross-site scripting in ipfire:ipfire (medium 5.4)
- [CVE-2020-19201](https://insights.sbomify.com/CVE-2020-19201/): Cross-site scripting in netgate:pfsense (medium 5.4)
- [CVE-2020-1920](https://insights.sbomify.com/CVE-2020-1920/): Regular expression denial of service in react-native (high 7.5)
- [CVE-2020-19199](https://insights.sbomify.com/CVE-2020-19199/): Cross-site request forgery in phpok:phpok (high 8.8)
- [CVE-2020-19190](https://insights.sbomify.com/CVE-2020-19190/): Memory corruption in invisible-island:ncurses (medium 6.5)
- [CVE-2020-1919](https://insights.sbomify.com/CVE-2020-1919/): Memory corruption in HHVM (high 7.5)
- [CVE-2020-19189](https://insights.sbomify.com/CVE-2020-19189/): Memory corruption in debian:debian linux (medium 6.5)
- [CVE-2020-19188](https://insights.sbomify.com/CVE-2020-19188/): Memory corruption in invisible-island:ncurses (medium 6.5)
- [CVE-2020-19187](https://insights.sbomify.com/CVE-2020-19187/): Memory corruption in invisible-island:ncurses (medium 6.5)
- [CVE-2020-19186](https://insights.sbomify.com/CVE-2020-19186/): Memory corruption in invisible-island:ncurses (medium 6.5)
- [CVE-2020-19185](https://insights.sbomify.com/CVE-2020-19185/): Memory corruption in invisible-island:ncurses (medium 6.5)
- [CVE-2020-1918](https://insights.sbomify.com/CVE-2020-1918/): Memory corruption in HHVM (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/139/