# Vulnerabilities published in 2020 - [CVE-2020-1917](https://insights.sbomify.com/CVE-2020-1917/): Memory corruption in HHVM (critical 9.8) - [CVE-2020-19165](https://insights.sbomify.com/CVE-2020-19165/): SQL injection in phpshe:phpshe (critical 9.8) - [CVE-2020-1916](https://insights.sbomify.com/CVE-2020-1916/): Integer overflow in HHVM (critical 9.8) - [CVE-2020-19159](https://insights.sbomify.com/CVE-2020-19159/): Cross-site request forgery in laiketui:laiketui (high 8.8) - [CVE-2020-19158](https://insights.sbomify.com/CVE-2020-19158/): Cross-site scripting in s-cms:s-cms (medium 5.4) - [CVE-2020-19157](https://insights.sbomify.com/CVE-2020-19157/): Cross-site scripting in wenkucms project:wenkucms (medium 6.1) - [CVE-2020-19156](https://insights.sbomify.com/CVE-2020-19156/): Cross-site scripting in ari-soft:ari adminer (medium 5.4) - [CVE-2020-19155](https://insights.sbomify.com/CVE-2020-19155/): Missing authorization in jflyfox:jfinal cms (high 8.8) - [CVE-2020-19154](https://insights.sbomify.com/CVE-2020-19154/): Path traversal in jflyfox:jfinal cms (medium 6.5) - [CVE-2020-19151](https://insights.sbomify.com/CVE-2020-19151/): Command injection in jflyfox:jfinal cms (high 8.8) - [CVE-2020-19150](https://insights.sbomify.com/CVE-2020-19150/): Path traversal in jflyfox:jfinal cms (high 8.1) - [CVE-2020-1915](https://insights.sbomify.com/CVE-2020-1915/): Out-of-bounds Read in Facebook Hermes (high 7.5) - [CVE-2020-19148](https://insights.sbomify.com/CVE-2020-19148/): Cross-site scripting in jflyfox:jfinal cms (medium 5.4) - [CVE-2020-19147](https://insights.sbomify.com/CVE-2020-19147/): Path traversal in jflyfox:jfinal cms (medium 6.5) - [CVE-2020-19146](https://insights.sbomify.com/CVE-2020-19146/): Path traversal in jflyfox:jfinal cms (medium 6.5) - [CVE-2020-19144](https://insights.sbomify.com/CVE-2020-19144/): Memory corruption in debian:debian linux (medium 6.5) - [CVE-2020-19143](https://insights.sbomify.com/CVE-2020-19143/): Memory corruption in debian:debian linux (medium 6.5) - [CVE-2020-19142](https://insights.sbomify.com/CVE-2020-19142/): Command injection in idreamsoft:icms (critical 9.8) - [CVE-2020-1914](https://insights.sbomify.com/CVE-2020-1914/): Always-Incorrect Control Flow Implementation in Facebook Hermes (critical 9.8) - [CVE-2020-19138](https://insights.sbomify.com/CVE-2020-19138/): File upload in dotcms:dotcms (critical 9.8) - [CVE-2020-19137](https://insights.sbomify.com/CVE-2020-19137/): Missing authorization in autumn project:autumn (high 7.5) - [CVE-2020-19131](https://insights.sbomify.com/CVE-2020-19131/): Memory corruption in debian:debian linux (high 7.5) - [CVE-2020-1913](https://insights.sbomify.com/CVE-2020-1913/): Signed to Unsigned Conversion Error in Facebook Hermes (high 8.1) - [CVE-2020-1912](https://insights.sbomify.com/CVE-2020-1912/): Out-of-bounds Read and Out-of-bounds Write in Facebook Hermes (high 8.1) - [CVE-2020-19118](https://insights.sbomify.com/CVE-2020-19118/): Cross-site scripting in yzmcms:yzmcms (medium 5.4) - [CVE-2020-19114](https://insights.sbomify.com/CVE-2020-19114/): SQL injection in projectworlds:online book store project in php (critical 9.8) - [CVE-2020-19113](https://insights.sbomify.com/CVE-2020-19113/): File upload in projectworlds:online book store project in php (critical 9.8) - [CVE-2020-19112](https://insights.sbomify.com/CVE-2020-19112/): SQL injection in projectworlds:online book store project in php (critical 9.8) - [CVE-2020-19111](https://insights.sbomify.com/CVE-2020-19111/): Auth bypass in projectworlds:online book store project in php (critical 9.8) - [CVE-2020-19110](https://insights.sbomify.com/CVE-2020-19110/): SQL injection in projectworlds:online book store project in php (critical 9.8) - [CVE-2020-1911](https://insights.sbomify.com/CVE-2020-1911/): Access of Resource Using Incompatible Type in Facebook Hermes (critical 9.8) - [CVE-2020-19109](https://insights.sbomify.com/CVE-2020-19109/): SQL injection in projectworlds:online book store project in php (critical 9.8) - [CVE-2020-19108](https://insights.sbomify.com/CVE-2020-19108/): SQL injection in projectworlds:online book store project in php (critical 9.8) - [CVE-2020-19107](https://insights.sbomify.com/CVE-2020-19107/): SQL injection in projectworlds:online book store project in php (critical 9.8) - [CVE-2020-1910](https://insights.sbomify.com/CVE-2020-1910/): Memory corruption in WhatsApp Business for Android (high 7.8) - [CVE-2020-1909](https://insights.sbomify.com/CVE-2020-1909/): Use after free in WhatsApp Business for iOS (critical 9.8) - [CVE-2020-1908](https://insights.sbomify.com/CVE-2020-1908/): Security feature bypass in WhatsApp Business for iOS (medium 4.6) - [CVE-2020-1907](https://insights.sbomify.com/CVE-2020-1907/): Memory corruption in WhatsApp Business for Android (critical 9.8) - [CVE-2020-1906](https://insights.sbomify.com/CVE-2020-1906/): Memory corruption in WhatsApp Business for Android (high 7.8) - [CVE-2020-1905](https://insights.sbomify.com/CVE-2020-1905/): Information disclosure in WhatsApp for Android (low 3.3) - [CVE-2020-19049](https://insights.sbomify.com/CVE-2020-19049/): Cross-site scripting in mybb:mybb (medium 5.4) - [CVE-2020-19048](https://insights.sbomify.com/CVE-2020-19048/): Cross-site scripting in mybb:mybb (medium 5.4) - [CVE-2020-19047](https://insights.sbomify.com/CVE-2020-19047/): Cross-site request forgery in iwebshop:iwebshop (high 8.8) - [CVE-2020-19046](https://insights.sbomify.com/CVE-2020-19046/): Cross-site scripting in s-cms:s-cms (medium 5.4) - [CVE-2020-19042](https://insights.sbomify.com/CVE-2020-19042/): Cross-site scripting in zzcms:zzcms (medium 6.1) - [CVE-2020-1904](https://insights.sbomify.com/CVE-2020-1904/): Path traversal in WhatsApp Business for iOS (medium 5.5) - [CVE-2020-19038](https://insights.sbomify.com/CVE-2020-19038/): Missing authorization in halo:halo (critical 9.1) - [CVE-2020-19037](https://insights.sbomify.com/CVE-2020-19037/): Auth bypass in halo:halo (medium 5.3) - [CVE-2020-1903](https://insights.sbomify.com/CVE-2020-1903/): Denial of service in WhatsApp Business for iOS (medium 5.5) - [CVE-2020-19028](https://insights.sbomify.com/CVE-2020-19028/): File upload in emlog:emlog (high 7.5) - [CVE-2020-1902](https://insights.sbomify.com/CVE-2020-1902/): Information disclosure in WhatsApp Business for Android (high 7.5) - [CVE-2020-1901](https://insights.sbomify.com/CVE-2020-1901/): Denial of service in WhatsApp for iOS (medium 5.3) - [CVE-2020-19007](https://insights.sbomify.com/CVE-2020-19007/): Cross-site scripting in halo:halo (medium 5.4) - [CVE-2020-19005](https://insights.sbomify.com/CVE-2020-19005/): Missing authorization in zrlog:zrlog (medium 5.7) - [CVE-2020-19003](https://insights.sbomify.com/CVE-2020-19003/): Verification check bypass in Gate One (medium 5.3) - [CVE-2020-19002](https://insights.sbomify.com/CVE-2020-19002/): Mezzanine Cross Site Scripting (XSS) vulnerability (medium 6.1) - [CVE-2020-19001](https://insights.sbomify.com/CVE-2020-19001/): Command Injection in Simiki (critical 9.8) - [CVE-2020-19000](https://insights.sbomify.com/CVE-2020-19000/): Cross Site Scripting (XSS) in Simiki (medium 6.1) - [CVE-2020-1900](https://insights.sbomify.com/CVE-2020-1900/): Use after free in HHVM (critical 9.8) - [CVE-2020-18999](https://insights.sbomify.com/CVE-2020-18999/): Cross-site scripting in blog mini project:blog mini (medium 6.1) - [CVE-2020-18998](https://insights.sbomify.com/CVE-2020-18998/): Cross-site scripting in blog mini project:blog mini (medium 6.1) - [CVE-2020-1899](https://insights.sbomify.com/CVE-2020-1899/): Deserialization in HHVM (high 7.5) - [CVE-2020-18985](https://insights.sbomify.com/CVE-2020-18985/): Open redirect in synacor:zimbra collaboration suite (medium 6.1) - [CVE-2020-18984](https://insights.sbomify.com/CVE-2020-18984/): Cross-site scripting in synacor:zimbra collaboration suite (medium 6.1) - [CVE-2020-18982](https://insights.sbomify.com/CVE-2020-18982/): Cross-site scripting in halo:halo (medium 5.4) - [CVE-2020-18980](https://insights.sbomify.com/CVE-2020-18980/): Code injection in halo:halo (critical 9.8) - [CVE-2020-1898](https://insights.sbomify.com/CVE-2020-1898/): Denial of service in HHVM (high 7.5) - [CVE-2020-18979](https://insights.sbomify.com/CVE-2020-18979/): Cross-site scripting in halo:halo (medium 6.1) - [CVE-2020-18976](https://insights.sbomify.com/CVE-2020-18976/): Memory corruption in broadcom:tcpreplay (medium 5.5) - [CVE-2020-18974](https://insights.sbomify.com/CVE-2020-18974/): Memory corruption in nasm:netwide assembler (low 3.3) - [CVE-2020-18972](https://insights.sbomify.com/CVE-2020-18972/): Information disclosure in podofo project:podofo (medium 5.5) - [CVE-2020-18971](https://insights.sbomify.com/CVE-2020-18971/): Memory corruption in podofo project:podofo (medium 5.5) - [CVE-2020-1897](https://insights.sbomify.com/CVE-2020-1897/): Use after free in proxygen (critical 9.8) - [CVE-2020-18964](https://insights.sbomify.com/CVE-2020-18964/): Cross-site request forgery in forestblog project:forestblog (high 8.8) - [CVE-2020-1896](https://insights.sbomify.com/CVE-2020-1896/): Memory corruption in Hermes (critical 9.8) - [CVE-2020-1895](https://insights.sbomify.com/CVE-2020-1895/): Memory corruption in Instagram for Android (high 7.8) - [CVE-2020-1894](https://insights.sbomify.com/CVE-2020-1894/): Memory corruption in WhatsApp Android (high 8.8) - [CVE-2020-1893](https://insights.sbomify.com/CVE-2020-1893/): Memory corruption in HHVM (high 7.5) - [CVE-2020-1892](https://insights.sbomify.com/CVE-2020-1892/): Memory corruption in HHVM (high 8.1) - [CVE-2020-18917](https://insights.sbomify.com/CVE-2020-18917/): Code injection in dedecms:dedecms (high 8.8) - [CVE-2020-18913](https://insights.sbomify.com/CVE-2020-18913/): SQL injection in ecisp:espcms-p8 (high 7.5) - [CVE-2020-18912](https://insights.sbomify.com/CVE-2020-18912/): File upload in earcms:ear (critical 9.8) - [CVE-2020-1891](https://insights.sbomify.com/CVE-2020-1891/): Memory corruption in WhatsApp Android (critical 9.8) - [CVE-2020-18900](https://insights.sbomify.com/CVE-2020-18900/): Memory corruption in libexe project:libexe (low 3.3) - [CVE-2020-1890](https://insights.sbomify.com/CVE-2020-1890/): Other in WhatsApp Business for Android (high 7.5) - [CVE-2020-18899](https://insights.sbomify.com/CVE-2020-18899/): Denial of service in exiv2:exiv2 (medium 6.5) - [CVE-2020-18898](https://insights.sbomify.com/CVE-2020-18898/): Denial of service in exiv2:exiv2 (medium 6.5) - [CVE-2020-18897](https://insights.sbomify.com/CVE-2020-18897/): Use after free in libpff project:libpff (high 7.8) - [CVE-2020-18890](https://insights.sbomify.com/CVE-2020-18890/): Missing authorization in puppycms:puppycms (critical 9.8) - [CVE-2020-1889](https://insights.sbomify.com/CVE-2020-1889/): Security feature bypass in WhatsApp Desktop (critical 10.0) - [CVE-2020-18889](https://insights.sbomify.com/CVE-2020-18889/): Cross-site request forgery in puppycms:puppycms (medium 6.5) - [CVE-2020-18888](https://insights.sbomify.com/CVE-2020-18888/): Missing authorization in puppycms:puppycms (high 7.5) - [CVE-2020-18886](https://insights.sbomify.com/CVE-2020-18886/): File upload in phpmywind:phpmywind (high 7.2) - [CVE-2020-18885](https://insights.sbomify.com/CVE-2020-18885/): Command injection in phpmywind:phpmywind (high 7.2) - [CVE-2020-1888](https://insights.sbomify.com/CVE-2020-1888/): Memory corruption in HHVM (high 7.5) - [CVE-2020-18879](https://insights.sbomify.com/CVE-2020-18879/): File upload in bludit:bludit (critical 9.8) - [CVE-2020-18878](https://insights.sbomify.com/CVE-2020-18878/): Path traversal in skycaiji:skycaiji (medium 5.3) - [CVE-2020-18877](https://insights.sbomify.com/CVE-2020-18877/): SQL injection in wuzhicms:wuzhicms (high 7.5) - [CVE-2020-18875](https://insights.sbomify.com/CVE-2020-18875/): Code injection in dotcms:dotcms (high 8.8) - [CVE-2020-1887](https://insights.sbomify.com/CVE-2020-1887/): Security feature bypass in Osquery (critical 9.1) --- From sbomify Insights: https://insights.sbomify.com/years/2020/page/140/