# Vulnerabilities published in 2020


- [CVE-2020-18173](https://insights.sbomify.com/CVE-2020-18173/): Code injection in 1password:1password (high 7.8)
- [CVE-2020-18172](https://insights.sbomify.com/CVE-2020-18172/): Code injection in trezor:bridge (critical 9.8)
- [CVE-2020-18171](https://insights.sbomify.com/CVE-2020-18171/): Privilege escalation in techsmith:snagit (high 8.8)
- [CVE-2020-18170](https://insights.sbomify.com/CVE-2020-18170/): Privilege escalation in abloy:key manager (critical 9.8)
- [CVE-2020-1817](https://insights.sbomify.com/CVE-2020-1817/): Privilege escalation in PCManager (high 7.8)
- [CVE-2020-18169](https://insights.sbomify.com/CVE-2020-18169/): Privilege escalation in techsmith:snagit (high 7.8)
- [CVE-2020-18167](https://insights.sbomify.com/CVE-2020-18167/): Cross-site scripting in laobancms:laobancms (medium 4.8)
- [CVE-2020-18166](https://insights.sbomify.com/CVE-2020-18166/): File upload in laobancms:laobancms (critical 9.8)
- [CVE-2020-18165](https://insights.sbomify.com/CVE-2020-18165/): Cross-site scripting in laobancms:laobancms (medium 4.8)
- [CVE-2020-18164](https://insights.sbomify.com/CVE-2020-18164/): SQL injection in tp-shop:tp-shop (critical 9.8)
- [CVE-2020-1816](https://insights.sbomify.com/CVE-2020-1816/): Denial of service in NIP6800 (high 7.5)
- [CVE-2020-18158](https://insights.sbomify.com/CVE-2020-18158/): Cross-site scripting in hucart:hucart (medium 5.4)
- [CVE-2020-18157](https://insights.sbomify.com/CVE-2020-18157/): Cross-site request forgery in metinfo:metinfo (high 8.8)
- [CVE-2020-18155](https://insights.sbomify.com/CVE-2020-18155/): SQL Injection in Subrion CMS (critical 9.8)
- [CVE-2020-18151](https://insights.sbomify.com/CVE-2020-18151/): ThinkCMF Cross Site Request Forgerly (CSRF) vulnerability (medium 6.5)
- [CVE-2020-1815](https://insights.sbomify.com/CVE-2020-1815/): Denial of service in NIP6800 (high 7.5)
- [CVE-2020-18145](https://insights.sbomify.com/CVE-2020-18145/): Cross-site scripting in baidu:umeditor (medium 6.1)
- [CVE-2020-18144](https://insights.sbomify.com/CVE-2020-18144/): SQL injection in ectouch:ectouch (critical 9.8)
- [CVE-2020-1814](https://insights.sbomify.com/CVE-2020-1814/): Race condition in NIP6800 (medium 5.3)
- [CVE-2020-18132](https://insights.sbomify.com/CVE-2020-18132/): Cross-site scripting in mipcms:mipcms (medium 4.8)
- [CVE-2020-18131](https://insights.sbomify.com/CVE-2020-18131/): Cross-site request forgery in clanscripts project:clanscripts (high 8.8)
- [CVE-2020-1813](https://insights.sbomify.com/CVE-2020-1813/): Auth bypass in HUAWEI P30 (medium 6.8)
- [CVE-2020-18129](https://insights.sbomify.com/CVE-2020-18129/): Cross-site request forgery in eyoucms:eyoucms (high 8.8)
- [CVE-2020-18127](https://insights.sbomify.com/CVE-2020-18127/): Path traversal in indexhibit:indexhibit (medium 6.5)
- [CVE-2020-18126](https://insights.sbomify.com/CVE-2020-18126/): Cross-site scripting in indexhibit:indexhibit (medium 5.4)
- [CVE-2020-18125](https://insights.sbomify.com/CVE-2020-18125/): Cross-site scripting in indexhibit:indexhibit (medium 6.1)
- [CVE-2020-18124](https://insights.sbomify.com/CVE-2020-18124/): Cross-site request forgery in indexhibit:indexhibit (medium 5.7)
- [CVE-2020-18123](https://insights.sbomify.com/CVE-2020-18123/): Cross-site request forgery in indexhibit:indexhibit (medium 6.5)
- [CVE-2020-18121](https://insights.sbomify.com/CVE-2020-18121/): Misconfiguration in indexhibit:indexhibit (high 8.8)
- [CVE-2020-1812](https://insights.sbomify.com/CVE-2020-1812/): Auth bypass in HUAWEI P30 (high 7.8)
- [CVE-2020-18116](https://insights.sbomify.com/CVE-2020-18116/): SQL injection in youdiancms:youdiancms (high 8.8)
- [CVE-2020-18114](https://insights.sbomify.com/CVE-2020-18114/): File upload in dedecms:dedecms (critical 9.8)
- [CVE-2020-1811](https://insights.sbomify.com/CVE-2020-1811/): Command injection in GaussDB 200 (high 8.8)
- [CVE-2020-18106](https://insights.sbomify.com/CVE-2020-18106/): SQL injection in wms project:wms (critical 9.8)
- [CVE-2020-18102](https://insights.sbomify.com/CVE-2020-18102/): Cross-site scripting in hotels server project:hotels server (medium 6.1)
- [CVE-2020-1810](https://insights.sbomify.com/CVE-2020-1810/): Weak cryptography in CloudEngine 12800;S5700;S6700 (medium 5.3)
- [CVE-2020-1809](https://insights.sbomify.com/CVE-2020-1809/): Security feature bypass in HUAWEI Mate 10 (medium 4.6)
- [CVE-2020-18084](https://insights.sbomify.com/CVE-2020-18084/): Cross-site scripting in yzmcms:yzmcms (medium 6.1)
- [CVE-2020-18081](https://insights.sbomify.com/CVE-2020-18081/): SQL injection in sem-cms:semcms (high 7.5)
- [CVE-2020-1808](https://insights.sbomify.com/CVE-2020-1808/): Memory corruption in Honor 20;HONOR 20 PRO;Honor Magic2;HUAWEI Mate 20 X;HUAWEI P30;HUAWEI P30 Pro;Honor View 20 (high 7.1)
- [CVE-2020-18078](https://insights.sbomify.com/CVE-2020-18078/): Auth bypass in sem-cms:semcms (critical 9.8)
- [CVE-2020-18077](https://insights.sbomify.com/CVE-2020-18077/): Memory corruption in ftpshell:ftpshell server (high 7.5)
- [CVE-2020-18070](https://insights.sbomify.com/CVE-2020-18070/): Path traversal in idreamsoft:icms (critical 9.1)
- [CVE-2020-1807](https://insights.sbomify.com/CVE-2020-1807/): Missing authorization in HUAWEI Mate 20 (low 3.5)
- [CVE-2020-18066](https://insights.sbomify.com/CVE-2020-18066/): Cross-site scripting in zrlog:zrlog (medium 6.1)
- [CVE-2020-18065](https://insights.sbomify.com/CVE-2020-18065/): Cross-site scripting in popojicms:popojicms (medium 5.4)
- [CVE-2020-1806](https://insights.sbomify.com/CVE-2020-1806/): Memory corruption in Honor V10 (high 7.1)
- [CVE-2020-1805](https://insights.sbomify.com/CVE-2020-1805/): Memory corruption in Honor V10 (high 7.1)
- [CVE-2020-18048](https://insights.sbomify.com/CVE-2020-18048/): Command injection in bertanddip:craigms (critical 9.8)
- [CVE-2020-1804](https://insights.sbomify.com/CVE-2020-1804/): Memory corruption in Honor V10 (high 7.1)
- [CVE-2020-18035](https://insights.sbomify.com/CVE-2020-18035/): Cross-site scripting in jeesns:jeesns (medium 6.1)
- [CVE-2020-18032](https://insights.sbomify.com/CVE-2020-18032/): Memory corruption in debian:debian linux (high 7.8)
- [CVE-2020-1803](https://insights.sbomify.com/CVE-2020-1803/): Auth bypass in Honor V20 (medium 5.3)
- [CVE-2020-18022](https://insights.sbomify.com/CVE-2020-18022/): Cross-site scripting in qibosoft:qibocms (medium 6.1)
- [CVE-2020-18020](https://insights.sbomify.com/CVE-2020-18020/): SQL injection in phpshe:mall system (critical 9.8)
- [CVE-2020-1802](https://insights.sbomify.com/CVE-2020-1802/): Security feature bypass in OSCA-550;OSCA-550A;OSCA-550AX;OSCA-550X (medium 4.6)
- [CVE-2020-18019](https://insights.sbomify.com/CVE-2020-18019/): SQL injection in xinfu:oa system (high 7.5)
- [CVE-2020-18013](https://insights.sbomify.com/CVE-2020-18013/): SQL injection in whatsns:whatsns (critical 9.8)
- [CVE-2020-1801](https://insights.sbomify.com/CVE-2020-1801/): Auth bypass in Mate 30 Pro;Mate 30 (medium 5.5)
- [CVE-2020-1800](https://insights.sbomify.com/CVE-2020-1800/): Missing authorization in HUAWEI P30 (high 7.8)
- [CVE-2020-17999](https://insights.sbomify.com/CVE-2020-17999/): Cross-site scripting in 1234n:minicms (medium 6.1)
- [CVE-2020-1799](https://insights.sbomify.com/CVE-2020-1799/): Use after free in E6878-370 (high 7.5)
- [CVE-2020-1798](https://insights.sbomify.com/CVE-2020-1798/): Auth bypass in HUAWEI P30 (medium 4.6)
- [CVE-2020-1797](https://insights.sbomify.com/CVE-2020-1797/): Missing authorization in HUAWEI Mate 20 (low 2.4)
- [CVE-2020-1796](https://insights.sbomify.com/CVE-2020-1796/): Missing authorization in HUAWEI Mate 20;HUAWEI Mate 30 Pro (medium 6.6)
- [CVE-2020-17952](https://insights.sbomify.com/CVE-2020-17952/): Code injection in topthink/think (critical 9.8)
- [CVE-2020-1795](https://insights.sbomify.com/CVE-2020-1795/): Security feature bypass in HUAWEI Mate 20;HUAWEI Mate 30 Pro (low 2.4)
- [CVE-2020-1794](https://insights.sbomify.com/CVE-2020-1794/): Auth bypass in HUAWEI Mate 20;HUAWEI Mate 30 Pro (medium 4.6)
- [CVE-2020-1793](https://insights.sbomify.com/CVE-2020-1793/): Auth bypass in HUAWEI Mate 20;HUAWEI Mate 30 Pro (medium 4.6)
- [CVE-2020-1792](https://insights.sbomify.com/CVE-2020-1792/): Memory corruption in Honor V10 (medium 5.5)
- [CVE-2020-1791](https://insights.sbomify.com/CVE-2020-1791/): Business logic in HUAWEI Mate 20 (low 2.4)
- [CVE-2020-17901](https://insights.sbomify.com/CVE-2020-17901/): Cross-site request forgery in pbootcms:pbootcms (medium 6.5)
- [CVE-2020-1790](https://insights.sbomify.com/CVE-2020-1790/): Command injection in GaussDB 200 (high 8.8)
- [CVE-2020-17891](https://insights.sbomify.com/CVE-2020-17891/): Cross-site scripting in tp-link:archer c1200 firmware (medium 6.1)
- [CVE-2020-1789](https://insights.sbomify.com/CVE-2020-1789/): Auth bypass in OSCA-550, OSCA-550A, OSCA-550AX, OSCA-550X (medium 6.8)
- [CVE-2020-1788](https://insights.sbomify.com/CVE-2020-1788/): Auth bypass in Honor V30 (medium 5.5)
- [CVE-2020-1787](https://insights.sbomify.com/CVE-2020-1787/): Auth bypass in HUAWEI Mate 20 (medium 6.6)
- [CVE-2020-1786](https://insights.sbomify.com/CVE-2020-1786/): Auth bypass in HUAWEI Mate 20 Pro (medium 4.6)
- [CVE-2020-1785](https://insights.sbomify.com/CVE-2020-1785/): Denial of service in Mate 10 Pro;Honor V10;Honor 10;Nova 4 (medium 5.5)
- [CVE-2020-1779](https://insights.sbomify.com/CVE-2020-1779/): Dynamic templates reveal sensitive data when OTRS tags are used (medium 4.3)
- [CVE-2020-1778](https://insights.sbomify.com/CVE-2020-1778/): Bypassing user account validation (medium 4.1)
- [CVE-2020-1777](https://insights.sbomify.com/CVE-2020-1777/): Agent names disclosed in chat feature (medium 4.3)
- [CVE-2020-1776](https://insights.sbomify.com/CVE-2020-1776/): Invalidating or changing user does not invalidate session (low 3.5)
- [CVE-2020-17759](https://insights.sbomify.com/CVE-2020-17759/): Command injection in evernote:evernote (high 8.8)
- [CVE-2020-17753](https://insights.sbomify.com/CVE-2020-17753/): Business logic in rc project:rc (medium 6.5)
- [CVE-2020-17752](https://insights.sbomify.com/CVE-2020-17752/): Integer overflow in mon project:mon (critical 9.8)
- [CVE-2020-1775](https://insights.sbomify.com/CVE-2020-1775/): Information disclosure in external interface (low 3.5)
- [CVE-2020-1774](https://insights.sbomify.com/CVE-2020-1774/): Information disclosure (medium 4.5)
- [CVE-2020-1773](https://insights.sbomify.com/CVE-2020-1773/): Session / Password / Password token leak (high 7.3)
- [CVE-2020-1772](https://insights.sbomify.com/CVE-2020-1772/): Information Disclosure (medium 6.5)
- [CVE-2020-1771](https://insights.sbomify.com/CVE-2020-1771/): Possible XSS in Customer user address book (medium 4.6)
- [CVE-2020-1770](https://insights.sbomify.com/CVE-2020-1770/): Information disclosure in support bundle files (low 2.4)
- [CVE-2020-1769](https://insights.sbomify.com/CVE-2020-1769/): Autocomplete in the form login screens (low 3.5)
- [CVE-2020-1768](https://insights.sbomify.com/CVE-2020-1768/): External Interface does not invalidate session (medium 5.4)
- [CVE-2020-1767](https://insights.sbomify.com/CVE-2020-1767/): Possible to send drafted messages as wrong agent (low 3.5)
- [CVE-2020-1766](https://insights.sbomify.com/CVE-2020-1766/): Improper handling of uploaded inline images (low 2.0)
- [CVE-2020-1765](https://insights.sbomify.com/CVE-2020-1765/): Spoofing of From field in several screens (low 3.5)
- [CVE-2020-1764](https://insights.sbomify.com/CVE-2020-1764/): Hard coded cryptographic key in Kiali (high 8.6)
- [CVE-2020-1763](https://insights.sbomify.com/CVE-2020-1763/): Memory corruption in libreswan (high 7.5)
- [CVE-2020-1762](https://insights.sbomify.com/CVE-2020-1762/): Insufficient Session Expiration in Kiali (high 7.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/143/