# Vulnerabilities published in 2020


- [CVE-2020-1761](https://insights.sbomify.com/CVE-2020-1761/): Information disclosure in openshift/console (medium 6.1)
- [CVE-2020-1760](https://insights.sbomify.com/CVE-2020-1760/): Cross-site scripting in ceph (medium 5.8)
- [CVE-2020-1759](https://insights.sbomify.com/CVE-2020-1759/): Weak cryptography in ceph (medium 6.4)
- [CVE-2020-1758](https://insights.sbomify.com/CVE-2020-1758/): Improper Certificate Validation and Improper Validation of Certificate with Host Mismatch in Keycloak (medium 5.3)
- [CVE-2020-1757](https://insights.sbomify.com/CVE-2020-1757/): Improper Input Validation in Undertow (high 8.1)
- [CVE-2020-17564](https://insights.sbomify.com/CVE-2020-17564/): Path traversal in feifeicms:feifeicms (critical 9.1)
- [CVE-2020-17563](https://insights.sbomify.com/CVE-2020-17563/): Path traversal in feifeicms:feifeicms (critical 9.1)
- [CVE-2020-1756](https://insights.sbomify.com/CVE-2020-1756/): Cross-site scripting in Moodle (high 7.2)
- [CVE-2020-17551](https://insights.sbomify.com/CVE-2020-17551/): Cross-site scripting (XSS) (medium 4.8)
- [CVE-2020-1755](https://insights.sbomify.com/CVE-2020-1755/): Security feature bypass in Moodle (medium 5.3)
- [CVE-2020-17542](https://insights.sbomify.com/CVE-2020-17542/): Cross-site scripting in dotcms:dotcms (medium 5.4)
- [CVE-2020-17541](https://insights.sbomify.com/CVE-2020-17541/): Memory corruption in libjpeg-turbo:libjpeg-turbo (high 8.8)
- [CVE-2020-1754](https://insights.sbomify.com/CVE-2020-1754/): Missing authorization in Moodle (medium 4.3)
- [CVE-2020-17538](https://insights.sbomify.com/CVE-2020-17538/): Memory corruption in artifex:ghostscript (medium 5.5)
- [CVE-2020-17534](https://insights.sbomify.com/CVE-2020-17534/): Improper synchronization in Apache Netbeans HTML/Java API (high 7.0)
- [CVE-2020-17533](https://insights.sbomify.com/CVE-2020-17533/): Apache Accumulo Improper Handling of Insufficient Permissions (high 8.1)
- [CVE-2020-17532](https://insights.sbomify.com/CVE-2020-17532/): Apache ServiceComb Yaml remote deserialization vulnerability (high 8.8)
- [CVE-2020-17531](https://insights.sbomify.com/CVE-2020-17531/): Deserialization flaw in EOL Tapestry 4. (critical 9.8)
- [CVE-2020-17530](https://insights.sbomify.com/CVE-2020-17530/): Apache Struts Remote Code Execution (critical 9.8, exploited in the wild)
- [CVE-2020-1753](https://insights.sbomify.com/CVE-2020-1753/): Insertion of Sensitive Information into Log File, Invocation of Process Using Visible Sensitive Information, and Exposure of Sensitive Information to an Unauthorized Actor in Ansible (medium 5.0)
- [CVE-2020-17529](https://insights.sbomify.com/CVE-2020-17529/): Apache NuttX (incubating) Out of Bound Write from invalid fragmentation offset value specified in the IP header (critical 9.8)
- [CVE-2020-17528](https://insights.sbomify.com/CVE-2020-17528/): Apache NuttX (incubating) Out of Bound Write from invalid TCP Urgent length (critical 9.1)
- [CVE-2020-17527](https://insights.sbomify.com/CVE-2020-17527/): Apache Tomcat: Request header mix-up between HTTP/2 streams (high 7.5)
- [CVE-2020-17526](https://insights.sbomify.com/CVE-2020-17526/): Incorrect Session Validation in Apache Airflow (high 7.7)
- [CVE-2020-17525](https://insights.sbomify.com/CVE-2020-17525/): Remote unauthenticated denial-of-service in Subversion mod_authz_svn (high 7.5)
- [CVE-2020-17523](https://insights.sbomify.com/CVE-2020-17523/): Authentication bypass in Apache Shiro (critical 9.8)
- [CVE-2020-17522](https://insights.sbomify.com/CVE-2020-17522/): Cache Manipulation Attack in Apache Traffic Control (medium 5.8)
- [CVE-2020-17521](https://insights.sbomify.com/CVE-2020-17521/): Information Disclosure in Apache Groovy (medium 5.5)
- [CVE-2020-17520](https://insights.sbomify.com/CVE-2020-17520/): Auth bypass in Pulsar Manager (medium 6.5)
- [CVE-2020-1752](https://insights.sbomify.com/CVE-2020-1752/): Use after free in glibc (high 7.0)
- [CVE-2020-17519](https://insights.sbomify.com/CVE-2020-17519/): Apache Flink Improper Access Control (critical 9.1, exploited in the wild)
- [CVE-2020-17518](https://insights.sbomify.com/CVE-2020-17518/): Apache Flink directory traversal attack: remote file writing through the REST API (high 7.5)
- [CVE-2020-17517](https://insights.sbomify.com/CVE-2020-17517/): Ozone S3 Gateway allows bucket and key access to non authenticated users (high 7.5)
- [CVE-2020-17516](https://insights.sbomify.com/CVE-2020-17516/): Authentication Bypass in Apache Cassandra (high 7.5)
- [CVE-2020-17515](https://insights.sbomify.com/CVE-2020-17515/): Apache Airflow cross-site scripting due to incomplete fix for CVE-2020-13944 (medium 6.1)
- [CVE-2020-17514](https://insights.sbomify.com/CVE-2020-17514/): disabled hostname verificiation (high 7.4)
- [CVE-2020-17513](https://insights.sbomify.com/CVE-2020-17513/): SSRF vulnerability in Apache Airflow (medium 5.3)
- [CVE-2020-17511](https://insights.sbomify.com/CVE-2020-17511/): Apache Airflow logs passwords in plaintext (medium 6.5)
- [CVE-2020-17510](https://insights.sbomify.com/CVE-2020-17510/): Authentication bypass in Apache Shiro (critical 9.8)
- [CVE-2020-1751](https://insights.sbomify.com/CVE-2020-1751/): Memory corruption in glibc (medium 5.1)
- [CVE-2020-17509](https://insights.sbomify.com/CVE-2020-17509/): Other in Apache Traffic Server (high 7.5)
- [CVE-2020-17508](https://insights.sbomify.com/CVE-2020-17508/): Information disclosure in Apache Traffic Server (high 7.5)
- [CVE-2020-17507](https://insights.sbomify.com/CVE-2020-17507/): Memory corruption in debian:debian linux (medium 5.3)
- [CVE-2020-17506](https://insights.sbomify.com/CVE-2020-17506/): SQL injection in articatech:web proxy (critical 9.8)
- [CVE-2020-17505](https://insights.sbomify.com/CVE-2020-17505/): Command injection in articatech:web proxy (high 8.8)
- [CVE-2020-17504](https://insights.sbomify.com/CVE-2020-17504/): Command injection in barco:transform n (high 7.2)
- [CVE-2020-17503](https://insights.sbomify.com/CVE-2020-17503/): Command injection in barco:transform n (high 7.2)
- [CVE-2020-17502](https://insights.sbomify.com/CVE-2020-17502/): Command injection in barco:transform n (high 7.2)
- [CVE-2020-17500](https://insights.sbomify.com/CVE-2020-17500/): Command injection in barco:transform n (critical 9.8)
- [CVE-2020-1750](https://insights.sbomify.com/CVE-2020-1750/): Denial of service in machine-config-operator-container (medium 6.5)
- [CVE-2020-17498](https://insights.sbomify.com/CVE-2020-17498/): Memory corruption in fedoraproject:fedora (medium 6.5)
- [CVE-2020-17497](https://insights.sbomify.com/CVE-2020-17497/): Denial of service in intel:inet wireless daemon (high 8.1)
- [CVE-2020-17496](https://insights.sbomify.com/CVE-2020-17496/): vBulletin PHP Module Remote Code Execution (critical 9.8, exploited in the wild)
- [CVE-2020-17495](https://insights.sbomify.com/CVE-2020-17495/): django-celery-results Stores Sensitive Information In Cleartext (high 7.5)
- [CVE-2020-17494](https://insights.sbomify.com/CVE-2020-17494/): Weak cryptography in untangle:untangle firewall ng (medium 5.3)
- [CVE-2020-17490](https://insights.sbomify.com/CVE-2020-17490/): SaltStack Salt Allows creating certificates with weak file permissions (medium 5.5)
- [CVE-2020-1749](https://insights.sbomify.com/CVE-2020-1749/): Information disclosure in kernel (high 7.5)
- [CVE-2020-17489](https://insights.sbomify.com/CVE-2020-17489/): Information disclosure in canonical:ubuntu linux (medium 4.3)
- [CVE-2020-17487](https://insights.sbomify.com/CVE-2020-17487/): Memory corruption in fedoraproject:fedora (high 7.5)
- [CVE-2020-17485](https://insights.sbomify.com/CVE-2020-17485/): File upload in uffizio:gps tracker (critical 9.8)
- [CVE-2020-17484](https://insights.sbomify.com/CVE-2020-17484/): Open redirect in uffizio:gps tracker (medium 6.1)
- [CVE-2020-17483](https://insights.sbomify.com/CVE-2020-17483/): Missing authorization in uffizio:gps tracker (high 7.5)
- [CVE-2020-17482](https://insights.sbomify.com/CVE-2020-17482/): Information disclosure in powerdns:authoritative (medium 4.3)
- [CVE-2020-17480](https://insights.sbomify.com/CVE-2020-17480/): Cross-site scripting vulnerability in TinyMCE (medium 6.1)
- [CVE-2020-1748](https://insights.sbomify.com/CVE-2020-1748/): Incorrect Authorization in WildFly Elytron (high 7.5)
- [CVE-2020-17479](https://insights.sbomify.com/CVE-2020-17479/): Validation bypass in jpv (critical 9.8)
- [CVE-2020-17478](https://insights.sbomify.com/CVE-2020-17478/): Weak cryptography in p5-crypt-perl project:p5-crypt-perl (high 7.5)
- [CVE-2020-17477](https://insights.sbomify.com/CVE-2020-17477/): Information disclosure in univention:ucs\@school (medium 6.5)
- [CVE-2020-17476](https://insights.sbomify.com/CVE-2020-17476/): Cross-site scripting in mibew:messenger (medium 6.1)
- [CVE-2020-17475](https://insights.sbomify.com/CVE-2020-17475/): Auth bypass in megvii:koala firmware (high 7.5)
- [CVE-2020-17474](https://insights.sbomify.com/CVE-2020-17474/): Auth bypass in zkteco:facedepot 7b firmware (critical 9.8)
- [CVE-2020-17473](https://insights.sbomify.com/CVE-2020-17473/): Auth bypass in zkteco:facedepot 7b firmware (medium 5.9)
- [CVE-2020-17470](https://insights.sbomify.com/CVE-2020-17470/): Weak cryptography in butok:fnet (medium 5.3)
- [CVE-2020-1747](https://insights.sbomify.com/CVE-2020-1747/): Improper Input Validation in PyYAML (critical 9.8)
- [CVE-2020-17469](https://insights.sbomify.com/CVE-2020-17469/): Null dereference in butok:fnet (high 7.5)
- [CVE-2020-17468](https://insights.sbomify.com/CVE-2020-17468/): Memory corruption in butok:fnet (high 7.5)
- [CVE-2020-17467](https://insights.sbomify.com/CVE-2020-17467/): Memory corruption in butok:fnet (critical 9.1)
- [CVE-2020-17466](https://insights.sbomify.com/CVE-2020-17466/): Auth bypass in turcom:trcwifizone (critical 9.8)
- [CVE-2020-17465](https://insights.sbomify.com/CVE-2020-17465/): Cross-site scripting in forgerock:identity manager (medium 6.1)
- [CVE-2020-17463](https://insights.sbomify.com/CVE-2020-17463/): Fuel CMS SQL Injection (critical 9.8, exploited in the wild)
- [CVE-2020-17462](https://insights.sbomify.com/CVE-2020-17462/): File upload in cmsmadesimple:cms made simple (high 7.8)
- [CVE-2020-1746](https://insights.sbomify.com/CVE-2020-1746/): Exposure of Sensitive Information to an Unauthorized Actor in ansible (medium 5.0)
- [CVE-2020-17458](https://insights.sbomify.com/CVE-2020-17458/): Cross-site scripting in fabbricadigitale:multiux (medium 5.4)
- [CVE-2020-17457](https://insights.sbomify.com/CVE-2020-17457/): Cross-site scripting in fujitsu:serverview remote management (medium 5.4)
- [CVE-2020-17456](https://insights.sbomify.com/CVE-2020-17456/): Command injection in seowonintech:slc-130 firmware (critical 9.8)
- [CVE-2020-17454](https://insights.sbomify.com/CVE-2020-17454/): Cross-site scripting in wso2:api manager (medium 6.1)
- [CVE-2020-17453](https://insights.sbomify.com/CVE-2020-17453/): Cross-site scripting in wso2:api manager (medium 6.1)
- [CVE-2020-17452](https://insights.sbomify.com/CVE-2020-17452/): File upload in flatcore:flatcore (high 7.2)
- [CVE-2020-17451](https://insights.sbomify.com/CVE-2020-17451/): Cross-site scripting in flatcore:flatcore (medium 4.8)
- [CVE-2020-17450](https://insights.sbomify.com/CVE-2020-17450/): Cross-site scripting in php-fusion:php-fusion (medium 6.1)
- [CVE-2020-1745](https://insights.sbomify.com/CVE-2020-1745/): Improper Authorization in Undertoe (high 8.6)
- [CVE-2020-17449](https://insights.sbomify.com/CVE-2020-17449/): Cross-site scripting in php-fusion:php-fusion (medium 5.4)
- [CVE-2020-17448](https://insights.sbomify.com/CVE-2020-17448/): Security feature bypass in telegram:telegram desktop (high 7.8)
- [CVE-2020-17446](https://insights.sbomify.com/CVE-2020-17446/): Asyncpg Arbitrary Code Execution Via Access to an Uninitialized Pointer (critical 9.8)
- [CVE-2020-17445](https://insights.sbomify.com/CVE-2020-17445/): Memory corruption in altran:picotcp (high 7.5)
- [CVE-2020-17444](https://insights.sbomify.com/CVE-2020-17444/): Denial of service in altran:picotcp (high 7.5)
- [CVE-2020-17443](https://insights.sbomify.com/CVE-2020-17443/): Integer overflow in altran:picotcp (high 7.5)
- [CVE-2020-17442](https://insights.sbomify.com/CVE-2020-17442/): Integer overflow in altran:picotcp (high 7.5)
- [CVE-2020-17441](https://insights.sbomify.com/CVE-2020-17441/): Memory corruption in altran:picotcp (critical 9.1)
- [CVE-2020-17440](https://insights.sbomify.com/CVE-2020-17440/): Memory corruption in uip project:uip (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/144/