# Vulnerabilities published in 2020


- [CVE-2020-15930](https://insights.sbomify.com/CVE-2020-15930/): Cross-site Scripting in Joplin (medium 6.1)
- [CVE-2020-1593](https://insights.sbomify.com/CVE-2020-1593/): Windows Media Audio Decoder Remote Code Execution Vulnerability (high 7.6)
- [CVE-2020-15929](https://insights.sbomify.com/CVE-2020-15929/): Path traversal in ortussolutions:testbox (critical 9.8)
- [CVE-2020-15928](https://insights.sbomify.com/CVE-2020-15928/): Path traversal in ortussolutions:testbox (medium 5.3)
- [CVE-2020-15927](https://insights.sbomify.com/CVE-2020-15927/): SQL injection in zohocorp:manageengine applications manager (high 8.8)
- [CVE-2020-15926](https://insights.sbomify.com/CVE-2020-15926/): Cross-site scripting in rocket.chat:rocket.chat (medium 6.1)
- [CVE-2020-15925](https://insights.sbomify.com/CVE-2020-15925/): SQL injection in loway:queuemetrics (high 8.8)
- [CVE-2020-15924](https://insights.sbomify.com/CVE-2020-15924/): SQL injection in midasolutions:eframework (high 7.5)
- [CVE-2020-15923](https://insights.sbomify.com/CVE-2020-15923/): Path traversal in midasolutions:eframework (high 7.5)
- [CVE-2020-15922](https://insights.sbomify.com/CVE-2020-15922/): Command injection in midasolutions:eframework (critical 9.8)
- [CVE-2020-15921](https://insights.sbomify.com/CVE-2020-15921/): Hardcoded credentials in midasolutions:eframework (critical 9.8)
- [CVE-2020-15920](https://insights.sbomify.com/CVE-2020-15920/): Command injection in midasolutions:eframework (critical 9.8)
- [CVE-2020-1592](https://insights.sbomify.com/CVE-2020-1592/): Windows Kernel Information Disclosure Vulnerability (medium 4.4)
- [CVE-2020-15919](https://insights.sbomify.com/CVE-2020-15919/): Cross-site scripting in midasolutions:eframework (medium 6.1)
- [CVE-2020-15918](https://insights.sbomify.com/CVE-2020-15918/): Cross-site scripting in midasolutions:eframework (medium 5.4)
- [CVE-2020-15917](https://insights.sbomify.com/CVE-2020-15917/): Other in claws-mail:claws-mail (critical 9.8)
- [CVE-2020-15916](https://insights.sbomify.com/CVE-2020-15916/): Command injection in tenda:ac15 firmware (critical 9.8)
- [CVE-2020-15914](https://insights.sbomify.com/CVE-2020-15914/): Cross-site scripting in ea:origin client (medium 5.4)
- [CVE-2020-15912](https://insights.sbomify.com/CVE-2020-15912/): Auth bypass in tesla:model 3 firmware (medium 6.5)
- [CVE-2020-15910](https://insights.sbomify.com/CVE-2020-15910/): Misconfiguration in solarwinds:n-central (medium 4.7)
- [CVE-2020-1591](https://insights.sbomify.com/CVE-2020-1591/): Microsoft Dynamics 365 (On-Premise) Cross Site Scripting Vulnerability (medium 5.4)
- [CVE-2020-15909](https://insights.sbomify.com/CVE-2020-15909/): Auth bypass in solarwinds:n-central (high 8.8)
- [CVE-2020-15908](https://insights.sbomify.com/CVE-2020-15908/): Path traversal in cauldrondevelopment:c\! (high 7.5)
- [CVE-2020-15907](https://insights.sbomify.com/CVE-2020-15907/): Cross-site scripting in mahara:mahara (medium 6.1)
- [CVE-2020-15906](https://insights.sbomify.com/CVE-2020-15906/): Auth bypass in tiki:tiki (critical 9.8)
- [CVE-2020-15904](https://insights.sbomify.com/CVE-2020-15904/): bsdiff4 out-of-bounds write via patch file (high 7.8)
- [CVE-2020-15903](https://insights.sbomify.com/CVE-2020-15903/): Privilege escalation in nagios:nagios xi (critical 9.8)
- [CVE-2020-15902](https://insights.sbomify.com/CVE-2020-15902/): Cross-site scripting in nagios:nagios xi (medium 6.1)
- [CVE-2020-15901](https://insights.sbomify.com/CVE-2020-15901/): Command injection in nagios:nagios xi (high 8.8)
- [CVE-2020-15900](https://insights.sbomify.com/CVE-2020-15900/): Memory corruption in artifex:ghostscript (critical 9.8)
- [CVE-2020-1590](https://insights.sbomify.com/CVE-2020-1590/): Connected User Experiences and Telemetry Service Elevation of Privilege Vulnerability (medium 6.6)
- [CVE-2020-15899](https://insights.sbomify.com/CVE-2020-15899/): Grin insufficient data validation (high 7.5)
- [CVE-2020-15898](https://insights.sbomify.com/CVE-2020-15898/): Security feature bypass in arista:eos (medium 5.3)
- [CVE-2020-15897](https://insights.sbomify.com/CVE-2020-15897/): Denial of service in arista:eos (high 7.5)
- [CVE-2020-15896](https://insights.sbomify.com/CVE-2020-15896/): Auth bypass in dlink:dap-1522 firmware (high 7.5)
- [CVE-2020-15895](https://insights.sbomify.com/CVE-2020-15895/): Cross-site scripting in dlink:dir-816l firmware (medium 6.1)
- [CVE-2020-15894](https://insights.sbomify.com/CVE-2020-15894/): Missing authorization in dlink:dir-816l firmware (high 7.5)
- [CVE-2020-15893](https://insights.sbomify.com/CVE-2020-15893/): Command injection in dlink:dir-816l firmware (critical 9.8)
- [CVE-2020-15892](https://insights.sbomify.com/CVE-2020-15892/): Memory corruption in dlink:dap-1520 firmware (critical 9.8)
- [CVE-2020-15890](https://insights.sbomify.com/CVE-2020-15890/): Memory corruption in canonical:ubuntu linux (high 7.5)
- [CVE-2020-1589](https://insights.sbomify.com/CVE-2020-1589/): Windows Kernel Information Disclosure Vulnerability (medium 4.4)
- [CVE-2020-15889](https://insights.sbomify.com/CVE-2020-15889/): Memory corruption in lua:lua (critical 9.8)
- [CVE-2020-15888](https://insights.sbomify.com/CVE-2020-15888/): Memory corruption in lua:lua (high 8.8)
- [CVE-2020-15887](https://insights.sbomify.com/CVE-2020-15887/): MunkiReport Software Update module is vulnerable to SQL injection (high 8.8)
- [CVE-2020-15886](https://insights.sbomify.com/CVE-2020-15886/): MunkiReport reportdata module SQL injection vulnerability (high 8.8)
- [CVE-2020-15885](https://insights.sbomify.com/CVE-2020-15885/): MunkiReport Cross-Site Scripting (XSS) Filter Bypass On Comment (medium 5.4)
- [CVE-2020-15884](https://insights.sbomify.com/CVE-2020-15884/): SQL injection in munkireport project:munkireport (high 8.8)
- [CVE-2020-15883](https://insights.sbomify.com/CVE-2020-15883/): MunkiReport Managed Installs module Reflected Cross-Site Scripting (XSS) vulnerability (medium 6.1)
- [CVE-2020-15882](https://insights.sbomify.com/CVE-2020-15882/): Cross-site request forgery in munkireport project:munkireport (high 8.1)
- [CVE-2020-15881](https://insights.sbomify.com/CVE-2020-15881/): MunkiReport munki_facts module Cross-Site Scripting (XSS) vulnerability (medium 6.1)
- [CVE-2020-15879](https://insights.sbomify.com/CVE-2020-15879/): Server-side request forgery in bitwarden:server (high 7.5)
- [CVE-2020-15878](https://insights.sbomify.com/CVE-2020-15878/): An issue was discovered in LibreNMS 1.65. (high 8.8)
- [CVE-2020-15877](https://insights.sbomify.com/CVE-2020-15877/): Exposure of Resource to Wrong Sphere in LibreNMS (high 8.8)
- [CVE-2020-15876](https://insights.sbomify.com/CVE-2020-15876/): An issue was discovered in LibreNMS 1.65. (high 8.8)
- [CVE-2020-15875](https://insights.sbomify.com/CVE-2020-15875/): SQL injection in LibreNMS (medium 5.0)
- [CVE-2020-15874](https://insights.sbomify.com/CVE-2020-15874/): An issue was discovered in LibreNMS 1.65. (high 8.8)
- [CVE-2020-15873](https://insights.sbomify.com/CVE-2020-15873/): LibreNMS SQL Injection vulnerability (medium 6.5)
- [CVE-2020-15871](https://insights.sbomify.com/CVE-2020-15871/): Other in sonatype:nexus repository manager (high 8.8)
- [CVE-2020-15870](https://insights.sbomify.com/CVE-2020-15870/): Cross-site scripting in sonatype:nexus repository manager (medium 6.1)
- [CVE-2020-1587](https://insights.sbomify.com/CVE-2020-1587/): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2020-15869](https://insights.sbomify.com/CVE-2020-15869/): Cross-site scripting in sonatype:nexus repository manager (medium 5.4)
- [CVE-2020-15868](https://insights.sbomify.com/CVE-2020-15868/): Missing authorization in sonatype:nexus repository manager (high 7.5)
- [CVE-2020-15867](https://insights.sbomify.com/CVE-2020-15867/): Code injection in gogs:gogs (high 7.2)
- [CVE-2020-15866](https://insights.sbomify.com/CVE-2020-15866/): Memory corruption in debian:debian linux (critical 9.8)
- [CVE-2020-15865](https://insights.sbomify.com/CVE-2020-15865/): Code injection in stimulsoft:reports (critical 9.8)
- [CVE-2020-15864](https://insights.sbomify.com/CVE-2020-15864/): Cross-site scripting in quali:cloudshell (medium 6.1)
- [CVE-2020-15863](https://insights.sbomify.com/CVE-2020-15863/): Memory corruption in canonical:ubuntu linux (medium 5.3)
- [CVE-2020-15862](https://insights.sbomify.com/CVE-2020-15862/): Privilege escalation in canonical:ubuntu linux (high 7.8)
- [CVE-2020-15861](https://insights.sbomify.com/CVE-2020-15861/): Privilege escalation in canonical:ubuntu linux (high 7.8)
- [CVE-2020-15860](https://insights.sbomify.com/CVE-2020-15860/): Business logic in parallels:remote application server (critical 9.9)
- [CVE-2020-15859](https://insights.sbomify.com/CVE-2020-15859/): Use after free in debian:debian linux (low 3.3)
- [CVE-2020-15858](https://insights.sbomify.com/CVE-2020-15858/): Path traversal in thalesgroup:bgs5 firmware (medium 6.2)
- [CVE-2020-15855](https://insights.sbomify.com/CVE-2020-15855/): Cross-site scripting in bodhi (medium 6.1)
- [CVE-2020-15853](https://insights.sbomify.com/CVE-2020-15853/): Denial of service in supybot-fedora (medium 5.3)
- [CVE-2020-15852](https://insights.sbomify.com/CVE-2020-15852/): Race condition in linux:linux kernel (high 7.8)
- [CVE-2020-15851](https://insights.sbomify.com/CVE-2020-15851/): Missing authorization in nakivo:backup \& replication transporter (critical 9.8)
- [CVE-2020-15850](https://insights.sbomify.com/CVE-2020-15850/): Misconfiguration in nakivo:backup \& replication director (high 7.8)
- [CVE-2020-1585](https://insights.sbomify.com/CVE-2020-1585/): Microsoft Windows Codecs Library Remote Code Execution Vulnerability (high 8.8)
- [CVE-2020-15849](https://insights.sbomify.com/CVE-2020-15849/): SQL injection in re-desk:re\ (high 7.2)
- [CVE-2020-15843](https://insights.sbomify.com/CVE-2020-15843/): Misconfiguration in actfax:actfax (high 7.3)
- [CVE-2020-15842](https://insights.sbomify.com/CVE-2020-15842/): Liferay Portal and Liferay DXP have Insecure Deserialization Vulnerability (high 8.1)
- [CVE-2020-15841](https://insights.sbomify.com/CVE-2020-15841/): Liferay Portal and Liferay DXP Potentially Reveal LDAP Server Password via Unsafe Connection (high 8.3)
- [CVE-2020-15840](https://insights.sbomify.com/CVE-2020-15840/): Liferay Portal and Liferay DXP Bypass via Double Encoded URL (medium 5.3)
- [CVE-2020-1584](https://insights.sbomify.com/CVE-2020-1584/): Windows dnsrslvr.dll Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2020-15839](https://insights.sbomify.com/CVE-2020-15839/): Unrestricted Upload of File with Dangerous Type in Liferay Portal and Liferay DXP (medium 6.5)
- [CVE-2020-15838](https://insights.sbomify.com/CVE-2020-15838/): Privilege escalation in connectwise:automate (high 8.8)
- [CVE-2020-15836](https://insights.sbomify.com/CVE-2020-15836/): Command injection in mofinetwork:mofi4500-4gxelte firmware (critical 9.8)
- [CVE-2020-15835](https://insights.sbomify.com/CVE-2020-15835/): Auth bypass in mofinetwork:mofi4500-4gxelte firmware (critical 9.8)
- [CVE-2020-15834](https://insights.sbomify.com/CVE-2020-15834/): Information disclosure in mofinetwork:mofi4500-4gxelte firmware (high 7.5)
- [CVE-2020-15833](https://insights.sbomify.com/CVE-2020-15833/): Hardcoded credentials in mofinetwork:mofi4500-4gxelte firmware (critical 9.8)
- [CVE-2020-15832](https://insights.sbomify.com/CVE-2020-15832/): Other in mofinetwork:mofi4500-4gxelte firmware (high 7.5)
- [CVE-2020-15831](https://insights.sbomify.com/CVE-2020-15831/): Cross-site scripting in jetbrains:teamcity (medium 6.1)
- [CVE-2020-15830](https://insights.sbomify.com/CVE-2020-15830/): Cross-site scripting in jetbrains:teamcity (medium 6.1)
- [CVE-2020-1583](https://insights.sbomify.com/CVE-2020-1583/): Microsoft Word Information Disclosure Vulnerability (high 8.8)
- [CVE-2020-15829](https://insights.sbomify.com/CVE-2020-15829/): Information disclosure in jetbrains:teamcity (medium 5.3)
- [CVE-2020-15828](https://insights.sbomify.com/CVE-2020-15828/): Missing authorization in jetbrains:teamcity (medium 6.5)
- [CVE-2020-15827](https://insights.sbomify.com/CVE-2020-15827/): Security feature bypass in jetbrains:toolbox (high 7.5)
- [CVE-2020-15826](https://insights.sbomify.com/CVE-2020-15826/): Privilege escalation in jetbrains:teamcity (medium 4.3)
- [CVE-2020-15825](https://insights.sbomify.com/CVE-2020-15825/): Privilege escalation in jetbrains:teamcity (high 8.8)
- [CVE-2020-15824](https://insights.sbomify.com/CVE-2020-15824/): Privilege escalation in jetbrains:kotlin (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/153/