# Vulnerabilities published in 2020 - [CVE-2020-15346](https://insights.sbomify.com/CVE-2020-15346/): Hardcoded credentials in zyxel:cloudcnm secumanager (medium 5.3) - [CVE-2020-15345](https://insights.sbomify.com/CVE-2020-15345/): Missing authorization in zyxel:cloudcnm secumanager (medium 5.3) - [CVE-2020-15344](https://insights.sbomify.com/CVE-2020-15344/): Missing authorization in zyxel:cloudcnm secumanager (medium 5.3) - [CVE-2020-15343](https://insights.sbomify.com/CVE-2020-15343/): Missing authorization in zyxel:cloudcnm secumanager (medium 5.3) - [CVE-2020-15342](https://insights.sbomify.com/CVE-2020-15342/): Missing authorization in zyxel:cloudcnm secumanager (medium 5.3) - [CVE-2020-15341](https://insights.sbomify.com/CVE-2020-15341/): Missing authorization in zyxel:cloudcnm secumanager (high 7.5) - [CVE-2020-15340](https://insights.sbomify.com/CVE-2020-15340/): Hardcoded credentials in zyxel:cloudcnm secumanager (high 7.5) - [CVE-2020-1534](https://insights.sbomify.com/CVE-2020-1534/): Windows Backup Service Elevation of Privilege Vulnerability (high 7.8) - [CVE-2020-15339](https://insights.sbomify.com/CVE-2020-15339/): Cross-site scripting in zyxel:cloudcnm secumanager (medium 6.1) - [CVE-2020-15338](https://insights.sbomify.com/CVE-2020-15338/): Information disclosure in zyxel:cloudcnm secumanager (medium 5.3) - [CVE-2020-15337](https://insights.sbomify.com/CVE-2020-15337/): Information disclosure in zyxel:cloudcnm secumanager (medium 5.3) - [CVE-2020-15336](https://insights.sbomify.com/CVE-2020-15336/): Missing authorization in zyxel:cloudcnm secumanager (high 7.5) - [CVE-2020-15335](https://insights.sbomify.com/CVE-2020-15335/): Missing authorization in zyxel:cloudcnm secumanager (high 7.5) - [CVE-2020-15334](https://insights.sbomify.com/CVE-2020-15334/): Other in zyxel:cloudcnm secumanager (medium 5.3) - [CVE-2020-15333](https://insights.sbomify.com/CVE-2020-15333/): SQL injection in zyxel:cloudcnm secumanager (medium 5.3) - [CVE-2020-15332](https://insights.sbomify.com/CVE-2020-15332/): Misconfiguration in zyxel:cloudcnm secumanager (critical 9.8) - [CVE-2020-15331](https://insights.sbomify.com/CVE-2020-15331/): Hardcoded credentials in zyxel:cloudcnm secumanager (critical 9.8) - [CVE-2020-15330](https://insights.sbomify.com/CVE-2020-15330/): Hardcoded credentials in zyxel:cloudcnm secumanager (medium 5.3) - [CVE-2020-1533](https://insights.sbomify.com/CVE-2020-1533/): Windows WalletService Elevation of Privilege Vulnerability (high 7.8) - [CVE-2020-15329](https://insights.sbomify.com/CVE-2020-15329/): Misconfiguration in zyxel:cloudcnm secumanager (medium 5.3) - [CVE-2020-15328](https://insights.sbomify.com/CVE-2020-15328/): Misconfiguration in zyxel:cloudcnm secumanager (medium 5.3) - [CVE-2020-15327](https://insights.sbomify.com/CVE-2020-15327/): Hardcoded credentials in zyxel:cloudcnm secumanager (high 7.5) - [CVE-2020-15326](https://insights.sbomify.com/CVE-2020-15326/): Hardcoded credentials in zyxel:cloudcnm secumanager (medium 5.3) - [CVE-2020-15325](https://insights.sbomify.com/CVE-2020-15325/): Hardcoded credentials in zyxel:cloudcnm secumanager (medium 5.3) - [CVE-2020-15324](https://insights.sbomify.com/CVE-2020-15324/): Hardcoded credentials in zyxel:cloud cnm secumanager (critical 9.8) - [CVE-2020-15323](https://insights.sbomify.com/CVE-2020-15323/): Hardcoded credentials in zyxel:cloudcnm secumanager (critical 9.8) - [CVE-2020-15322](https://insights.sbomify.com/CVE-2020-15322/): Hardcoded credentials in zyxel:cloudcnm secumanager (critical 9.8) - [CVE-2020-15321](https://insights.sbomify.com/CVE-2020-15321/): Hardcoded credentials in zyxel:cloudcnm secumanager (critical 9.8) - [CVE-2020-15320](https://insights.sbomify.com/CVE-2020-15320/): Hardcoded credentials in zyxel:cloudcnm secumanager (critical 9.8) - [CVE-2020-1532](https://insights.sbomify.com/CVE-2020-1532/): Windows InstallService Elevation of Privilege Vulnerability (high 7.8) - [CVE-2020-15319](https://insights.sbomify.com/CVE-2020-15319/): Hardcoded credentials in zyxel:cloudcnm secumanager (medium 5.9) - [CVE-2020-15318](https://insights.sbomify.com/CVE-2020-15318/): Hardcoded credentials in zyxel:cloudcnm secumanager (medium 5.9) - [CVE-2020-15317](https://insights.sbomify.com/CVE-2020-15317/): Hardcoded credentials in zyxel:cloudcnm secumanager (medium 5.9) - [CVE-2020-15316](https://insights.sbomify.com/CVE-2020-15316/): Hardcoded credentials in zyxel:cloudcnm secumanager (medium 5.9) - [CVE-2020-15315](https://insights.sbomify.com/CVE-2020-15315/): Hardcoded credentials in zyxel:cloudcnm secumanager (medium 5.9) - [CVE-2020-15314](https://insights.sbomify.com/CVE-2020-15314/): Hardcoded credentials in zyxel:cloudcnm secumanager (medium 5.9) - [CVE-2020-15313](https://insights.sbomify.com/CVE-2020-15313/): Hardcoded credentials in zyxel:cloudcnm secumanager (medium 5.9) - [CVE-2020-15312](https://insights.sbomify.com/CVE-2020-15312/): Hardcoded credentials in zyxel:cloudcnm secumanager (medium 5.9) - [CVE-2020-1531](https://insights.sbomify.com/CVE-2020-1531/): Windows Accounts Control Elevation of Privilege Vulnerability (high 7.8) - [CVE-2020-15309](https://insights.sbomify.com/CVE-2020-15309/): Information disclosure in wolfssl:wolfssl (high 7.0) - [CVE-2020-15308](https://insights.sbomify.com/CVE-2020-15308/): SQL injection in turnkeylinux:support incident tracker (high 7.2) - [CVE-2020-15307](https://insights.sbomify.com/CVE-2020-15307/): Cross-site scripting in nozominetworks:guardian (medium 6.1) - [CVE-2020-15306](https://insights.sbomify.com/CVE-2020-15306/): Memory corruption in canonical:ubuntu linux (medium 5.5) - [CVE-2020-15305](https://insights.sbomify.com/CVE-2020-15305/): Use after free in canonical:ubuntu linux (medium 5.5) - [CVE-2020-15304](https://insights.sbomify.com/CVE-2020-15304/): Null dereference in fedoraproject:fedora (medium 5.5) - [CVE-2020-15303](https://insights.sbomify.com/CVE-2020-15303/): XML external entity in infoblox:nios (medium 6.5) - [CVE-2020-15302](https://insights.sbomify.com/CVE-2020-15302/): Security feature bypass in argent:recoverymanager (high 7.5) - [CVE-2020-15301](https://insights.sbomify.com/CVE-2020-15301/): Code injection in salesagility:suitecrm (high 7.8) - [CVE-2020-15300](https://insights.sbomify.com/CVE-2020-15300/): Open redirect in salesagility:suitecrm (medium 6.1) - [CVE-2020-1530](https://insights.sbomify.com/CVE-2020-1530/): Windows Remote Access Elevation of Privilege Vulnerability (high 7.8) - [CVE-2020-15299](https://insights.sbomify.com/CVE-2020-15299/): Cross-site scripting in king-theme:kingcomposer (medium 6.1) - [CVE-2020-15297](https://insights.sbomify.com/CVE-2020-15297/): Server-side request forgery in Bitdefender Update Server (high 7.1) - [CVE-2020-15294](https://insights.sbomify.com/CVE-2020-15294/): Race condition in Hypervisor Introspection (high 7.8) - [CVE-2020-15293](https://insights.sbomify.com/CVE-2020-15293/): Memory corruption in Bitdefender Hypervisor Introspection (VA-9336) (medium 6.1) - [CVE-2020-15292](https://insights.sbomify.com/CVE-2020-15292/): Lack of validation on data read from guest memory in Bitdefender HVI (VA-9333) (medium 5.5) - [CVE-2020-1529](https://insights.sbomify.com/CVE-2020-1529/): Windows GDI Elevation of Privilege Vulnerability (high 7.8) - [CVE-2020-1528](https://insights.sbomify.com/CVE-2020-1528/): Windows Radio Manager API Elevation of Privilege Vulnerability (high 7.8) - [CVE-2020-15279](https://insights.sbomify.com/CVE-2020-15279/): Scanning exclusion paths disclosure in BEST for Windows (medium 4.0) - [CVE-2020-15278](https://insights.sbomify.com/CVE-2020-15278/): Unauthorized privilege escalation in Mod module (high 7.7) - [CVE-2020-15277](https://insights.sbomify.com/CVE-2020-15277/): Remote Code Execution in baserCMS (high 7.2) - [CVE-2020-15276](https://insights.sbomify.com/CVE-2020-15276/): Cross Site Scripting in baserCMS (high 7.7) - [CVE-2020-15275](https://insights.sbomify.com/CVE-2020-15275/): malicious SVG attachment causing stored XSS vulnerability in MoinMoin (high 8.7) - [CVE-2020-15274](https://insights.sbomify.com/CVE-2020-15274/): Stored XSS via search result in Wiki.js (medium 5.8) - [CVE-2020-15273](https://insights.sbomify.com/CVE-2020-15273/): Cross-Site Scripting in baserCMS (high 7.3) - [CVE-2020-15272](https://insights.sbomify.com/CVE-2020-15272/): Shell-injection in git-tag-annotation GitHub action (high 8.7) - [CVE-2020-15271](https://insights.sbomify.com/CVE-2020-15271/): Shell Command Execution in lookatme (critical 9.3) - [CVE-2020-15270](https://insights.sbomify.com/CVE-2020-15270/): Improper session expiration in Parse Server (medium 4.3) - [CVE-2020-1527](https://insights.sbomify.com/CVE-2020-1527/): Windows Custom Protocol Engine Elevation of Privilege Vulnerability (high 7.8) - [CVE-2020-15269](https://insights.sbomify.com/CVE-2020-15269/): Expired token reuse in Spree (high 7.4) - [CVE-2020-15266](https://insights.sbomify.com/CVE-2020-15266/): Undefined behavior in Tensorflow (low 3.7) - [CVE-2020-15265](https://insights.sbomify.com/CVE-2020-15265/): Segfault in Tensorflow (medium 5.9) - [CVE-2020-15264](https://insights.sbomify.com/CVE-2020-15264/): Privilege Escalation in Boxstarter (high 8.0) - [CVE-2020-15263](https://insights.sbomify.com/CVE-2020-15263/): XSS in platform (high 8.0) - [CVE-2020-15262](https://insights.sbomify.com/CVE-2020-15262/): Invalid integrity hashes in webpack-subresource-integrity (low 3.7) - [CVE-2020-15261](https://insights.sbomify.com/CVE-2020-15261/): Unquoted service path vulnerability on Veyon (high 8.0) - [CVE-2020-15260](https://insights.sbomify.com/CVE-2020-15260/): Existing TLS connections can be reused without checking remote hostname (medium 6.8) - [CVE-2020-1526](https://insights.sbomify.com/CVE-2020-1526/): Windows Network Connection Broker Elevation of Privilege Vulnerability (high 7.8) - [CVE-2020-15259](https://insights.sbomify.com/CVE-2020-15259/): CSRF in Auth0 ad-ldap-connector (high 8.1) - [CVE-2020-15258](https://insights.sbomify.com/CVE-2020-15258/): Insecure use of shell.openExternal in Wire (high 8.0) - [CVE-2020-15257](https://insights.sbomify.com/CVE-2020-15257/): containerd-shim API Exposed to Host Network Containers (medium 5.2) - [CVE-2020-15256](https://insights.sbomify.com/CVE-2020-15256/): Prototype pollution in object-path (high 7.7) - [CVE-2020-15255](https://insights.sbomify.com/CVE-2020-15255/): CSV injection in Anuko Time Tracker (high 8.7) - [CVE-2020-15254](https://insights.sbomify.com/CVE-2020-15254/): Undefined Behavior in bounded Crossbeam channel (high 8.1) - [CVE-2020-15253](https://insights.sbomify.com/CVE-2020-15253/): Stored XSS in Grocy (high 7.3) - [CVE-2020-15252](https://insights.sbomify.com/CVE-2020-15252/): RCE in XWiki (high 8.5) - [CVE-2020-15251](https://insights.sbomify.com/CVE-2020-15251/): Privilege Escalation in Channelmgnt plug-in for Sopel (high 7.7) - [CVE-2020-15250](https://insights.sbomify.com/CVE-2020-15250/): Information disclosure in JUnit4 (medium 4.4) - [CVE-2020-1525](https://insights.sbomify.com/CVE-2020-1525/): Media Foundation Memory Corruption Vulnerability (high 7.8) - [CVE-2020-15249](https://insights.sbomify.com/CVE-2020-15249/): Stored XSS by authenticated backend user with access to upload files (low 2.8) - [CVE-2020-15248](https://insights.sbomify.com/CVE-2020-15248/): Privilege escalation by backend users assigned to the default "Publisher" system role (medium 4.0) - [CVE-2020-15247](https://insights.sbomify.com/CVE-2020-15247/): Twig Sandbox Escape by authenticated users with access to editing CMS templates when safemode is enabled. (medium 5.2) - [CVE-2020-15246](https://insights.sbomify.com/CVE-2020-15246/): Local File Inclusion by unauthenticated users (high 7.5) - [CVE-2020-15245](https://insights.sbomify.com/CVE-2020-15245/): Email verification bypass in Sylius (medium 4.3) - [CVE-2020-15244](https://insights.sbomify.com/CVE-2020-15244/): RCE in Magento (high 8.0) - [CVE-2020-15243](https://insights.sbomify.com/CVE-2020-15243/): WebApi Authentication attribute missing in Smartstore (critical 9.1) - [CVE-2020-15242](https://insights.sbomify.com/CVE-2020-15242/): Open Redirect in Next.js (medium 4.7) - [CVE-2020-15241](https://insights.sbomify.com/CVE-2020-15241/): Cross-Site Scripting in TYPO3 Fluid Engine (medium 4.7) - [CVE-2020-15240](https://insights.sbomify.com/CVE-2020-15240/): Regression in JWT Signature Validation (high 7.4) - [CVE-2020-1524](https://insights.sbomify.com/CVE-2020-1524/): Windows Speech Shell Components Elevation of Privilege Vulnerability (high 7.8) - [CVE-2020-15239](https://insights.sbomify.com/CVE-2020-15239/): Directory Traversal in xmpp-http-upload (low 3.5) --- From sbomify Insights: https://insights.sbomify.com/years/2020/page/158/