# Vulnerabilities published in 2020


- [CVE-2020-15238](https://insights.sbomify.com/CVE-2020-15238/): Local privilege escalation Blueman (high 7.1)
- [CVE-2020-15237](https://insights.sbomify.com/CVE-2020-15237/): Timing attack in Shrine (medium 5.9)
- [CVE-2020-15236](https://insights.sbomify.com/CVE-2020-15236/): Directory Traversal in Wiki.js (high 8.6)
- [CVE-2020-15235](https://insights.sbomify.com/CVE-2020-15235/): Sensitive data exposure in RACTF (medium 5.9)
- [CVE-2020-15234](https://insights.sbomify.com/CVE-2020-15234/): Redirect URL matching ignores character casing (medium 6.1)
- [CVE-2020-15233](https://insights.sbomify.com/CVE-2020-15233/): OAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addresses (medium 6.1)
- [CVE-2020-15232](https://insights.sbomify.com/CVE-2020-15232/): XML External Entity attack in mapfish-print (critical 9.3)
- [CVE-2020-15231](https://insights.sbomify.com/CVE-2020-15231/): Cross-site scripting attack in mapfish-print (critical 9.3)
- [CVE-2020-15230](https://insights.sbomify.com/CVE-2020-15230/): Arbitrary file read un Vapor (high 8.5)
- [CVE-2020-1523](https://insights.sbomify.com/CVE-2020-1523/): Microsoft SharePoint Server Tampering Vulnerability (high 8.9)
- [CVE-2020-15229](https://insights.sbomify.com/CVE-2020-15229/): Path traversal and files overwrite with unsquashfs (high 8.2)
- [CVE-2020-15228](https://insights.sbomify.com/CVE-2020-15228/): Environment Variable Injection in GitHub Actions (low 3.5)
- [CVE-2020-15227](https://insights.sbomify.com/CVE-2020-15227/): Remote Code Execution vulnerability (high 8.7)
- [CVE-2020-15226](https://insights.sbomify.com/CVE-2020-15226/): SQL Injection in GLPI Search API (medium 5.0)
- [CVE-2020-15225](https://insights.sbomify.com/CVE-2020-15225/): Denial of Service vulnerability in django-filter (high 7.5)
- [CVE-2020-15224](https://insights.sbomify.com/CVE-2020-15224/): Socket syscalls can leak enclave memory contents in Open Enclave (medium 6.8)
- [CVE-2020-15223](https://insights.sbomify.com/CVE-2020-15223/): Ignored storage errors on token revokation in ORY Fosite (high 8.0)
- [CVE-2020-15222](https://insights.sbomify.com/CVE-2020-15222/): Replay of private_key_jwt possible in ORY Fosite (high 8.1)
- [CVE-2020-15221](https://insights.sbomify.com/CVE-2020-15221/): XSS in the breadcrumbs (medium 6.8)
- [CVE-2020-15220](https://insights.sbomify.com/CVE-2020-15220/): Session fixation (medium 6.1)
- [CVE-2020-1522](https://insights.sbomify.com/CVE-2020-1522/): Windows Speech Runtime Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2020-15219](https://insights.sbomify.com/CVE-2020-15219/): SQL query displayed on portal error (medium 4.3)
- [CVE-2020-15218](https://insights.sbomify.com/CVE-2020-15218/): Admin pages are cached and can be embedded (medium 6.8)
- [CVE-2020-15217](https://insights.sbomify.com/CVE-2020-15217/): User data exposure in GLPI (medium 5.3)
- [CVE-2020-15216](https://insights.sbomify.com/CVE-2020-15216/): Signature Validation Bypass in goxmldsig (medium 5.3)
- [CVE-2020-15215](https://insights.sbomify.com/CVE-2020-15215/): Context isolation bypass in Electron (medium 5.6)
- [CVE-2020-15214](https://insights.sbomify.com/CVE-2020-15214/): Out of bounds write in tensorflow-lite (high 8.1)
- [CVE-2020-15213](https://insights.sbomify.com/CVE-2020-15213/): Denial of service in tensorflow-lite (medium 4.0)
- [CVE-2020-15212](https://insights.sbomify.com/CVE-2020-15212/): Out of bounds access in tensorflow-lite (high 8.1)
- [CVE-2020-15211](https://insights.sbomify.com/CVE-2020-15211/): Out of bounds access in tensorflow-lite (medium 4.8)
- [CVE-2020-15210](https://insights.sbomify.com/CVE-2020-15210/): Segmentation fault in tensorflow-lite (medium 6.5)
- [CVE-2020-1521](https://insights.sbomify.com/CVE-2020-1521/): Windows Speech Runtime Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2020-15209](https://insights.sbomify.com/CVE-2020-15209/): Null pointer dereference in tensorflow-lite (medium 5.9)
- [CVE-2020-15208](https://insights.sbomify.com/CVE-2020-15208/): Data corruption in tensorflow-lite (high 7.4)
- [CVE-2020-15207](https://insights.sbomify.com/CVE-2020-15207/): Segfault and data corruption in tensorflow-lite (high 8.7)
- [CVE-2020-15206](https://insights.sbomify.com/CVE-2020-15206/): Denial of Service in Tensorflow (critical 9.0)
- [CVE-2020-15205](https://insights.sbomify.com/CVE-2020-15205/): Data leak in Tensorflow (critical 9.0)
- [CVE-2020-15204](https://insights.sbomify.com/CVE-2020-15204/): Segfault in Tensorflow (medium 5.3)
- [CVE-2020-15203](https://insights.sbomify.com/CVE-2020-15203/): Denial of Service in Tensorflow (high 7.5)
- [CVE-2020-15202](https://insights.sbomify.com/CVE-2020-15202/): Integer truncation in Shard API usage (critical 9.0)
- [CVE-2020-15201](https://insights.sbomify.com/CVE-2020-15201/): Heap buffer overflow in Tensorflow (medium 4.8)
- [CVE-2020-15200](https://insights.sbomify.com/CVE-2020-15200/): Segfault in Tensorflow (medium 5.9)
- [CVE-2020-1520](https://insights.sbomify.com/CVE-2020-1520/): Windows Font Driver Host Remote Code Execution Vulnerability (high 7.8)
- [CVE-2020-15199](https://insights.sbomify.com/CVE-2020-15199/): Denial of Service in Tensorflow (medium 5.9)
- [CVE-2020-15198](https://insights.sbomify.com/CVE-2020-15198/): Heap buffer overflow in Tensorflow (medium 5.4)
- [CVE-2020-15197](https://insights.sbomify.com/CVE-2020-15197/): Denial of Service in Tensorflow (medium 6.3)
- [CVE-2020-15196](https://insights.sbomify.com/CVE-2020-15196/): Heap buffer overflow in Tensorflow (high 8.5)
- [CVE-2020-15195](https://insights.sbomify.com/CVE-2020-15195/): Heap buffer overflow in Tensorflow (high 8.5)
- [CVE-2020-15194](https://insights.sbomify.com/CVE-2020-15194/): Denial of Service in Tensorflow (medium 5.3)
- [CVE-2020-15193](https://insights.sbomify.com/CVE-2020-15193/): Memory corruption in Tensorflow (high 7.1)
- [CVE-2020-15192](https://insights.sbomify.com/CVE-2020-15192/): Memory leak in Tensorflow (medium 4.3)
- [CVE-2020-15191](https://insights.sbomify.com/CVE-2020-15191/): Undefined behavior in Tensorflow (medium 5.3)
- [CVE-2020-15190](https://insights.sbomify.com/CVE-2020-15190/): Segfault in Tensorflow (medium 5.3)
- [CVE-2020-1519](https://insights.sbomify.com/CVE-2020-1519/): Windows UPnP Device Host Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2020-15189](https://insights.sbomify.com/CVE-2020-15189/): Remote Code Execution in SOY CMS (medium 6.8)
- [CVE-2020-15188](https://insights.sbomify.com/CVE-2020-15188/): Unauthenticated Remote Code Execution in SOY CMS (critical 10.0)
- [CVE-2020-15187](https://insights.sbomify.com/CVE-2020-15187/): Duplicate plugin entries in Helm (low 3.0)
- [CVE-2020-15186](https://insights.sbomify.com/CVE-2020-15186/): Improper sanitization of plugin names in Helm (low 3.4)
- [CVE-2020-15185](https://insights.sbomify.com/CVE-2020-15185/): Duplicated chart entries in Helm (low 2.2)
- [CVE-2020-15184](https://insights.sbomify.com/CVE-2020-15184/): Aliases are never checked in Helm (low 3.7)
- [CVE-2020-15183](https://insights.sbomify.com/CVE-2020-15183/): Reflected XSS leading to RCE in SoyCMS (high 8.4)
- [CVE-2020-15182](https://insights.sbomify.com/CVE-2020-15182/): Cross-site Request Forgery leading to RCE in SOY CMS (high 8.4)
- [CVE-2020-15181](https://insights.sbomify.com/CVE-2020-15181/): Admin account takeover in Alfresco Reset Password (critical 9.3)
- [CVE-2020-15180](https://insights.sbomify.com/CVE-2020-15180/): Command injection in mariadb (critical 9.0)
- [CVE-2020-1518](https://insights.sbomify.com/CVE-2020-1518/): Windows File Server Resource Management Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2020-15179](https://insights.sbomify.com/CVE-2020-15179/): HTML Injection in ScratchSig (high 8.0)
- [CVE-2020-15178](https://insights.sbomify.com/CVE-2020-15178/): Potential XSS in PrestaShop contactform (high 8.0)
- [CVE-2020-15177](https://insights.sbomify.com/CVE-2020-15177/): Unauthenticated Stored XSS in GLPI (high 8.0)
- [CVE-2020-15176](https://insights.sbomify.com/CVE-2020-15176/): SQL injection in GLPI (high 8.7)
- [CVE-2020-15175](https://insights.sbomify.com/CVE-2020-15175/): Unauthenticated File Deletion in GLPI (high 7.4)
- [CVE-2020-15174](https://insights.sbomify.com/CVE-2020-15174/): Unpreventable top-level navigation in Electron (high 7.5)
- [CVE-2020-15173](https://insights.sbomify.com/CVE-2020-15173/): Heap buffer overflow in ACCEL-PPP (high 8.2)
- [CVE-2020-15172](https://insights.sbomify.com/CVE-2020-15172/): Remote Code Execution in Act module (high 8.7)
- [CVE-2020-15171](https://insights.sbomify.com/CVE-2020-15171/): Users with SCRIPT rights can execute arbitrary code in XWiki (medium 6.6)
- [CVE-2020-15170](https://insights.sbomify.com/CVE-2020-15170/): Missing access control in apollo-adminservice (high 7.0)
- [CVE-2020-1517](https://insights.sbomify.com/CVE-2020-1517/): Windows File Server Resource Management Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2020-15169](https://insights.sbomify.com/CVE-2020-15169/): XSS in Action View (medium 5.4)
- [CVE-2020-15168](https://insights.sbomify.com/CVE-2020-15168/): File size limit bypass in node-fetch (low 2.6)
- [CVE-2020-15167](https://insights.sbomify.com/CVE-2020-15167/): Arbitrary code execution via configuration file in Miller (high 8.2)
- [CVE-2020-15166](https://insights.sbomify.com/CVE-2020-15166/): Denial of Service in ZeroMQ (high 7.5)
- [CVE-2020-15165](https://insights.sbomify.com/CVE-2020-15165/): Potentially tampered sources on Play Store for Chameleon Mini Live Debugger (critical 9.3)
- [CVE-2020-15164](https://insights.sbomify.com/CVE-2020-15164/): Authentication Bypass in Scratch Login (mediawiki-scratch-login) (critical 10.0)
- [CVE-2020-15163](https://insights.sbomify.com/CVE-2020-15163/): Invalid root may become trusted root in The Update Framework (TUF) (high 8.7)
- [CVE-2020-15162](https://insights.sbomify.com/CVE-2020-15162/): Stored XSS in PrestaShop (medium 5.4)
- [CVE-2020-15161](https://insights.sbomify.com/CVE-2020-15161/): Potential XSS in PrestaShop (medium 5.4)
- [CVE-2020-15160](https://insights.sbomify.com/CVE-2020-15160/): Blind SQL Injection in PrestaShop (critical 9.8)
- [CVE-2020-1516](https://insights.sbomify.com/CVE-2020-1516/): Windows Work Folders Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2020-15159](https://insights.sbomify.com/CVE-2020-15159/): Cross Site Scripting leading to RCE in baserCMS (high 7.6)
- [CVE-2020-15158](https://insights.sbomify.com/CVE-2020-15158/): Heap buffer overflow in libIEC61850 (high 7.7)
- [CVE-2020-15157](https://insights.sbomify.com/CVE-2020-15157/): containerd can be coerced into leaking credentials during image pull (medium 6.1)
- [CVE-2020-15156](https://insights.sbomify.com/CVE-2020-15156/): XSS due to lack of CSRF validation for replying/publishing (medium 6.8)
- [CVE-2020-15155](https://insights.sbomify.com/CVE-2020-15155/): Cross-Site Scripting in baserCMS (high 7.3)
- [CVE-2020-15154](https://insights.sbomify.com/CVE-2020-15154/): Cross Site Scripting in baserCMS (high 7.3)
- [CVE-2020-15153](https://insights.sbomify.com/CVE-2020-15153/): Unauthenticated SQL injection in Ampache (high 8.2)
- [CVE-2020-15152](https://insights.sbomify.com/CVE-2020-15152/): Server-Side Request Forgery in ftp-srv (critical 9.1)
- [CVE-2020-15151](https://insights.sbomify.com/CVE-2020-15151/): Observable Timing Discrepancy in OpenMage LTS (high 8.0)
- [CVE-2020-15150](https://insights.sbomify.com/CVE-2020-15150/): Remote Code Execution in paginator(hex) (critical 9.0)
- [CVE-2020-1515](https://insights.sbomify.com/CVE-2020-1515/): Windows Telephony Server Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2020-15149](https://insights.sbomify.com/CVE-2020-15149/): Account takeover in NodeBB (critical 9.9)
- [CVE-2020-15148](https://insights.sbomify.com/CVE-2020-15148/): Unsafe deserialization in Yii 2 (high 8.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/159/