# Vulnerabilities published in 2020


- [CVE-2020-15147](https://insights.sbomify.com/CVE-2020-15147/): Remote Code Execution in Red Discord Bot (high 8.5)
- [CVE-2020-15146](https://insights.sbomify.com/CVE-2020-15146/): Remote Code Execution in SyliusResourceBundle (critical 9.6)
- [CVE-2020-15145](https://insights.sbomify.com/CVE-2020-15145/): Local privilege elevation in Composer-Setup for Windows (medium 6.7)
- [CVE-2020-15143](https://insights.sbomify.com/CVE-2020-15143/): Remote Code Execution in SyliusResourceBundle (high 7.7)
- [CVE-2020-15142](https://insights.sbomify.com/CVE-2020-15142/): Arbitrary Code Generation (high 8.0)
- [CVE-2020-15141](https://insights.sbomify.com/CVE-2020-15141/): Path Traversal in openapi-python-client (low 3.0)
- [CVE-2020-15140](https://insights.sbomify.com/CVE-2020-15140/): Remote Code Execution in Red Discord Bot (high 8.2)
- [CVE-2020-1514](https://insights.sbomify.com/CVE-2020-1514/): Microsoft Office SharePoint XSS Vulnerability (medium 5.4)
- [CVE-2020-15139](https://insights.sbomify.com/CVE-2020-15139/): XSS in MyBB (high 8.8)
- [CVE-2020-15138](https://insights.sbomify.com/CVE-2020-15138/): Cross-Site Scripting in Prism (high 7.1)
- [CVE-2020-15137](https://insights.sbomify.com/CVE-2020-15137/): Integer overflow in HoRNDIS (medium 5.5)
- [CVE-2020-15136](https://insights.sbomify.com/CVE-2020-15136/): Improper authentication in etcd (medium 6.5)
- [CVE-2020-15135](https://insights.sbomify.com/CVE-2020-15135/): CSRF vulnerability in save-server (medium 6.7)
- [CVE-2020-15134](https://insights.sbomify.com/CVE-2020-15134/): Missing TLS certificate verification in Faye (high 8.0)
- [CVE-2020-15133](https://insights.sbomify.com/CVE-2020-15133/): Missing TLS certificate verification in Faye Websocket (high 8.0)
- [CVE-2020-15132](https://insights.sbomify.com/CVE-2020-15132/): Reset Password / Login vulnerability in Sulu (medium 5.3)
- [CVE-2020-15131](https://insights.sbomify.com/CVE-2020-15131/): False-positive validity for NFT1 genesis transactions in SLP Validate (high 7.5)
- [CVE-2020-15130](https://insights.sbomify.com/CVE-2020-15130/): False-positive validity for NFT1 genesis transactions in SLPJS (high 7.5)
- [CVE-2020-1513](https://insights.sbomify.com/CVE-2020-1513/): Windows CSC Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2020-15129](https://insights.sbomify.com/CVE-2020-15129/): Open redirect in Traefik (medium 6.1)
- [CVE-2020-15128](https://insights.sbomify.com/CVE-2020-15128/): Reliance on Cookies without validation in OctoberCMS (medium 6.1)
- [CVE-2020-15127](https://insights.sbomify.com/CVE-2020-15127/): Denial of service in Contour (high 7.5)
- [CVE-2020-15126](https://insights.sbomify.com/CVE-2020-15126/): Information disclosure through Viewer query in parse-server (medium 6.5)
- [CVE-2020-15125](https://insights.sbomify.com/CVE-2020-15125/): Authorization header is not sanitized in an error object in auth0 (high 7.7)
- [CVE-2020-15124](https://insights.sbomify.com/CVE-2020-15124/): Path traversal in Goobi viewer Core (critical 9.6)
- [CVE-2020-15123](https://insights.sbomify.com/CVE-2020-15123/): Command injection in codecov (npm package) (critical 9.3)
- [CVE-2020-15121](https://insights.sbomify.com/CVE-2020-15121/): Command injection in Radare2 (high 7.4)
- [CVE-2020-15120](https://insights.sbomify.com/CVE-2020-15120/): Authorization Bypass in I hate money (medium 4.9)
- [CVE-2020-1512](https://insights.sbomify.com/CVE-2020-1512/): Windows State Repository Service Information Disclosure Vulnerability (high 7.8)
- [CVE-2020-15119](https://insights.sbomify.com/CVE-2020-15119/): DOM-based XSS in auth0-lock (medium 6.4)
- [CVE-2020-15118](https://insights.sbomify.com/CVE-2020-15118/): Cross-Site Scripting in Wagtail (medium 5.7)
- [CVE-2020-15117](https://insights.sbomify.com/CVE-2020-15117/): Denial of Service in Synergy (medium 6.5)
- [CVE-2020-15115](https://insights.sbomify.com/CVE-2020-15115/): No minimum password length in etcd (medium 5.8)
- [CVE-2020-15114](https://insights.sbomify.com/CVE-2020-15114/): Denial of Service in etcd (high 7.7)
- [CVE-2020-15113](https://insights.sbomify.com/CVE-2020-15113/): Improper Preservation of Permissions in etcd (medium 5.7)
- [CVE-2020-15112](https://insights.sbomify.com/CVE-2020-15112/): Improper Input Validation in etcd (medium 6.5)
- [CVE-2020-15111](https://insights.sbomify.com/CVE-2020-15111/): CRLF vulnerability in Fiber (medium 4.2)
- [CVE-2020-15110](https://insights.sbomify.com/CVE-2020-15110/): Possible pod name collisions in jupyterhub-kubespawner (medium 6.8)
- [CVE-2020-1511](https://insights.sbomify.com/CVE-2020-1511/): Connected User Experiences and Telemetry Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2020-15109](https://insights.sbomify.com/CVE-2020-15109/): Ability to change order address without triggering address validations in solidus (medium 5.3)
- [CVE-2020-15108](https://insights.sbomify.com/CVE-2020-15108/): SQL Injection in glpi (high 7.1)
- [CVE-2020-15107](https://insights.sbomify.com/CVE-2020-15107/): x87 FPU operations in enclaves are vulnerable to ABI poisoning in openenclave (medium 5.3)
- [CVE-2020-15106](https://insights.sbomify.com/CVE-2020-15106/): Improper Input Validation in etcd (medium 6.5)
- [CVE-2020-15105](https://insights.sbomify.com/CVE-2020-15105/): In Django Two-Factor Authentication, user passwords are stored in clear text in the Django session (medium 5.4)
- [CVE-2020-15104](https://insights.sbomify.com/CVE-2020-15104/): TLS Validation Vulnerability in Envoy (medium 4.6)
- [CVE-2020-15103](https://insights.sbomify.com/CVE-2020-15103/): Integer Overflow in FreeRDP (low 3.5)
- [CVE-2020-15102](https://insights.sbomify.com/CVE-2020-15102/): Improper access control on dashboard form in PrestaShop (medium 6.5)
- [CVE-2020-15101](https://insights.sbomify.com/CVE-2020-15101/): Nested directory structure can lead to Uncontrolled Resource Consumption in freewvs (low 2.8)
- [CVE-2020-15100](https://insights.sbomify.com/CVE-2020-15100/): Uncontrolled Resource Consumption in freewvs (low 2.8)
- [CVE-2020-1510](https://insights.sbomify.com/CVE-2020-1510/): Win32k Information Disclosure Vulnerability (medium 5.5)
- [CVE-2020-15099](https://insights.sbomify.com/CVE-2020-15099/): Exposure of Sensitive Information to an Unauthorized Actor in TYPO3 CMS (high 8.1)
- [CVE-2020-15098](https://insights.sbomify.com/CVE-2020-15098/): Missing Required Cryptographic Step Leading to Sensitive Information Disclosure in TYPO3 CMS (high 8.8)
- [CVE-2020-15097](https://insights.sbomify.com/CVE-2020-15097/): Path Traversal in loklak (critical 9.1)
- [CVE-2020-15096](https://insights.sbomify.com/CVE-2020-15096/): Context isolation bypass via Promise in Electron (medium 6.8)
- [CVE-2020-15095](https://insights.sbomify.com/CVE-2020-15095/): Sensitive information exposure through logs in npm cli (medium 4.4)
- [CVE-2020-15094](https://insights.sbomify.com/CVE-2020-15094/): RCE in Symfony (high 8.0)
- [CVE-2020-15093](https://insights.sbomify.com/CVE-2020-15093/): Improper verification of signature threshold in tough (high 8.6)
- [CVE-2020-15092](https://insights.sbomify.com/CVE-2020-15092/): Stored XSS in TimelineJS3 (high 7.2)
- [CVE-2020-15091](https://insights.sbomify.com/CVE-2020-15091/): Denial of Service in TenderMint (medium 6.5)
- [CVE-2020-1509](https://insights.sbomify.com/CVE-2020-1509/): Local Security Authority Subsystem Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2020-15087](https://insights.sbomify.com/CVE-2020-15087/): Privilege escalation in Presto (high 7.4)
- [CVE-2020-15086](https://insights.sbomify.com/CVE-2020-15086/): Potential Remote Code Execution in TYPO3 with mediace extension (critical 9.8)
- [CVE-2020-15085](https://insights.sbomify.com/CVE-2020-15085/): Client caching login operation with plaintext password in Saleor Storefront (medium 6.9)
- [CVE-2020-15084](https://insights.sbomify.com/CVE-2020-15084/): Authorization bypass in express-jwt (high 7.7)
- [CVE-2020-15083](https://insights.sbomify.com/CVE-2020-15083/): Reflected XSS when uploading an image in the Product page in PrestaShop (medium 4.7)
- [CVE-2020-15082](https://insights.sbomify.com/CVE-2020-15082/): External control of configuration setting in the dashboard in PrestaShop (high 7.1)
- [CVE-2020-15081](https://insights.sbomify.com/CVE-2020-15081/): Information exposure in the upload directory in PrestaShop (medium 5.3)
- [CVE-2020-15080](https://insights.sbomify.com/CVE-2020-15080/): Information disclosure in release archive in PrestaShop (medium 5.3)
- [CVE-2020-1508](https://insights.sbomify.com/CVE-2020-1508/): Windows Media Audio Decoder Remote Code Execution Vulnerability (high 7.6)
- [CVE-2020-15079](https://insights.sbomify.com/CVE-2020-15079/): Improper access control in PrestaShop (medium 6.4)
- [CVE-2020-15078](https://insights.sbomify.com/CVE-2020-15078/): Auth bypass in OpenVPN (high 7.5)
- [CVE-2020-15077](https://insights.sbomify.com/CVE-2020-15077/): Auth bypass in OpenVPN Access Server (medium 5.3)
- [CVE-2020-15076](https://insights.sbomify.com/CVE-2020-15076/): Path traversal in Private Tunnel (high 7.8)
- [CVE-2020-15075](https://insights.sbomify.com/CVE-2020-15075/): Other in OpenVPN Connect (high 7.1)
- [CVE-2020-15074](https://insights.sbomify.com/CVE-2020-15074/): Auth bypass in OpenVPN Access Server (high 7.5)
- [CVE-2020-15073](https://insights.sbomify.com/CVE-2020-15073/): Cross-site scripting in phplist:phplist (medium 5.4)
- [CVE-2020-15072](https://insights.sbomify.com/CVE-2020-15072/): SQL injection in phplist:phplist (high 8.8)
- [CVE-2020-15071](https://insights.sbomify.com/CVE-2020-15071/): Cross-site scripting in getsymphony:symphony (medium 6.1)
- [CVE-2020-15070](https://insights.sbomify.com/CVE-2020-15070/): Code injection in zulip:zulip server (high 8.8)
- [CVE-2020-1507](https://insights.sbomify.com/CVE-2020-1507/): Microsoft COM for Windows Elevation of Privilege Vulnerability (high 7.9)
- [CVE-2020-15069](https://insights.sbomify.com/CVE-2020-15069/): Sophos XG Firewall Buffer Overflow (critical 9.8, exploited in the wild)
- [CVE-2020-15065](https://insights.sbomify.com/CVE-2020-15065/): Memory corruption in digitus:da-70254 firmware (medium 6.5)
- [CVE-2020-15064](https://insights.sbomify.com/CVE-2020-15064/): Cross-site scripting in digitus:da-70254 firmware (medium 4.3)
- [CVE-2020-15063](https://insights.sbomify.com/CVE-2020-15063/): Auth bypass in digitus:da-70254 firmware (high 8.8)
- [CVE-2020-15062](https://insights.sbomify.com/CVE-2020-15062/): Information disclosure in digitus:da-70254 firmware (high 8.8)
- [CVE-2020-15061](https://insights.sbomify.com/CVE-2020-15061/): Memory corruption in lindy-international:42633 firmware (medium 6.5)
- [CVE-2020-15060](https://insights.sbomify.com/CVE-2020-15060/): Cross-site scripting in lindy-international:42633 firmware (medium 4.3)
- [CVE-2020-1506](https://insights.sbomify.com/CVE-2020-1506/): Windows Start-Up Application Elevation of Privilege Vulnerability (medium 6.1)
- [CVE-2020-15059](https://insights.sbomify.com/CVE-2020-15059/): Auth bypass in lindy-international:42633 firmware (high 8.8)
- [CVE-2020-15058](https://insights.sbomify.com/CVE-2020-15058/): Information disclosure in lindy-international:42633 firmware (high 8.8)
- [CVE-2020-15057](https://insights.sbomify.com/CVE-2020-15057/): Memory corruption in tp-link:tl-ps310u firmware (medium 6.5)
- [CVE-2020-15056](https://insights.sbomify.com/CVE-2020-15056/): Cross-site scripting in tp-link:tl-ps310u firmware (medium 4.3)
- [CVE-2020-15055](https://insights.sbomify.com/CVE-2020-15055/): Auth bypass in tp-link:tl-ps310u firmware (high 8.8)
- [CVE-2020-15054](https://insights.sbomify.com/CVE-2020-15054/): Information disclosure in tp-link:tl-ps310u firmware (high 8.8)
- [CVE-2020-15053](https://insights.sbomify.com/CVE-2020-15053/): Cross-site scripting in articatech:artica proxy (medium 6.1)
- [CVE-2020-15052](https://insights.sbomify.com/CVE-2020-15052/): SQL injection in articatech:artica proxy (high 7.5)
- [CVE-2020-15051](https://insights.sbomify.com/CVE-2020-15051/): Cross-site scripting in articatech:artica proxy (medium 6.1)
- [CVE-2020-15050](https://insights.sbomify.com/CVE-2020-15050/): Path traversal in supremainc:biostar 2 (high 7.5)
- [CVE-2020-1505](https://insights.sbomify.com/CVE-2020-1505/): Microsoft SharePoint Information Disclosure Vulnerability (medium 5.5)
- [CVE-2020-15049](https://insights.sbomify.com/CVE-2020-15049/): Other in fedoraproject:fedora (critical 9.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/160/