# Vulnerabilities published in 2020


- [CVE-2020-15047](https://insights.sbomify.com/CVE-2020-15047/): Security feature bypass in trojita project:trojita (medium 5.9)
- [CVE-2020-15046](https://insights.sbomify.com/CVE-2020-15046/): Cross-site request forgery in supermicro:x10drh-it bios (high 8.8)
- [CVE-2020-15043](https://insights.sbomify.com/CVE-2020-15043/): Cross-site request forgery in iball:wrb303n firmware (medium 6.5)
- [CVE-2020-15041](https://insights.sbomify.com/CVE-2020-15041/): Cross-site scripting in php-fusion:php-fusion (medium 4.8)
- [CVE-2020-1504](https://insights.sbomify.com/CVE-2020-1504/): Microsoft Excel Remote Code Execution Vulnerability (high 8.8)
- [CVE-2020-15038](https://insights.sbomify.com/CVE-2020-15038/): Cross-site scripting in seedprod:coming soon page\, under construction \& maintenance mode (medium 5.4)
- [CVE-2020-15037](https://insights.sbomify.com/CVE-2020-15037/): Cross-site scripting in nedi:nedi (medium 5.4)
- [CVE-2020-15036](https://insights.sbomify.com/CVE-2020-15036/): Cross-site scripting in nedi:nedi (medium 5.4)
- [CVE-2020-15035](https://insights.sbomify.com/CVE-2020-15035/): Cross-site scripting in nedi:nedi (medium 5.4)
- [CVE-2020-15034](https://insights.sbomify.com/CVE-2020-15034/): Cross-site scripting in nedi:nedi (medium 5.4)
- [CVE-2020-15033](https://insights.sbomify.com/CVE-2020-15033/): Cross-site scripting in nedi:nedi (medium 5.4)
- [CVE-2020-15032](https://insights.sbomify.com/CVE-2020-15032/): Cross-site scripting in nedi:nedi (medium 5.4)
- [CVE-2020-15031](https://insights.sbomify.com/CVE-2020-15031/): Cross-site scripting in nedi:nedi (medium 5.4)
- [CVE-2020-15030](https://insights.sbomify.com/CVE-2020-15030/): Cross-site scripting in nedi:nedi (medium 5.4)
- [CVE-2020-1503](https://insights.sbomify.com/CVE-2020-1503/): Microsoft Word Information Disclosure Vulnerability (medium 5.5)
- [CVE-2020-15029](https://insights.sbomify.com/CVE-2020-15029/): Cross-site scripting in nedi:nedi (medium 5.4)
- [CVE-2020-15028](https://insights.sbomify.com/CVE-2020-15028/): Cross-site scripting in nedi:nedi (medium 5.4)
- [CVE-2020-15027](https://insights.sbomify.com/CVE-2020-15027/): Auth bypass in connectwise:automate (critical 9.8)
- [CVE-2020-15026](https://insights.sbomify.com/CVE-2020-15026/): Path traversal in bludit:bludit (medium 4.9)
- [CVE-2020-15025](https://insights.sbomify.com/CVE-2020-15025/): Denial of service in netapp:8300 firmware (medium 4.4)
- [CVE-2020-15024](https://insights.sbomify.com/CVE-2020-15024/): Information disclosure in avast:antivirus (medium 5.5)
- [CVE-2020-15023](https://insights.sbomify.com/CVE-2020-15023/): Weak cryptography in askey:ap5100w firmware (medium 5.9)
- [CVE-2020-15020](https://insights.sbomify.com/CVE-2020-15020/): Cross-site scripting in elementor:website builder (medium 5.4)
- [CVE-2020-1502](https://insights.sbomify.com/CVE-2020-1502/): Microsoft Word Information Disclosure Vulnerability (medium 5.5)
- [CVE-2020-15018](https://insights.sbomify.com/CVE-2020-15018/): Auth bypass in playsms:playsms (medium 6.5)
- [CVE-2020-15017](https://insights.sbomify.com/CVE-2020-15017/): Cross-site scripting in nedi:nedi (medium 6.1)
- [CVE-2020-15016](https://insights.sbomify.com/CVE-2020-15016/): Cross-site scripting in nedi:nedi (medium 6.1)
- [CVE-2020-15015](https://insights.sbomify.com/CVE-2020-15015/): GleamTech FileUltimate Cross-site Scripting (medium 6.1)
- [CVE-2020-15014](https://insights.sbomify.com/CVE-2020-15014/): Cross-site request forgery in pramod:blogcms (high 8.8)
- [CVE-2020-15012](https://insights.sbomify.com/CVE-2020-15012/): Path traversal in sonatype:nexus repository manager (high 8.6)
- [CVE-2020-15011](https://insights.sbomify.com/CVE-2020-15011/): Other in canonical:ubuntu linux (medium 4.3)
- [CVE-2020-1501](https://insights.sbomify.com/CVE-2020-1501/): Microsoft SharePoint Spoofing Vulnerability (medium 5.4)
- [CVE-2020-15009](https://insights.sbomify.com/CVE-2020-15009/): Code injection in asus:screenpad2 upgrade tool (high 7.8)
- [CVE-2020-15008](https://insights.sbomify.com/CVE-2020-15008/): SQL injection in connectwise:connectwise automate (high 7.5)
- [CVE-2020-15007](https://insights.sbomify.com/CVE-2020-15007/): Memory corruption in doom vanille project:doom vanille (critical 9.8)
- [CVE-2020-15006](https://insights.sbomify.com/CVE-2020-15006/): Cross-site scripting in bludit:bludit (medium 5.4)
- [CVE-2020-15005](https://insights.sbomify.com/CVE-2020-15005/): img_auth.php may leak private extension images into the public cache (low 3.1)
- [CVE-2020-15004](https://insights.sbomify.com/CVE-2020-15004/): Cross-site scripting in open-xchange:open-xchange appsuite (medium 4.8)
- [CVE-2020-15003](https://insights.sbomify.com/CVE-2020-15003/): Information disclosure in open-xchange:open-xchange appsuite (medium 4.3)
- [CVE-2020-15002](https://insights.sbomify.com/CVE-2020-15002/): Server-side request forgery in open-xchange:open-xchange appsuite (medium 5.0)
- [CVE-2020-15001](https://insights.sbomify.com/CVE-2020-15001/): Missing authorization in yubico:yubikey 5 nfc firmware (medium 5.3)
- [CVE-2020-15000](https://insights.sbomify.com/CVE-2020-15000/): Hardcoded credentials in yubico:yubikey 5 nfc firmware (medium 5.9)
- [CVE-2020-1500](https://insights.sbomify.com/CVE-2020-1500/): Microsoft SharePoint Spoofing Vulnerability (medium 5.4)
- [CVE-2020-14999](https://insights.sbomify.com/CVE-2020-14999/): Security feature bypass in acronis:agent (high 7.5)
- [CVE-2020-14993](https://insights.sbomify.com/CVE-2020-14993/): Memory corruption in draytek:vigor2960 firmware (critical 9.8)
- [CVE-2020-14990](https://insights.sbomify.com/CVE-2020-14990/): Privilege escalation in iobit:advanced systemcare (high 7.1)
- [CVE-2020-1499](https://insights.sbomify.com/CVE-2020-1499/): Microsoft SharePoint Spoofing Vulnerability (medium 5.4)
- [CVE-2020-14989](https://insights.sbomify.com/CVE-2020-14989/): Cross-site request forgery in bloomreach:experience manager (medium 6.5)
- [CVE-2020-14988](https://insights.sbomify.com/CVE-2020-14988/): Cross-site scripting in bloomreach:experience manager (medium 5.4)
- [CVE-2020-14987](https://insights.sbomify.com/CVE-2020-14987/): Code injection in bloomreach:experience manager (high 7.2)
- [CVE-2020-14983](https://insights.sbomify.com/CVE-2020-14983/): Memory corruption in chocolate-doom:chocolate doom (critical 9.8)
- [CVE-2020-14982](https://insights.sbomify.com/CVE-2020-14982/): SQL injection in kronos:web time and attendance (medium 6.5)
- [CVE-2020-14981](https://insights.sbomify.com/CVE-2020-14981/): Security feature bypass in vipre:password vault (medium 5.9)
- [CVE-2020-14980](https://insights.sbomify.com/CVE-2020-14980/): Security feature bypass in sophos:sophos secure email (medium 5.9)
- [CVE-2020-1498](https://insights.sbomify.com/CVE-2020-1498/): Microsoft Excel Remote Code Execution Vulnerability (high 8.8)
- [CVE-2020-14979](https://insights.sbomify.com/CVE-2020-14979/): Privilege escalation in evga:precision x1 (high 7.8)
- [CVE-2020-14978](https://insights.sbomify.com/CVE-2020-14978/): Privilege escalation in f-secure:safe (high 8.1)
- [CVE-2020-14977](https://insights.sbomify.com/CVE-2020-14977/): Privilege escalation in f-secure:safe (high 8.1)
- [CVE-2020-14976](https://insights.sbomify.com/CVE-2020-14976/): Privilege escalation in gns3:ubridge (medium 5.5)
- [CVE-2020-14975](https://insights.sbomify.com/CVE-2020-14975/): Missing authorization in iobit:iobit unlocker (high 7.8)
- [CVE-2020-14974](https://insights.sbomify.com/CVE-2020-14974/): Privilege escalation in iobit:iobit unlocker (high 7.1)
- [CVE-2020-14973](https://insights.sbomify.com/CVE-2020-14973/): Cross-site scripting in webtareas project:webtareas (medium 6.1)
- [CVE-2020-14972](https://insights.sbomify.com/CVE-2020-14972/): SQL injection in pisay online e-learning system project:pisay online e-learning system (critical 9.8)
- [CVE-2020-14971](https://insights.sbomify.com/CVE-2020-14971/): Code injection in pi-hole:pi-hole (high 7.8)
- [CVE-2020-1497](https://insights.sbomify.com/CVE-2020-1497/): Microsoft Excel Information Disclosure Vulnerability (medium 5.5)
- [CVE-2020-14969](https://insights.sbomify.com/CVE-2020-14969/): Missing authorization in misp-project:misp (high 7.5)
- [CVE-2020-14968](https://insights.sbomify.com/CVE-2020-14968/): RSA-PSS signature validation vulnerability by prepending zeros in jsrsasign (critical 9.8)
- [CVE-2020-14967](https://insights.sbomify.com/CVE-2020-14967/): RSA PKCS#1 decryption vulnerability with prepending zeros in jsrsasign (critical 9.8)
- [CVE-2020-14966](https://insights.sbomify.com/CVE-2020-14966/): ECDSA signature validation vulnerability by accepting wrong ASN.1 encoding in jsrsasign (high 7.5)
- [CVE-2020-14965](https://insights.sbomify.com/CVE-2020-14965/): Cross-site scripting in tp-link:tl-wr740n firmware (medium 4.8)
- [CVE-2020-14962](https://insights.sbomify.com/CVE-2020-14962/): Cross-site scripting in machothemes:image photo gallery final tiles grid (medium 5.4)
- [CVE-2020-14961](https://insights.sbomify.com/CVE-2020-14961/): Unrestricted Uploads in Concrete5 (medium 5.3)
- [CVE-2020-14960](https://insights.sbomify.com/CVE-2020-14960/): SQL injection in php-fusion:php-fusion (high 7.2)
- [CVE-2020-1496](https://insights.sbomify.com/CVE-2020-1496/): Microsoft Excel Remote Code Execution Vulnerability (high 8.8)
- [CVE-2020-14959](https://insights.sbomify.com/CVE-2020-14959/): Cross-site scripting in goldplugins:easy testimonials (medium 5.4)
- [CVE-2020-14958](https://insights.sbomify.com/CVE-2020-14958/): Insecure Permissions in Gogs (medium 6.5)
- [CVE-2020-14957](https://insights.sbomify.com/CVE-2020-14957/): Memory corruption in arswp:windows cleanup assistant (high 7.8)
- [CVE-2020-14956](https://insights.sbomify.com/CVE-2020-14956/): Memory corruption in arswp:windows cleanup assistant (high 7.8)
- [CVE-2020-14955](https://insights.sbomify.com/CVE-2020-14955/): Memory corruption in jiangmin:jiangmin antivirus (medium 5.5)
- [CVE-2020-14954](https://insights.sbomify.com/CVE-2020-14954/): Other in canonical:ubuntu linux (medium 5.9)
- [CVE-2020-14950](https://insights.sbomify.com/CVE-2020-14950/): Command injection in aapanel:aapanel (high 8.8)
- [CVE-2020-1495](https://insights.sbomify.com/CVE-2020-1495/): Microsoft Excel Remote Code Execution Vulnerability (high 8.8)
- [CVE-2020-14947](https://insights.sbomify.com/CVE-2020-14947/): Command injection in factorfx:open computer software inventory next generation (high 8.8)
- [CVE-2020-14946](https://insights.sbomify.com/CVE-2020-14946/): Path traversal in globalradar:bsa radar (medium 4.3)
- [CVE-2020-14945](https://insights.sbomify.com/CVE-2020-14945/): Privilege escalation in globalradar:bsa radar (high 8.8)
- [CVE-2020-14944](https://insights.sbomify.com/CVE-2020-14944/): Missing authorization in globalradar:bsa radar (critical 9.8)
- [CVE-2020-14943](https://insights.sbomify.com/CVE-2020-14943/): Cross-site scripting in globalradar:bsa radar (medium 5.4)
- [CVE-2020-14942](https://insights.sbomify.com/CVE-2020-14942/): Deserialization of Untrusted Data in Tendenci (critical 9.8)
- [CVE-2020-14940](https://insights.sbomify.com/CVE-2020-14940/): XML external entity in herac:tuxguitar (high 7.5)
- [CVE-2020-1494](https://insights.sbomify.com/CVE-2020-1494/): Microsoft Excel Remote Code Execution Vulnerability (high 8.8)
- [CVE-2020-14939](https://insights.sbomify.com/CVE-2020-14939/): Code injection in freedroid:freedroidrpg (high 7.8)
- [CVE-2020-14938](https://insights.sbomify.com/CVE-2020-14938/): Memory corruption in freedroid:freedroidrpg (critical 9.8)
- [CVE-2020-14937](https://insights.sbomify.com/CVE-2020-14937/): Memory corruption in contiki-ng:contiki-ng (critical 9.1)
- [CVE-2020-14936](https://insights.sbomify.com/CVE-2020-14936/): Memory corruption in contiki-ng:contiki-ng (critical 9.8)
- [CVE-2020-14935](https://insights.sbomify.com/CVE-2020-14935/): Memory corruption in contiki-ng:contiki-ng (critical 9.8)
- [CVE-2020-14934](https://insights.sbomify.com/CVE-2020-14934/): Memory corruption in contiki-ng:contiki-ng (critical 9.8)
- [CVE-2020-14933](https://insights.sbomify.com/CVE-2020-14933/): Deserialization in squirrelmail:squirrelmail (high 8.8)
- [CVE-2020-14932](https://insights.sbomify.com/CVE-2020-14932/): Deserialization in squirrelmail:squirrelmail (critical 9.8)
- [CVE-2020-14931](https://insights.sbomify.com/CVE-2020-14931/): Memory corruption in dmitry project:dmitry (critical 9.8)
- [CVE-2020-14930](https://insights.sbomify.com/CVE-2020-14930/): Information disclosure in bt ctroms terminal project:bt ctroms terminal (high 8.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/161/