# Vulnerabilities published in 2020


- [CVE-2020-14073](https://insights.sbomify.com/CVE-2020-14073/): Cross-site scripting in paessler:prtg network monitor (medium 5.4)
- [CVE-2020-14072](https://insights.sbomify.com/CVE-2020-14072/): Command injection in mk-auth:mk-auth (critical 9.8)
- [CVE-2020-14071](https://insights.sbomify.com/CVE-2020-14071/): Cross-site scripting in mk-auth:mk-auth (medium 6.1)
- [CVE-2020-14070](https://insights.sbomify.com/CVE-2020-14070/): Auth bypass in mk-auth:mk-auth (critical 9.8)
- [CVE-2020-1407](https://insights.sbomify.com/CVE-2020-1407/): Memory corruption in Windows (high 7.8)
- [CVE-2020-14069](https://insights.sbomify.com/CVE-2020-14069/): SQL injection in mk-auth:mk-auth (medium 6.8)
- [CVE-2020-14068](https://insights.sbomify.com/CVE-2020-14068/): SQL injection in mk-auth:mk-auth (critical 9.8)
- [CVE-2020-14067](https://insights.sbomify.com/CVE-2020-14067/): File upload in naviwebs:navigatecms (critical 9.8)
- [CVE-2020-14066](https://insights.sbomify.com/CVE-2020-14066/): File upload in icewarp:mail server (high 8.8)
- [CVE-2020-14065](https://insights.sbomify.com/CVE-2020-14065/): File upload in icewarp:mail server (medium 6.5)
- [CVE-2020-14064](https://insights.sbomify.com/CVE-2020-14064/): Missing authorization in icewarp:mail server (medium 6.5)
- [CVE-2020-14063](https://insights.sbomify.com/CVE-2020-14063/): Cross-site scripting in tc custom javascript project:tc custom javascript (medium 6.1)
- [CVE-2020-14062](https://insights.sbomify.com/CVE-2020-14062/): Deserialization of untrusted data in Jackson Databind (high 8.1)
- [CVE-2020-14061](https://insights.sbomify.com/CVE-2020-14061/): Deserialization of untrusted data in Jackson Databind (high 8.1)
- [CVE-2020-14060](https://insights.sbomify.com/CVE-2020-14060/): Deserialization of untrusted data in Jackson Databind (high 8.1)
- [CVE-2020-1406](https://insights.sbomify.com/CVE-2020-1406/): Privilege escalation in Windows (high 7.8)
- [CVE-2020-14059](https://insights.sbomify.com/CVE-2020-14059/): Race condition in squid-cache:squid (medium 6.5)
- [CVE-2020-14058](https://insights.sbomify.com/CVE-2020-14058/): Null dereference in fedoraproject:fedora (high 7.5)
- [CVE-2020-14057](https://insights.sbomify.com/CVE-2020-14057/): Path traversal in monstaftp:monsta ftp (critical 9.8)
- [CVE-2020-14056](https://insights.sbomify.com/CVE-2020-14056/): Server-side request forgery in monstaftp:monsta ftp (critical 9.8)
- [CVE-2020-14055](https://insights.sbomify.com/CVE-2020-14055/): Cross-site scripting in monstaftp:monsta ftp (medium 6.1)
- [CVE-2020-14054](https://insights.sbomify.com/CVE-2020-14054/): SQL injection in sokkia:gnr5 vanguard firmware (critical 9.8)
- [CVE-2020-1405](https://insights.sbomify.com/CVE-2020-1405/): Privilege escalation in Windows (high 7.1)
- [CVE-2020-14049](https://insights.sbomify.com/CVE-2020-14049/): Command injection in rakuten:viber (high 7.5)
- [CVE-2020-14048](https://insights.sbomify.com/CVE-2020-14048/): Missing authorization in zohocorp:manageengine servicedesk plus (high 7.5)
- [CVE-2020-14044](https://insights.sbomify.com/CVE-2020-14044/): Codiad SSRF Vulnerability (high 7.2)
- [CVE-2020-14043](https://insights.sbomify.com/CVE-2020-14043/): Codiad CSRF Vulnerability (high 8.8)
- [CVE-2020-14042](https://insights.sbomify.com/CVE-2020-14042/): Codiad Cross-site Scripting Vulnerability (medium 6.1)
- [CVE-2020-14040](https://insights.sbomify.com/CVE-2020-14040/): golang.org/x/text Infinite loop (high 7.5)
- [CVE-2020-1404](https://insights.sbomify.com/CVE-2020-1404/): Privilege escalation in Windows (high 7.8)
- [CVE-2020-14039](https://insights.sbomify.com/CVE-2020-14039/): Security feature bypass in golang:go (medium 5.3)
- [CVE-2020-14034](https://insights.sbomify.com/CVE-2020-14034/): Memory corruption in meetecho:janus (critical 9.8)
- [CVE-2020-14033](https://insights.sbomify.com/CVE-2020-14033/): Memory corruption in meetecho:janus (critical 9.8)
- [CVE-2020-14032](https://insights.sbomify.com/CVE-2020-14032/): Privilege escalation in asrock:box-r1000 firmware (critical 9.8)
- [CVE-2020-14031](https://insights.sbomify.com/CVE-2020-14031/): Path traversal in ozeki:ozeki ng sms gateway (high 7.2)
- [CVE-2020-14030](https://insights.sbomify.com/CVE-2020-14030/): Deserialization in ozeki:ozeki ng sms gateway (high 7.2)
- [CVE-2020-1403](https://insights.sbomify.com/CVE-2020-1403/): Memory corruption in Internet Explorer 11 (high 7.5)
- [CVE-2020-14029](https://insights.sbomify.com/CVE-2020-14029/): XML external entity in ozeki:ozeki ng sms gateway (high 7.5)
- [CVE-2020-14028](https://insights.sbomify.com/CVE-2020-14028/): Path traversal in ozeki:ozeki ng sms gateway (high 7.2)
- [CVE-2020-14027](https://insights.sbomify.com/CVE-2020-14027/): Command injection in ozeki:ozeki ng sms gateway (medium 5.3)
- [CVE-2020-14026](https://insights.sbomify.com/CVE-2020-14026/): Code injection in ozeki:ozeki ng sms gateway (high 8.8)
- [CVE-2020-14025](https://insights.sbomify.com/CVE-2020-14025/): Cross-site request forgery in ozeki:ozeki ng sms gateway (high 8.8)
- [CVE-2020-14024](https://insights.sbomify.com/CVE-2020-14024/): Cross-site scripting in ozeki:ozeki ng sms gateway (medium 6.1)
- [CVE-2020-14023](https://insights.sbomify.com/CVE-2020-14023/): Server-side request forgery in ozeki:ozeki ng sms gateway (medium 4.9)
- [CVE-2020-14022](https://insights.sbomify.com/CVE-2020-14022/): File upload in ozeki:ozeki ng sms gateway (high 8.8)
- [CVE-2020-14021](https://insights.sbomify.com/CVE-2020-14021/): Path traversal in ozeki:ozeki ng sms gateway (medium 4.9)
- [CVE-2020-1402](https://insights.sbomify.com/CVE-2020-1402/): Memory corruption in Windows (high 7.8)
- [CVE-2020-14019](https://insights.sbomify.com/CVE-2020-14019/): rtslib-fb weak permissions for /etc/target/saveconfig.json file (high 7.8)
- [CVE-2020-14018](https://insights.sbomify.com/CVE-2020-14018/): Cross-site scripting in naviwebs:navigate cms (medium 6.1)
- [CVE-2020-14017](https://insights.sbomify.com/CVE-2020-14017/): Information disclosure in naviwebs:navigate cms (high 7.5)
- [CVE-2020-14016](https://insights.sbomify.com/CVE-2020-14016/): Information disclosure in naviwebs:navigate cms (medium 5.3)
- [CVE-2020-14015](https://insights.sbomify.com/CVE-2020-14015/): Auth bypass in naviwebs:navigate cms (high 7.5)
- [CVE-2020-14014](https://insights.sbomify.com/CVE-2020-14014/): Cross-site scripting in naviwebs:navigate cms (medium 5.4)
- [CVE-2020-14012](https://insights.sbomify.com/CVE-2020-14012/): Cross-site scripting in enhancesoft:osticket (medium 5.4)
- [CVE-2020-14011](https://insights.sbomify.com/CVE-2020-14011/): Hardcoded credentials in lansweeper:lansweeper (critical 9.8)
- [CVE-2020-14010](https://insights.sbomify.com/CVE-2020-14010/): Cross-site scripting in laborator:xenon (medium 6.1)
- [CVE-2020-1401](https://insights.sbomify.com/CVE-2020-1401/): Memory corruption in Windows (high 7.8)
- [CVE-2020-14009](https://insights.sbomify.com/CVE-2020-14009/): Security feature bypass in proofpoint:enterprise protection (medium 6.3)
- [CVE-2020-14008](https://insights.sbomify.com/CVE-2020-14008/): File upload in zohocorp:manageengine applications manager (high 7.2)
- [CVE-2020-14007](https://insights.sbomify.com/CVE-2020-14007/): Cross-site scripting in solarwinds:orion network performance monitor (medium 5.4)
- [CVE-2020-14006](https://insights.sbomify.com/CVE-2020-14006/): Cross-site scripting in solarwinds:orion network performance monitor (medium 5.4)
- [CVE-2020-14005](https://insights.sbomify.com/CVE-2020-14005/): Code injection in solarwinds:orion network performance monitor (high 8.8)
- [CVE-2020-14004](https://insights.sbomify.com/CVE-2020-14004/): Privilege escalation in icinga:icinga (high 7.8)
- [CVE-2020-14002](https://insights.sbomify.com/CVE-2020-14002/): Information disclosure in fedoraproject:fedora (medium 5.9)
- [CVE-2020-14001](https://insights.sbomify.com/CVE-2020-14001/): Unintended read access in kramdown gem (critical 9.8)
- [CVE-2020-14000](https://insights.sbomify.com/CVE-2020-14000/): Remote Code Execution in scratch-vm (critical 9.8)
- [CVE-2020-1400](https://insights.sbomify.com/CVE-2020-1400/): Integer overflow in Windows (high 7.8)
- [CVE-2020-13999](https://insights.sbomify.com/CVE-2020-13999/): Integer overflow in fedoraproject:fedora (medium 5.5)
- [CVE-2020-13998](https://insights.sbomify.com/CVE-2020-13998/): Information disclosure in citrix:xenapp (high 7.5)
- [CVE-2020-13997](https://insights.sbomify.com/CVE-2020-13997/): Shopware database password is leaked to an unauthenticated users (high 7.5)
- [CVE-2020-13996](https://insights.sbomify.com/CVE-2020-13996/): SQL injection in j2store:j2store (high 8.8)
- [CVE-2020-13995](https://insights.sbomify.com/CVE-2020-13995/): Memory corruption in airforce:nitf extract utility (critical 9.8)
- [CVE-2020-13994](https://insights.sbomify.com/CVE-2020-13994/): File upload in mods-for-hesk:mods for hesk (high 8.8)
- [CVE-2020-13993](https://insights.sbomify.com/CVE-2020-13993/): SQL injection in mods-for-hesk:mods for hesk (high 7.5)
- [CVE-2020-13992](https://insights.sbomify.com/CVE-2020-13992/): Cross-site scripting in mods-for-hesk:mods for hesk (medium 6.1)
- [CVE-2020-13991](https://insights.sbomify.com/CVE-2020-13991/): Other in jerryscript:jerryscript (high 7.5)
- [CVE-2020-1399](https://insights.sbomify.com/CVE-2020-1399/): Privilege escalation in Windows (high 7.8)
- [CVE-2020-13988](https://insights.sbomify.com/CVE-2020-13988/): Integer overflow in contiki-ng:contiki-ng (high 7.5)
- [CVE-2020-13987](https://insights.sbomify.com/CVE-2020-13987/): Memory corruption in open-iscsi project:open-iscsi (high 7.5)
- [CVE-2020-13986](https://insights.sbomify.com/CVE-2020-13986/): Denial of service in contiki-os:contiki (high 7.5)
- [CVE-2020-13985](https://insights.sbomify.com/CVE-2020-13985/): Memory corruption in contiki-os:contiki (high 7.5)
- [CVE-2020-13984](https://insights.sbomify.com/CVE-2020-13984/): Denial of service in contiki-os:contiki (high 7.5)
- [CVE-2020-13980](https://insights.sbomify.com/CVE-2020-13980/): OpenCart Cross-site Scripting (medium 4.8)
- [CVE-2020-1398](https://insights.sbomify.com/CVE-2020-1398/): Privilege escalation in Windows (medium 6.8)
- [CVE-2020-13978](https://insights.sbomify.com/CVE-2020-13978/): Command injection in monstra:monstra cms (high 7.2)
- [CVE-2020-13977](https://insights.sbomify.com/CVE-2020-13977/): Code injection in fedoraproject:fedora (medium 4.9)
- [CVE-2020-13976](https://insights.sbomify.com/CVE-2020-13976/): Command injection in dd-wrt:dd-wrt (high 8.8)
- [CVE-2020-13974](https://insights.sbomify.com/CVE-2020-13974/): Integer overflow in canonical:ubuntu linux (high 7.8)
- [CVE-2020-13973](https://insights.sbomify.com/CVE-2020-13973/): Cross-site scripting in json-sanitizer (medium 6.1)
- [CVE-2020-13972](https://insights.sbomify.com/CVE-2020-13972/): Cross-site scripting in enghouse:web chat (medium 6.1)
- [CVE-2020-13971](https://insights.sbomify.com/CVE-2020-13971/): Shopware vulnerable to Cross-site Scripting (medium 5.4)
- [CVE-2020-13970](https://insights.sbomify.com/CVE-2020-13970/): Shopware vulnerable to SSRF (high 8.8)
- [CVE-2020-1397](https://insights.sbomify.com/CVE-2020-1397/): Information disclosure in Windows (medium 6.5)
- [CVE-2020-13969](https://insights.sbomify.com/CVE-2020-13969/): Cross-site scripting in crk:business platform (medium 6.1)
- [CVE-2020-13968](https://insights.sbomify.com/CVE-2020-13968/): SQL injection in crk:business platform (critical 9.8)
- [CVE-2020-13965](https://insights.sbomify.com/CVE-2020-13965/): Roundcube Webmail Cross-Site Scripting (XSS) (medium 6.3, exploited in the wild)
- [CVE-2020-13964](https://insights.sbomify.com/CVE-2020-13964/): Cross-site scripting in debian:debian linux (medium 6.1)
- [CVE-2020-13963](https://insights.sbomify.com/CVE-2020-13963/): Hardcoded credentials in soplanning:soplanning (critical 9.8)
- [CVE-2020-13962](https://insights.sbomify.com/CVE-2020-13962/): Denial of service in fedoraproject:fedora (high 7.5)
- [CVE-2020-13961](https://insights.sbomify.com/CVE-2020-13961/): Improper Input Validation in strapi (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/170/