# Vulnerabilities published in 2020


- [CVE-2020-13960](https://insights.sbomify.com/CVE-2020-13960/): Misconfiguration in dlink:dir-600m firmware (high 7.5)
- [CVE-2020-1396](https://insights.sbomify.com/CVE-2020-1396/): Privilege escalation in Windows (high 7.8)
- [CVE-2020-13959](https://insights.sbomify.com/CVE-2020-13959/): Velocity Tools XSS Vulnerability (medium 6.1)
- [CVE-2020-13958](https://insights.sbomify.com/CVE-2020-13958/): Code injection in Apache OpenOffice (high 7.8)
- [CVE-2020-13957](https://insights.sbomify.com/CVE-2020-13957/): Incorrect Authorization in Apache Solr (critical 9.8)
- [CVE-2020-13956](https://insights.sbomify.com/CVE-2020-13956/): Cross-site scripting in Apache HttpClient (medium 5.3)
- [CVE-2020-13955](https://insights.sbomify.com/CVE-2020-13955/): Missing Authentication for Critical Function in Apache Calcite (medium 5.9)
- [CVE-2020-13954](https://insights.sbomify.com/CVE-2020-13954/): Apache CXF Reflected XSS in the services listing page via the styleSheetPath (medium 6.1)
- [CVE-2020-13953](https://insights.sbomify.com/CVE-2020-13953/): Improper file downloads in Apache Tapestry (medium 5.3)
- [CVE-2020-13952](https://insights.sbomify.com/CVE-2020-13952/): Plaintext password leak in Apache Superset (high 8.1)
- [CVE-2020-13951](https://insights.sbomify.com/CVE-2020-13951/): Denial of service in Apache OpenMeetings (high 7.5)
- [CVE-2020-13950](https://insights.sbomify.com/CVE-2020-13950/): mod_proxy_http NULL pointer dereference (high 7.5)
- [CVE-2020-1395](https://insights.sbomify.com/CVE-2020-1395/): Privilege escalation in Windows (high 7.8)
- [CVE-2020-13949](https://insights.sbomify.com/CVE-2020-13949/): Uncontrolled Resource Consumption in Apache Thrift (high 7.5)
- [CVE-2020-13948](https://insights.sbomify.com/CVE-2020-13948/): Apache Superset OS Command Injection (high 8.8)
- [CVE-2020-13947](https://insights.sbomify.com/CVE-2020-13947/): Cross-site scripting (XSS) in Apache ActiveMQ (medium 6.1)
- [CVE-2020-13946](https://insights.sbomify.com/CVE-2020-13946/): Man-in-the-middle attack in Apache Cassandra (medium 5.9)
- [CVE-2020-13945](https://insights.sbomify.com/CVE-2020-13945/): Auth bypass in Apache APISIX (medium 6.5)
- [CVE-2020-13944](https://insights.sbomify.com/CVE-2020-13944/): Apache Airflow Cross-site Scripting (medium 6.1)
- [CVE-2020-13943](https://insights.sbomify.com/CVE-2020-13943/): Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat (medium 4.3)
- [CVE-2020-13942](https://insights.sbomify.com/CVE-2020-13942/): Remote Code Execution in Apache Unomi (critical 9.8)
- [CVE-2020-13941](https://insights.sbomify.com/CVE-2020-13941/): Improper Input Validation in Apache Solr (high 8.8)
- [CVE-2020-13940](https://insights.sbomify.com/CVE-2020-13940/): Improper Restriction of XML External Entity Reference in Apache NiFi (medium 5.5)
- [CVE-2020-1394](https://insights.sbomify.com/CVE-2020-1394/): Privilege escalation in Windows (high 7.8)
- [CVE-2020-13938](https://insights.sbomify.com/CVE-2020-13938/): Improper Handling of Insufficient Privileges (medium 5.5)
- [CVE-2020-13937](https://insights.sbomify.com/CVE-2020-13937/): Authentication bypass in Apache Kylin (medium 5.3)
- [CVE-2020-13936](https://insights.sbomify.com/CVE-2020-13936/): Velocity Sandbox Bypass (high 8.8)
- [CVE-2020-13935](https://insights.sbomify.com/CVE-2020-13935/): Infinite Loop in Apache Tomcat (high 7.5)
- [CVE-2020-13934](https://insights.sbomify.com/CVE-2020-13934/): Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat (high 7.5)
- [CVE-2020-13933](https://insights.sbomify.com/CVE-2020-13933/): Authentication bypass in Apache Shiro (high 7.5)
- [CVE-2020-13932](https://insights.sbomify.com/CVE-2020-13932/): Cross-site Scripting (XSS) in Apache ActiveMQ Artemis (medium 6.1)
- [CVE-2020-13931](https://insights.sbomify.com/CVE-2020-13931/): Remote code execution in Apache TomEE (critical 9.8)
- [CVE-2020-1393](https://insights.sbomify.com/CVE-2020-1393/): Privilege escalation in Microsoft Visual Studio (high 7.8)
- [CVE-2020-13929](https://insights.sbomify.com/CVE-2020-13929/): Notebook permissions bypass (high 7.5)
- [CVE-2020-13928](https://insights.sbomify.com/CVE-2020-13928/): Cross-site scripting in Apache Atlas (medium 6.1)
- [CVE-2020-13927](https://insights.sbomify.com/CVE-2020-13927/): Apache Airflow's Experimental API Authentication Bypass (critical 9.8, exploited in the wild)
- [CVE-2020-13926](https://insights.sbomify.com/CVE-2020-13926/): SQL Injection in Kylin (critical 9.8)
- [CVE-2020-13925](https://insights.sbomify.com/CVE-2020-13925/): Command Injection in Kylin (critical 9.8)
- [CVE-2020-13924](https://insights.sbomify.com/CVE-2020-13924/): Path traversal in Apache Ambari (high 7.5)
- [CVE-2020-13923](https://insights.sbomify.com/CVE-2020-13923/): Missing authorization in Apache OFBiz (medium 5.3)
- [CVE-2020-13922](https://insights.sbomify.com/CVE-2020-13922/): Apache DolphinScheduler (incubating) Permission vulnerability (medium 6.5)
- [CVE-2020-13921](https://insights.sbomify.com/CVE-2020-13921/): SQL Injection in Apache SkyWalking (critical 9.8)
- [CVE-2020-13920](https://insights.sbomify.com/CVE-2020-13920/): Improper Authentication in Apache ActiveMQ (medium 5.9)
- [CVE-2020-1392](https://insights.sbomify.com/CVE-2020-1392/): Privilege escalation in Windows (high 7.8)
- [CVE-2020-13919](https://insights.sbomify.com/CVE-2020-13919/): Command injection in ruckuswireless:unleashed firmware (critical 9.8)
- [CVE-2020-13918](https://insights.sbomify.com/CVE-2020-13918/): Missing authorization in ruckuswireless:unleashed firmware (high 7.5)
- [CVE-2020-13917](https://insights.sbomify.com/CVE-2020-13917/): Command injection in ruckuswireless:unleashed firmware (critical 9.8)
- [CVE-2020-13916](https://insights.sbomify.com/CVE-2020-13916/): Memory corruption in ruckuswireless:unleashed firmware (critical 9.8)
- [CVE-2020-13915](https://insights.sbomify.com/CVE-2020-13915/): Missing authorization in ruckuswireless:unleashed firmware (high 7.5)
- [CVE-2020-13914](https://insights.sbomify.com/CVE-2020-13914/): Denial of service in ruckuswireless:unleashed firmware (high 7.5)
- [CVE-2020-13913](https://insights.sbomify.com/CVE-2020-13913/): Cross-site scripting in ruckuswireless:unleashed firmware (medium 6.1)
- [CVE-2020-13912](https://insights.sbomify.com/CVE-2020-13912/): Misconfiguration in solarwinds:advanced monitoring agent (high 7.3)
- [CVE-2020-13911](https://insights.sbomify.com/CVE-2020-13911/): Cross-site scripting in your online shop project:your online shop (medium 5.4)
- [CVE-2020-13910](https://insights.sbomify.com/CVE-2020-13910/): Memory corruption in pengutronix:barebox (critical 9.1)
- [CVE-2020-1391](https://insights.sbomify.com/CVE-2020-1391/): Information disclosure in Windows 10 Version 1903 for 32-bit Systems (medium 5.5)
- [CVE-2020-13909](https://insights.sbomify.com/CVE-2020-13909/): Critical severity vulnerability in Ignition (critical 9.8)
- [CVE-2020-13906](https://insights.sbomify.com/CVE-2020-13906/): Memory corruption in irfanview:irfanview (high 7.8)
- [CVE-2020-13905](https://insights.sbomify.com/CVE-2020-13905/): Memory corruption in irfanview:irfanview (high 8.8)
- [CVE-2020-13904](https://insights.sbomify.com/CVE-2020-13904/): Use after free in canonical:ubuntu linux (medium 5.5)
- [CVE-2020-13902](https://insights.sbomify.com/CVE-2020-13902/): Memory corruption in imagemagick:imagemagick (high 7.1)
- [CVE-2020-13901](https://insights.sbomify.com/CVE-2020-13901/): Memory corruption in meetecho:janus (critical 9.8)
- [CVE-2020-13900](https://insights.sbomify.com/CVE-2020-13900/): Null dereference in meetecho:janus (high 7.5)
- [CVE-2020-1390](https://insights.sbomify.com/CVE-2020-1390/): Privilege escalation in Windows (high 7.8)
- [CVE-2020-13899](https://insights.sbomify.com/CVE-2020-13899/): Information disclosure in meetecho:janus (high 7.5)
- [CVE-2020-13898](https://insights.sbomify.com/CVE-2020-13898/): Null dereference in meetecho:janus (high 7.5)
- [CVE-2020-13897](https://insights.sbomify.com/CVE-2020-13897/): HESK before 3.1.10 allows reflected XSS. (medium 6.1)
- [CVE-2020-13896](https://insights.sbomify.com/CVE-2020-13896/): Information disclosure in maipu:mp1800x-50 firmware (medium 5.3)
- [CVE-2020-13895](https://insights.sbomify.com/CVE-2020-13895/): Weak cryptography in p5-crypt-perl project:p5-crypt-perl (high 8.8)
- [CVE-2020-13894](https://insights.sbomify.com/CVE-2020-13894/): Path traversal in dext5:dext5 (high 7.5)
- [CVE-2020-13893](https://insights.sbomify.com/CVE-2020-13893/): Cross-site scripting in sage:easypay (medium 5.4)
- [CVE-2020-13892](https://insights.sbomify.com/CVE-2020-13892/): Cross-site scripting in themeboy:sportspress (medium 5.4)
- [CVE-2020-13891](https://insights.sbomify.com/CVE-2020-13891/): Information disclosure in mattermost:mattermost (high 7.5)
- [CVE-2020-13890](https://insights.sbomify.com/CVE-2020-13890/): Cross-site scripting in laborator:neon (medium 5.4)
- [CVE-2020-1389](https://insights.sbomify.com/CVE-2020-1389/): Information disclosure in Windows (medium 5.5)
- [CVE-2020-13889](https://insights.sbomify.com/CVE-2020-13889/): Cross-site scripting in bludit:bludit (medium 5.4)
- [CVE-2020-13888](https://insights.sbomify.com/CVE-2020-13888/): Cross-site scripting in kordil edms project:kordil edms (medium 5.4)
- [CVE-2020-13887](https://insights.sbomify.com/CVE-2020-13887/): File upload in kordil edms project:kordil edms (high 8.8)
- [CVE-2020-13886](https://insights.sbomify.com/CVE-2020-13886/): Path traversal in intelbras:tip200 firmware (medium 5.3)
- [CVE-2020-13885](https://insights.sbomify.com/CVE-2020-13885/): Privilege escalation in citrix:workspace app (high 7.8)
- [CVE-2020-13884](https://insights.sbomify.com/CVE-2020-13884/): Privilege escalation in citrix:workspace app (high 7.8)
- [CVE-2020-13883](https://insights.sbomify.com/CVE-2020-13883/): XML external entity in wso2:api manager (medium 5.5)
- [CVE-2020-13882](https://insights.sbomify.com/CVE-2020-13882/): Race condition in cisofy:lynis (medium 4.2)
- [CVE-2020-13881](https://insights.sbomify.com/CVE-2020-13881/): Information disclosure in arista:cloudvision portal (high 7.5)
- [CVE-2020-13880](https://insights.sbomify.com/CVE-2020-13880/): Memory corruption in irfanview:b3d (critical 9.8)
- [CVE-2020-1388](https://insights.sbomify.com/CVE-2020-1388/): Privilege escalation in Windows (high 7.8)
- [CVE-2020-13879](https://insights.sbomify.com/CVE-2020-13879/): Memory corruption in irfanview:b3d (critical 9.8)
- [CVE-2020-13878](https://insights.sbomify.com/CVE-2020-13878/): Memory corruption in irfanview:b3d (critical 9.8)
- [CVE-2020-13877](https://insights.sbomify.com/CVE-2020-13877/): SQL injection in resourcexpress:meeting monitor (critical 9.8)
- [CVE-2020-13873](https://insights.sbomify.com/CVE-2020-13873/): SQL injection in codologic:codoforum (critical 9.8)
- [CVE-2020-13872](https://insights.sbomify.com/CVE-2020-13872/): Auth bypass in royalapps:royal ts (high 8.8)
- [CVE-2020-13871](https://insights.sbomify.com/CVE-2020-13871/): Use after free in debian:debian linux (high 7.5)
- [CVE-2020-13870](https://insights.sbomify.com/CVE-2020-13870/): Comments plugin stored Cross-site Scripting (XSS) via an asset volume name (medium 5.4)
- [CVE-2020-1387](https://insights.sbomify.com/CVE-2020-1387/): Privilege escalation in Windows (high 7.8)
- [CVE-2020-13869](https://insights.sbomify.com/CVE-2020-13869/): Comments plugin stored Cross-site Scripting via a guest name (medium 5.4)
- [CVE-2020-13868](https://insights.sbomify.com/CVE-2020-13868/): Comments plugin Cross-Site Request Forgery (CSRF) (medium 6.5)
- [CVE-2020-13867](https://insights.sbomify.com/CVE-2020-13867/): Misconfiguration in fedoraproject:fedora (medium 5.5)
- [CVE-2020-13866](https://insights.sbomify.com/CVE-2020-13866/): Misconfiguration in qbik:wingate (high 7.8)
- [CVE-2020-13865](https://insights.sbomify.com/CVE-2020-13865/): Cross-site scripting in elementor:elementor page builder (medium 5.4)
- [CVE-2020-13864](https://insights.sbomify.com/CVE-2020-13864/): Cross-site scripting in elementor:elementor page builder (medium 5.4)
- [CVE-2020-13863](https://insights.sbomify.com/CVE-2020-13863/): Other in mitel:micollab (high 8.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/171/