# Vulnerabilities published in 2020


- [CVE-2020-13761](https://insights.sbomify.com/CVE-2020-13761/): Cross-site scripting in joomla:joomla\! (medium 6.1)
- [CVE-2020-13760](https://insights.sbomify.com/CVE-2020-13760/): Cross-site request forgery in joomla:joomla\! (high 8.8)
- [CVE-2020-1376](https://insights.sbomify.com/CVE-2020-1376/): Windows Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2020-13759](https://insights.sbomify.com/CVE-2020-13759/): Improper Synchronization and Race Condition in vm-memory (high 7.5)
- [CVE-2020-13758](https://insights.sbomify.com/CVE-2020-13758/): Cross-site scripting in bitrix:bitrix24 (medium 6.1)
- [CVE-2020-13757](https://insights.sbomify.com/CVE-2020-13757/): Python-RSA decryption of ciphertext leads to DoS (high 7.5)
- [CVE-2020-13756](https://insights.sbomify.com/CVE-2020-13756/): Sabberworm PHP CSS Parser Code injection vulnerability in allSelectors() (critical 9.8)
- [CVE-2020-13754](https://insights.sbomify.com/CVE-2020-13754/): Memory corruption in canonical:ubuntu linux (medium 6.7)
- [CVE-2020-13753](https://insights.sbomify.com/CVE-2020-13753/): Security feature bypass in canonical:ubuntu linux (critical 10.0)
- [CVE-2020-1375](https://insights.sbomify.com/CVE-2020-1375/): Privilege escalation in Windows (high 7.8)
- [CVE-2020-1374](https://insights.sbomify.com/CVE-2020-1374/): Other in Windows (high 7.5)
- [CVE-2020-1373](https://insights.sbomify.com/CVE-2020-1373/): Privilege escalation in Windows (high 7.8)
- [CVE-2020-1372](https://insights.sbomify.com/CVE-2020-1372/): Privilege escalation in Windows (high 7.8)
- [CVE-2020-13712](https://insights.sbomify.com/CVE-2020-13712/): MGOS Command Injection (high 7.8)
- [CVE-2020-1371](https://insights.sbomify.com/CVE-2020-1371/): Memory corruption in Windows (high 7.8)
- [CVE-2020-13702](https://insights.sbomify.com/CVE-2020-13702/): Information disclosure in the rolling proximity identifier project:the rolling proximity identifier (medium 4.3)
- [CVE-2020-13700](https://insights.sbomify.com/CVE-2020-13700/): acf-to-rest-api plugin insecure direct object reference (IDOR) via permalink manipulation (high 7.5)
- [CVE-2020-1370](https://insights.sbomify.com/CVE-2020-1370/): Privilege escalation in Windows (high 7.8)
- [CVE-2020-13699](https://insights.sbomify.com/CVE-2020-13699/): Command injection in teamviewer:teamviewer (high 8.8)
- [CVE-2020-13697](https://insights.sbomify.com/CVE-2020-13697/): NanoHTTPD Cross-site Scripting vulnerability (medium 6.1)
- [CVE-2020-13696](https://insights.sbomify.com/CVE-2020-13696/): Path traversal in canonical:ubuntu linux (medium 4.4)
- [CVE-2020-13695](https://insights.sbomify.com/CVE-2020-13695/): Privilege escalation in quickbox:quickbox (high 7.2)
- [CVE-2020-13694](https://insights.sbomify.com/CVE-2020-13694/): Command injection in quickbox:quickbox (high 8.8)
- [CVE-2020-13693](https://insights.sbomify.com/CVE-2020-13693/): bbPress unauthenticated privilege-escalation (critical 9.8)
- [CVE-2020-13692](https://insights.sbomify.com/CVE-2020-13692/): Improper Restriction of XML External Entity Reference (high 7.7)
- [CVE-2020-1369](https://insights.sbomify.com/CVE-2020-1369/): Privilege escalation in Windows (high 7.8)
- [CVE-2020-13688](https://insights.sbomify.com/CVE-2020-13688/): Drupal Core Cross-site scripting vulnerability (medium 6.1)
- [CVE-2020-1368](https://insights.sbomify.com/CVE-2020-1368/): Privilege escalation in Windows (high 7.8)
- [CVE-2020-13677](https://insights.sbomify.com/CVE-2020-13677/): Drupal core access bypass vulnerability (high 7.5)
- [CVE-2020-13676](https://insights.sbomify.com/CVE-2020-13676/): Incorrect Authorization in Drupal core (medium 6.5)
- [CVE-2020-13675](https://insights.sbomify.com/CVE-2020-13675/): Unrestricted Upload of File with Dangerous Type in Drupal core (critical 9.8)
- [CVE-2020-13674](https://insights.sbomify.com/CVE-2020-13674/): Cross-Site Request Forgery in Drupal core (medium 6.5)
- [CVE-2020-13673](https://insights.sbomify.com/CVE-2020-13673/): Cross-site scripting in Entity Embed (medium 6.1)
- [CVE-2020-13672](https://insights.sbomify.com/CVE-2020-13672/): Drupal core Cross-site Scripting (XSS) vulnerability (medium 6.1)
- [CVE-2020-13671](https://insights.sbomify.com/CVE-2020-13671/): Drupal core Un-restricted Upload of File (high 8.8, exploited in the wild)
- [CVE-2020-13670](https://insights.sbomify.com/CVE-2020-13670/): Exposure of Resource to Wrong Sphere in Drupal Core (high 7.5)
- [CVE-2020-1367](https://insights.sbomify.com/CVE-2020-1367/): Information disclosure in Windows (medium 5.5)
- [CVE-2020-13669](https://insights.sbomify.com/CVE-2020-13669/): Drupal core Cross-site Scripting (XSS) vulnerability in ckeditor (medium 6.1)
- [CVE-2020-13668](https://insights.sbomify.com/CVE-2020-13668/): Access bypass in Drupal Core 8/9 (medium 6.1)
- [CVE-2020-13667](https://insights.sbomify.com/CVE-2020-13667/): Drupal Core Access bypass vulnerability (medium 5.3)
- [CVE-2020-13666](https://insights.sbomify.com/CVE-2020-13666/): Drupal Core Cross-site scripting vulnerability (medium 6.1)
- [CVE-2020-13665](https://insights.sbomify.com/CVE-2020-13665/): Drupal Core Access bypass vulnerability (critical 9.8)
- [CVE-2020-13664](https://insights.sbomify.com/CVE-2020-13664/): Drupal Core Arbitrary PHP code execution vulnerability (high 8.8)
- [CVE-2020-13663](https://insights.sbomify.com/CVE-2020-13663/): Drupal Core Cross-Site Request Forgery (CSRF) vulnerability (high 8.8)
- [CVE-2020-13662](https://insights.sbomify.com/CVE-2020-13662/): Drupal Core Open Redirect vulnerability (medium 6.1)
- [CVE-2020-13661](https://insights.sbomify.com/CVE-2020-13661/): Command injection in telerik:fiddler (high 8.8)
- [CVE-2020-13660](https://insights.sbomify.com/CVE-2020-13660/): Cross-site scripting in cmsmadesimple:cms made simple (medium 4.8)
- [CVE-2020-1366](https://insights.sbomify.com/CVE-2020-1366/): Privilege escalation in Windows (high 7.8)
- [CVE-2020-13659](https://insights.sbomify.com/CVE-2020-13659/): Null dereference in canonical:ubuntu linux (low 2.5)
- [CVE-2020-13658](https://insights.sbomify.com/CVE-2020-13658/): Cross-site request forgery in lansweeper:lansweeper (high 8.0)
- [CVE-2020-13657](https://insights.sbomify.com/CVE-2020-13657/): Privilege escalation in avast:avg antivirus (medium 5.5)
- [CVE-2020-13656](https://insights.sbomify.com/CVE-2020-13656/): Memory corruption in morganstanley:hobbes (critical 9.8)
- [CVE-2020-13655](https://insights.sbomify.com/CVE-2020-13655/): Cross-site scripting in o-dyn:collabtive (medium 6.1)
- [CVE-2020-13654](https://insights.sbomify.com/CVE-2020-13654/): Improper escaping in XWiki Platform (high 7.5)
- [CVE-2020-13653](https://insights.sbomify.com/CVE-2020-13653/): Cross-site scripting in synacor:zimbra collaboration suite (medium 6.1)
- [CVE-2020-13652](https://insights.sbomify.com/CVE-2020-13652/): Cross-site scripting in digdash:digdash (medium 6.1)
- [CVE-2020-13651](https://insights.sbomify.com/CVE-2020-13651/): Code injection in digdash:digdash (high 7.8)
- [CVE-2020-13650](https://insights.sbomify.com/CVE-2020-13650/): Server-side request forgery in digdash:digdash (high 7.5)
- [CVE-2020-1365](https://insights.sbomify.com/CVE-2020-1365/): Memory corruption in Windows (high 7.8)
- [CVE-2020-13649](https://insights.sbomify.com/CVE-2020-13649/): Null dereference in jerryscript:jerryscript (high 7.5)
- [CVE-2020-13646](https://insights.sbomify.com/CVE-2020-13646/): Memory corruption in ijinshan:cheetah free wifi (high 7.8)
- [CVE-2020-13645](https://insights.sbomify.com/CVE-2020-13645/): Security feature bypass in broadcom:fabric operating system (medium 6.5)
- [CVE-2020-13644](https://insights.sbomify.com/CVE-2020-13644/): Cross-site scripting in pickplugins:accordion (medium 5.4)
- [CVE-2020-13643](https://insights.sbomify.com/CVE-2020-13643/): Cross-site request forgery in siteorigin:page builder (high 8.8)
- [CVE-2020-13642](https://insights.sbomify.com/CVE-2020-13642/): Cross-site request forgery in siteorigin:page builder (high 8.8)
- [CVE-2020-13641](https://insights.sbomify.com/CVE-2020-13641/): Cross-site request forgery in infolific:real-time find and replace (high 8.8)
- [CVE-2020-13640](https://insights.sbomify.com/CVE-2020-13640/): SQL injection in gvectors:wpdiscuz (critical 9.8)
- [CVE-2020-1364](https://insights.sbomify.com/CVE-2020-1364/): Denial of service in Windows (high 7.1)
- [CVE-2020-13639](https://insights.sbomify.com/CVE-2020-13639/): Cross-site scripting in outsystems:lifetime management console (medium 6.1)
- [CVE-2020-13638](https://insights.sbomify.com/CVE-2020-13638/): Auth bypass in rconfig:rconfig (critical 9.8)
- [CVE-2020-13637](https://insights.sbomify.com/CVE-2020-13637/): Information disclosure in heinekingmedia:stashcat (high 7.5)
- [CVE-2020-13634](https://insights.sbomify.com/CVE-2020-13634/): Memory corruption in youhua:windows master (high 7.8)
- [CVE-2020-13633](https://insights.sbomify.com/CVE-2020-13633/): Fork CMS Cross-site Scripting Vulnerability (medium 6.1)
- [CVE-2020-13632](https://insights.sbomify.com/CVE-2020-13632/): Null dereference in broadcom:fabric operating system (medium 5.5)
- [CVE-2020-13631](https://insights.sbomify.com/CVE-2020-13631/): Other in apple:icloud (medium 5.5)
- [CVE-2020-13630](https://insights.sbomify.com/CVE-2020-13630/): Use after free in apple:icloud (high 7.0)
- [CVE-2020-1363](https://insights.sbomify.com/CVE-2020-1363/): Memory corruption in Windows (high 7.8)
- [CVE-2020-13628](https://insights.sbomify.com/CVE-2020-13628/): Cross-site scripting in centreon:centreon host-monitoring widget (medium 6.1)
- [CVE-2020-13627](https://insights.sbomify.com/CVE-2020-13627/): Cross-site scripting in centreon:centreon host-monitoring widget (medium 6.1)
- [CVE-2020-13626](https://insights.sbomify.com/CVE-2020-13626/): Missing authorization in oneplus:app locker (medium 4.6)
- [CVE-2020-13625](https://insights.sbomify.com/CVE-2020-13625/): Insufficient output escaping of attachment names in PHPMailer (high 7.5)
- [CVE-2020-13623](https://insights.sbomify.com/CVE-2020-13623/): Denial of service in jerryscript:jerryscript (high 7.5)
- [CVE-2020-13622](https://insights.sbomify.com/CVE-2020-13622/): Denial of service in jerryscript:jerryscript (high 7.5)
- [CVE-2020-13620](https://insights.sbomify.com/CVE-2020-13620/): Cross-site request forgery in fastweb:fastgate gpon fga2130fwb firmware (high 8.8)
- [CVE-2020-1362](https://insights.sbomify.com/CVE-2020-1362/): Privilege escalation in Windows (high 7.8)
- [CVE-2020-13619](https://insights.sbomify.com/CVE-2020-13619/): OS Command Injection in Locutus (critical 9.8)
- [CVE-2020-13617](https://insights.sbomify.com/CVE-2020-13617/): Information disclosure in mitel:6863 firmware (high 7.5)
- [CVE-2020-13616](https://insights.sbomify.com/CVE-2020-13616/): Security feature bypass in pichi project:pichi (medium 5.9)
- [CVE-2020-13615](https://insights.sbomify.com/CVE-2020-13615/): Security feature bypass in qore:qore (medium 5.9)
- [CVE-2020-13614](https://insights.sbomify.com/CVE-2020-13614/): Security feature bypass in axel project:axel (medium 5.9)
- [CVE-2020-1361](https://insights.sbomify.com/CVE-2020-1361/): Information disclosure in Windows (medium 5.5)
- [CVE-2020-13603](https://insights.sbomify.com/CVE-2020-13603/): Integer Overflow in memory allocating functions (medium 6.9)
- [CVE-2020-13602](https://insights.sbomify.com/CVE-2020-13602/): Remote Denial of Service in LwM2M do_write_op_tlv (medium 4.0)
- [CVE-2020-13601](https://insights.sbomify.com/CVE-2020-13601/): Possible read out of bounds in dns read (critical 9.0)
- [CVE-2020-13600](https://insights.sbomify.com/CVE-2020-13600/): Malformed SPI in response for eswifi can corrupt kernel memory (high 7.0)
- [CVE-2020-1360](https://insights.sbomify.com/CVE-2020-1360/): Privilege escalation in Windows (high 7.8)
- [CVE-2020-13599](https://insights.sbomify.com/CVE-2020-13599/): Security problem with settings and littlefs (low 3.3)
- [CVE-2020-13598](https://insights.sbomify.com/CVE-2020-13598/): FS: Buffer Overflow when enabling Long File Names in FAT_FS and calling fs_stat (medium 6.3)
- [CVE-2020-13597](https://insights.sbomify.com/CVE-2020-13597/): Calico nodes IPv6 traffic redirection from route advertisment (medium 6.0)
- [CVE-2020-13596](https://insights.sbomify.com/CVE-2020-13596/): XSS in Django (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/173/