# Vulnerabilities published in 2020


- [CVE-2020-13498](https://insights.sbomify.com/CVE-2020-13498/): Memory corruption in OpenUSD (medium 4.3)
- [CVE-2020-13497](https://insights.sbomify.com/CVE-2020-13497/): Memory corruption in Pixar (medium 4.3)
- [CVE-2020-13496](https://insights.sbomify.com/CVE-2020-13496/): Memory corruption in Pixar (medium 4.3)
- [CVE-2020-13495](https://insights.sbomify.com/CVE-2020-13495/): Memory corruption in OpenUSD (medium 4.3)
- [CVE-2020-13494](https://insights.sbomify.com/CVE-2020-13494/): Memory corruption in Pixar (medium 4.3)
- [CVE-2020-13493](https://insights.sbomify.com/CVE-2020-13493/): Memory corruption in Pixar (high 8.8)
- [CVE-2020-1349](https://insights.sbomify.com/CVE-2020-1349/): Memory corruption in Microsoft 365 Apps for Enterprise for 32-bit Systems (high 7.8)
- [CVE-2020-13487](https://insights.sbomify.com/CVE-2020-13487/): bbPress stored Cross-Site Scripting (XSS) vulnerability in the Forum creation section (medium 4.8)
- [CVE-2020-13486](https://insights.sbomify.com/CVE-2020-13486/): Knock Knock plugin Open redirection vulnerability (medium 6.1)
- [CVE-2020-13485](https://insights.sbomify.com/CVE-2020-13485/): Knock Knock plugin IP Whitelist bypass via an X-Forwarded-For HTTP header (critical 9.1)
- [CVE-2020-13484](https://insights.sbomify.com/CVE-2020-13484/): Server-side request forgery in bitrix24:bitrix24 (critical 9.8)
- [CVE-2020-13483](https://insights.sbomify.com/CVE-2020-13483/): Cross-site scripting in bitrix24:bitrix24 (medium 6.1)
- [CVE-2020-13482](https://insights.sbomify.com/CVE-2020-13482/): Improper Certificate Validation in EM-HTTP-Request (high 7.4)
- [CVE-2020-13481](https://insights.sbomify.com/CVE-2020-13481/): Certain Lexmark products through 2020-05-25 allow XSS which allows an attacker to obtain session credentials and other sensitive information. (medium 6.1)
- [CVE-2020-13480](https://insights.sbomify.com/CVE-2020-13480/): Cross-site scripting in verint:workforce optimization (medium 5.4)
- [CVE-2020-1348](https://insights.sbomify.com/CVE-2020-1348/): Information disclosure in Windows (medium 6.5)
- [CVE-2020-13476](https://insights.sbomify.com/CVE-2020-13476/): Cross-site scripting in nchsoftware:express invoice (medium 4.8)
- [CVE-2020-13474](https://insights.sbomify.com/CVE-2020-13474/): Privilege escalation in nchsoftware:express accounts (medium 6.5)
- [CVE-2020-13473](https://insights.sbomify.com/CVE-2020-13473/): Information disclosure in nchsoftware:express accounts (medium 5.5)
- [CVE-2020-13472](https://insights.sbomify.com/CVE-2020-13472/): Security feature bypass in gigadevice:gd32f103 firmware (medium 4.6)
- [CVE-2020-13471](https://insights.sbomify.com/CVE-2020-13471/): Security feature bypass in apexmic:apm32f103 firmware (medium 6.8)
- [CVE-2020-13470](https://insights.sbomify.com/CVE-2020-13470/): Information disclosure in gigadevice:gd32f103 firmware (medium 4.6)
- [CVE-2020-1347](https://insights.sbomify.com/CVE-2020-1347/): Privilege escalation in Windows (high 7.8)
- [CVE-2020-13469](https://insights.sbomify.com/CVE-2020-13469/): Security feature bypass in gigadevice:gd32vf103 firmware (medium 4.6)
- [CVE-2020-13468](https://insights.sbomify.com/CVE-2020-13468/): Security feature bypass in gigadevice:gd32f130 firmware (medium 6.8)
- [CVE-2020-13467](https://insights.sbomify.com/CVE-2020-13467/): Security feature bypass in cksic:cks32f103 firmware (medium 4.6)
- [CVE-2020-13466](https://insights.sbomify.com/CVE-2020-13466/): Security feature bypass in st:stm32f103 firmware (medium 6.8)
- [CVE-2020-13465](https://insights.sbomify.com/CVE-2020-13465/): Security feature bypass in gigadevice:gd32f103 firmware (medium 6.8)
- [CVE-2020-13464](https://insights.sbomify.com/CVE-2020-13464/): Security feature bypass in cksic:cks32f103 firmware (medium 4.2)
- [CVE-2020-13463](https://insights.sbomify.com/CVE-2020-13463/): Security feature bypass in apexmic:apm32f103 firmware (medium 4.6)
- [CVE-2020-13462](https://insights.sbomify.com/CVE-2020-13462/): Missing authorization in tufin:securetrack (medium 5.7)
- [CVE-2020-13461](https://insights.sbomify.com/CVE-2020-13461/): Information disclosure in tufin:securetrack (medium 4.3)
- [CVE-2020-13460](https://insights.sbomify.com/CVE-2020-13460/): Cross-site request forgery in tufin:securetrack (high 8.8)
- [CVE-2020-1346](https://insights.sbomify.com/CVE-2020-1346/): Privilege escalation in Windows (high 7.8)
- [CVE-2020-13459](https://insights.sbomify.com/CVE-2020-13459/): Image Resizer Cross-site Scripting (XSS) in the Bulk Resize action (medium 5.4)
- [CVE-2020-13458](https://insights.sbomify.com/CVE-2020-13458/): Image Resizer Cross-Site Request Forgery (CSRF) (high 8.8)
- [CVE-2020-13452](https://insights.sbomify.com/CVE-2020-13452/): Misconfiguration in thecodingmachine:gotenberg (critical 9.8)
- [CVE-2020-13451](https://insights.sbomify.com/CVE-2020-13451/): Other in thecodingmachine:gotenberg (critical 9.8)
- [CVE-2020-13450](https://insights.sbomify.com/CVE-2020-13450/): Path traversal in thecodingmachine:gotenberg (critical 9.8)
- [CVE-2020-1345](https://insights.sbomify.com/CVE-2020-1345/): Microsoft Office SharePoint XSS Vulnerability (high 7.4)
- [CVE-2020-13449](https://insights.sbomify.com/CVE-2020-13449/): Path traversal in thecodingmachine:gotenberg (high 7.5)
- [CVE-2020-13448](https://insights.sbomify.com/CVE-2020-13448/): Command injection in quickbox:quickbox (high 8.8)
- [CVE-2020-13445](https://insights.sbomify.com/CVE-2020-13445/): Liferay Portal and Liferay DXP Vulnerable to Arbitrary Code Execution (high 8.8)
- [CVE-2020-13444](https://insights.sbomify.com/CVE-2020-13444/): Liferay Portal and Liferay DXP Fails to Sanitize API Data (medium 6.5)
- [CVE-2020-13443](https://insights.sbomify.com/CVE-2020-13443/): File upload in expressionengine:expressionengine (high 8.8)
- [CVE-2020-13442](https://insights.sbomify.com/CVE-2020-13442/): File upload in dext5:dext5 (critical 9.8)
- [CVE-2020-13440](https://insights.sbomify.com/CVE-2020-13440/): Memory corruption in rockcarry:ffjpeg (medium 6.5)
- [CVE-2020-1344](https://insights.sbomify.com/CVE-2020-1344/): Privilege escalation in Windows (high 7.8)
- [CVE-2020-13439](https://insights.sbomify.com/CVE-2020-13439/): Memory corruption in rockcarry:ffjpeg (medium 6.5)
- [CVE-2020-13438](https://insights.sbomify.com/CVE-2020-13438/): Memory corruption in rockcarry:ffjpeg (medium 6.5)
- [CVE-2020-13435](https://insights.sbomify.com/CVE-2020-13435/): Null dereference in fedoraproject:fedora (medium 5.5)
- [CVE-2020-13434](https://insights.sbomify.com/CVE-2020-13434/): Integer overflow in apple:icloud (medium 5.5)
- [CVE-2020-13433](https://insights.sbomify.com/CVE-2020-13433/): SQL injection in adminpanel project:adminpanel (critical 9.8)
- [CVE-2020-13432](https://insights.sbomify.com/CVE-2020-13432/): Memory corruption in rejetto:http file server (high 7.5)
- [CVE-2020-13431](https://insights.sbomify.com/CVE-2020-13431/): Privilege escalation in geti2p:i2p (high 7.8)
- [CVE-2020-13430](https://insights.sbomify.com/CVE-2020-13430/): Grafana XSS via the OpenTSDB datasource (medium 6.1)
- [CVE-2020-1343](https://insights.sbomify.com/CVE-2020-1343/): Information disclosure in Microsoft Visual Studio Code Live Share extension (medium 5.9)
- [CVE-2020-13429](https://insights.sbomify.com/CVE-2020-13429/): Cross-site scripting in grafana:piechart-panel (medium 5.4)
- [CVE-2020-13428](https://insights.sbomify.com/CVE-2020-13428/): Memory corruption in debian:debian linux (high 7.8)
- [CVE-2020-13427](https://insights.sbomify.com/CVE-2020-13427/): Cross-site scripting in victorcms project:victorcms (medium 6.1)
- [CVE-2020-13426](https://insights.sbomify.com/CVE-2020-13426/): Cross-site request forgery in bdtask:multi-scheduler (medium 6.5)
- [CVE-2020-13425](https://insights.sbomify.com/CVE-2020-13425/): Missing authorization in thetrackr:trackr firmware (high 7.1)
- [CVE-2020-13424](https://insights.sbomify.com/CVE-2020-13424/): Information disclosure in xcloner:xcloner (medium 6.5)
- [CVE-2020-13423](https://insights.sbomify.com/CVE-2020-13423/): Cross-site scripting in form builder for magento 2 project:form builder for magento 2 (medium 4.8)
- [CVE-2020-13422](https://insights.sbomify.com/CVE-2020-13422/): Missing authorization in openiam:openiam (high 8.1)
- [CVE-2020-13421](https://insights.sbomify.com/CVE-2020-13421/): Missing authorization in openiam:openiam (critical 9.8)
- [CVE-2020-13420](https://insights.sbomify.com/CVE-2020-13420/): Code injection in openiam:openiam (critical 9.8)
- [CVE-2020-1342](https://insights.sbomify.com/CVE-2020-1342/): Information disclosure in Microsoft 365 Apps for Enterprise for 32-bit Systems (medium 5.5)
- [CVE-2020-13419](https://insights.sbomify.com/CVE-2020-13419/): Path traversal in openiam:openiam (medium 5.3)
- [CVE-2020-13418](https://insights.sbomify.com/CVE-2020-13418/): Cross-site scripting in openiam:openiam (medium 6.1)
- [CVE-2020-13417](https://insights.sbomify.com/CVE-2020-13417/): Privilege escalation in aviatrix:controller (critical 9.8)
- [CVE-2020-13416](https://insights.sbomify.com/CVE-2020-13416/): Cross-site request forgery in aviatrix:controller (medium 6.5)
- [CVE-2020-13415](https://insights.sbomify.com/CVE-2020-13415/): Auth bypass in aviatrix:controller (high 7.5)
- [CVE-2020-13414](https://insights.sbomify.com/CVE-2020-13414/): Hardcoded credentials in aviatrix:controller (high 7.5)
- [CVE-2020-13413](https://insights.sbomify.com/CVE-2020-13413/): Information disclosure in aviatrix:controller (medium 5.3)
- [CVE-2020-13412](https://insights.sbomify.com/CVE-2020-13412/): Cross-site request forgery in aviatrix:controller (high 8.8)
- [CVE-2020-13410](https://insights.sbomify.com/CVE-2020-13410/): Improper exception handling in Aedes (high 7.5)
- [CVE-2020-13409](https://insights.sbomify.com/CVE-2020-13409/): Cross-site scripting in tufin:securetrack (medium 5.9)
- [CVE-2020-13408](https://insights.sbomify.com/CVE-2020-13408/): Cross-site scripting in tufin:securetrack (medium 5.9)
- [CVE-2020-13407](https://insights.sbomify.com/CVE-2020-13407/): Cross-site scripting in tufin:securetrack (medium 5.9)
- [CVE-2020-13405](https://insights.sbomify.com/CVE-2020-13405/): Microweber Discloses Sensitive Information (high 7.5)
- [CVE-2020-13404](https://insights.sbomify.com/CVE-2020-13404/): Command injection in quadra-informatique:atos\/sips (high 8.8)
- [CVE-2020-13401](https://insights.sbomify.com/CVE-2020-13401/): Improper Input Validation in Docker Engine (medium 6.0)
- [CVE-2020-1340](https://insights.sbomify.com/CVE-2020-1340/): Cross-site scripting in NuGetGallery (medium 5.4)
- [CVE-2020-13398](https://insights.sbomify.com/CVE-2020-13398/): Memory corruption in canonical:ubuntu linux (high 8.3)
- [CVE-2020-13397](https://insights.sbomify.com/CVE-2020-13397/): Memory corruption in canonical:ubuntu linux (medium 5.5)
- [CVE-2020-13396](https://insights.sbomify.com/CVE-2020-13396/): Memory corruption in canonical:ubuntu linux (high 7.1)
- [CVE-2020-13394](https://insights.sbomify.com/CVE-2020-13394/): Memory corruption in tendacn:ac15 firmware (critical 9.8)
- [CVE-2020-13393](https://insights.sbomify.com/CVE-2020-13393/): Memory corruption in tendacn:ac15 firmware (critical 9.8)
- [CVE-2020-13392](https://insights.sbomify.com/CVE-2020-13392/): Memory corruption in tendacn:ac15 firmware (critical 9.8)
- [CVE-2020-13391](https://insights.sbomify.com/CVE-2020-13391/): Memory corruption in tendacn:ac15 firmware (critical 9.8)
- [CVE-2020-13390](https://insights.sbomify.com/CVE-2020-13390/): Memory corruption in tendacn:ac15 firmware (critical 9.8)
- [CVE-2020-1339](https://insights.sbomify.com/CVE-2020-1339/): Windows Media Remote Code Execution Vulnerability (high 7.8)
- [CVE-2020-13389](https://insights.sbomify.com/CVE-2020-13389/): Memory corruption in tendacn:ac15 firmware (critical 9.8)
- [CVE-2020-13388](https://insights.sbomify.com/CVE-2020-13388/): OS Command Injection in jw.util (critical 9.8)
- [CVE-2020-13387](https://insights.sbomify.com/CVE-2020-13387/): Denial of service in pexip:pexip infinity (high 7.5)
- [CVE-2020-13386](https://insights.sbomify.com/CVE-2020-13386/): Misconfiguration in smartdraw:smartdraw 2020 (high 8.2)
- [CVE-2020-13384](https://insights.sbomify.com/CVE-2020-13384/): File upload in monstra:monstra (high 8.8)
- [CVE-2020-13383](https://insights.sbomify.com/CVE-2020-13383/): Path traversal in os4ed:opensis (high 7.5)
- [CVE-2020-13382](https://insights.sbomify.com/CVE-2020-13382/): Missing authorization in os4ed:opensis (critical 9.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/175/