# Vulnerabilities published in 2020 - [CVE-2020-13278](https://insights.sbomify.com/CVE-2020-13278/): Reflected cross-site scripting in francoisjacquet/rosariosis (medium 6.1) - [CVE-2020-13277](https://insights.sbomify.com/CVE-2020-13277/): Missing authorization in GitLab (medium 6.3) - [CVE-2020-13276](https://insights.sbomify.com/CVE-2020-13276/): Business logic in GitLab (high 7.4) - [CVE-2020-13275](https://insights.sbomify.com/CVE-2020-13275/): Auth bypass in GitLab (high 8.0) - [CVE-2020-13274](https://insights.sbomify.com/CVE-2020-13274/): Denial of service in GitLab (high 7.5) - [CVE-2020-13273](https://insights.sbomify.com/CVE-2020-13273/): Denial of service in GitLab (high 7.5) - [CVE-2020-13272](https://insights.sbomify.com/CVE-2020-13272/): Auth bypass in GitLab (high 7.5) - [CVE-2020-13271](https://insights.sbomify.com/CVE-2020-13271/): Cross-site scripting in GitLab (medium 6.1) - [CVE-2020-13270](https://insights.sbomify.com/CVE-2020-13270/): Missing authorization in GitLab (high 7.5) - [CVE-2020-1327](https://insights.sbomify.com/CVE-2020-1327/): Cross-site scripting in Azure DevOps Server (medium 6.1) - [CVE-2020-13269](https://insights.sbomify.com/CVE-2020-13269/): Cross-site scripting in GitLab (medium 6.1) - [CVE-2020-13268](https://insights.sbomify.com/CVE-2020-13268/): Information disclosure in GitLab (medium 5.3) - [CVE-2020-13267](https://insights.sbomify.com/CVE-2020-13267/): Cross-site scripting in GitLab (medium 6.1) - [CVE-2020-13266](https://insights.sbomify.com/CVE-2020-13266/): Missing authorization in GitLab (medium 4.3) - [CVE-2020-13265](https://insights.sbomify.com/CVE-2020-13265/): Security feature bypass in GitLab (medium 4.3) - [CVE-2020-13264](https://insights.sbomify.com/CVE-2020-13264/): Information disclosure in GitLab (medium 5.3) - [CVE-2020-13263](https://insights.sbomify.com/CVE-2020-13263/): Missing authorization in GitLab (high 7.5) - [CVE-2020-13262](https://insights.sbomify.com/CVE-2020-13262/): Cross-site scripting in GitLab (medium 6.1) - [CVE-2020-13261](https://insights.sbomify.com/CVE-2020-13261/): Information disclosure in GitLab (medium 5.3) - [CVE-2020-13260](https://insights.sbomify.com/CVE-2020-13260/): Cross-site scripting in rad:secflow-1v firmware (medium 6.1) - [CVE-2020-1326](https://insights.sbomify.com/CVE-2020-1326/): Cross-site scripting in Azure DevOps Server (medium 5.4) - [CVE-2020-13259](https://insights.sbomify.com/CVE-2020-13259/): Cross-site request forgery in rad:secflow-1v firmware (high 8.8) - [CVE-2020-13258](https://insights.sbomify.com/CVE-2020-13258/): Cross-site scripting in Contentful (medium 6.1) - [CVE-2020-13254](https://insights.sbomify.com/CVE-2020-13254/): Data leakage via cache key collision in Django (medium 5.9) - [CVE-2020-13253](https://insights.sbomify.com/CVE-2020-13253/): Memory corruption in canonical:ubuntu linux (medium 5.5) - [CVE-2020-13252](https://insights.sbomify.com/CVE-2020-13252/): Command Injection in Centreon (high 8.8) - [CVE-2020-13250](https://insights.sbomify.com/CVE-2020-13250/): Allocation of Resources Without Limits or Throttling in Hashicorp Consul (high 7.5) - [CVE-2020-1325](https://insights.sbomify.com/CVE-2020-1325/): Azure DevOps Server and Team Foundation Services Spoofing Vulnerability (medium 5.4) - [CVE-2020-13249](https://insights.sbomify.com/CVE-2020-13249/): Other in fedoraproject:fedora (high 8.8) - [CVE-2020-13248](https://insights.sbomify.com/CVE-2020-13248/): Cross-site scripting in boolebox:boolebox (medium 5.4) - [CVE-2020-13247](https://insights.sbomify.com/CVE-2020-13247/): Code injection in boolebox:boolebox (high 7.3) - [CVE-2020-13246](https://insights.sbomify.com/CVE-2020-13246/): Denial of Service in Gitea (high 7.5) - [CVE-2020-13245](https://insights.sbomify.com/CVE-2020-13245/): Security feature bypass in netgear:r6120 firmware (medium 5.9) - [CVE-2020-13241](https://insights.sbomify.com/CVE-2020-13241/): Microweber allows Unrestricted File Upload (high 7.8) - [CVE-2020-13240](https://insights.sbomify.com/CVE-2020-13240/): Dolibarr Stored Cross-site Scripting (medium 5.4) - [CVE-2020-1324](https://insights.sbomify.com/CVE-2020-1324/): Privilege escalation in Windows (high 7.8) - [CVE-2020-13239](https://insights.sbomify.com/CVE-2020-13239/): Dolibarr Stored Cross-site Scripting via file upload (medium 5.4) - [CVE-2020-13238](https://insights.sbomify.com/CVE-2020-13238/): Denial of service in mitsubishielectric:melsec iq-r00cpu firmware (high 7.5) - [CVE-2020-13231](https://insights.sbomify.com/CVE-2020-13231/): Cross-site request forgery in cacti:cacti (medium 6.5) - [CVE-2020-13230](https://insights.sbomify.com/CVE-2020-13230/): Missing authorization in cacti:cacti (medium 4.3) - [CVE-2020-1323](https://insights.sbomify.com/CVE-2020-1323/): Open redirect in Microsoft SharePoint Enterprise Server (medium 6.1) - [CVE-2020-13229](https://insights.sbomify.com/CVE-2020-13229/): Auth bypass in sysax:multi server (high 8.8) - [CVE-2020-13228](https://insights.sbomify.com/CVE-2020-13228/): Cross-site scripting in sysax:multi server (medium 6.1) - [CVE-2020-13227](https://insights.sbomify.com/CVE-2020-13227/): Information disclosure in sysax:multi server (medium 5.3) - [CVE-2020-13226](https://insights.sbomify.com/CVE-2020-13226/): WSO2 API Manager vulnerable to SSRF (critical 9.8) - [CVE-2020-13225](https://insights.sbomify.com/CVE-2020-13225/): Cross-site scripting in phpipam:phpipam (medium 4.8) - [CVE-2020-13224](https://insights.sbomify.com/CVE-2020-13224/): Memory corruption in tp-link:nc200 firmware (high 8.8) - [CVE-2020-13223](https://insights.sbomify.com/CVE-2020-13223/): Information Disclosure in HashiCorp Vault (high 7.5) - [CVE-2020-1322](https://insights.sbomify.com/CVE-2020-1322/): Information disclosure in Microsoft 365 Apps for Enterprise for 32-bit Systems (medium 6.5) - [CVE-2020-1321](https://insights.sbomify.com/CVE-2020-1321/): Memory corruption in Microsoft 365 Apps for Enterprise for 32-bit Systems (high 8.8) - [CVE-2020-1320](https://insights.sbomify.com/CVE-2020-1320/): Cross-site scripting in Microsoft SharePoint Enterprise Server (medium 5.4) - [CVE-2020-1319](https://insights.sbomify.com/CVE-2020-1319/): Microsoft Windows Codecs Library Remote Code Execution Vulnerability (high 7.3) - [CVE-2020-13186](https://insights.sbomify.com/CVE-2020-13186/): Cross-site request forgery in - Cloud Access Connector - Cloud Access Connector Legacy (medium 6.5) - [CVE-2020-13185](https://insights.sbomify.com/CVE-2020-13185/): Auth bypass in - Cloud Access Connector - Cloud Access Connector Legacy (medium 6.5) - [CVE-2020-13183](https://insights.sbomify.com/CVE-2020-13183/): Cross-site scripting in Teradici PCoIP Management Console (medium 6.1) - [CVE-2020-1318](https://insights.sbomify.com/CVE-2020-1318/): Cross-site scripting in Microsoft SharePoint Enterprise Server (medium 5.4) - [CVE-2020-13179](https://insights.sbomify.com/CVE-2020-13179/): Information disclosure in - PCoIP Standard Agent for Windows - PCoIP Graphics Agent for Windows (medium 5.5) - [CVE-2020-13178](https://insights.sbomify.com/CVE-2020-13178/): Privilege escalation in - PCoIP Standard Agent for Windows - PCoIP Graphics Agent for Windows (medium 6.7) - [CVE-2020-13177](https://insights.sbomify.com/CVE-2020-13177/): Privilege escalation in - PCoIP Standard Agent for Windows - PCoIP Graphics Agent for Windows (high 7.8) - [CVE-2020-13176](https://insights.sbomify.com/CVE-2020-13176/): Cross-site scripting in - Cloud Access Connector - Cloud Access Connector Legacy (medium 6.1) - [CVE-2020-13175](https://insights.sbomify.com/CVE-2020-13175/): Path traversal in - Cloud Access Connector - Cloud Access Connector Legacy (high 7.5) - [CVE-2020-13174](https://insights.sbomify.com/CVE-2020-13174/): Other in - Management Console (medium 6.1) - [CVE-2020-13173](https://insights.sbomify.com/CVE-2020-13173/): Race condition in PCoIP Standard Agent for Windows, PCoIP Graphics Agent for Windows (high 7.8) - [CVE-2020-13170](https://insights.sbomify.com/CVE-2020-13170/): Improper Input Validation in HashiCorp Consul (high 7.5) - [CVE-2020-1317](https://insights.sbomify.com/CVE-2020-1317/): Privilege escalation in Windows (high 8.8) - [CVE-2020-13169](https://insights.sbomify.com/CVE-2020-13169/): Cross-site scripting in solarwinds:orion platform (critical 9.0) - [CVE-2020-13168](https://insights.sbomify.com/CVE-2020-13168/): Cross-site scripting in sysaid:sysaid on-premises (medium 6.1) - [CVE-2020-13167](https://insights.sbomify.com/CVE-2020-13167/): Command injection in netsweeper:netsweeper (critical 9.8) - [CVE-2020-13166](https://insights.sbomify.com/CVE-2020-13166/): Hardcoded credentials in mylittletools:mylittleadmin (critical 9.8) - [CVE-2020-13164](https://insights.sbomify.com/CVE-2020-13164/): Denial of service in debian:debian linux (high 7.5) - [CVE-2020-13163](https://insights.sbomify.com/CVE-2020-13163/): Improper certificate validation in em-imap (high 7.4) - [CVE-2020-13162](https://insights.sbomify.com/CVE-2020-13162/): Race condition in pulsesecure:pulse secure desktop client (high 7.0) - [CVE-2020-13160](https://insights.sbomify.com/CVE-2020-13160/): Memory corruption in anydesk:anydesk (critical 9.8) - [CVE-2020-1316](https://insights.sbomify.com/CVE-2020-1316/): Privilege escalation in Windows (high 7.8) - [CVE-2020-13159](https://insights.sbomify.com/CVE-2020-13159/): Command injection in articatech:artica proxy (critical 9.8) - [CVE-2020-13158](https://insights.sbomify.com/CVE-2020-13158/): Path traversal in articatech:artica proxy (high 7.5) - [CVE-2020-13157](https://insights.sbomify.com/CVE-2020-13157/): NukeViet Cross-Site Request Forgery (CSRF) (medium 6.5) - [CVE-2020-13156](https://insights.sbomify.com/CVE-2020-13156/): NukeViet Cross-Site Request Forgery (CSRF) (medium 6.5) - [CVE-2020-13155](https://insights.sbomify.com/CVE-2020-13155/): NukeViet Cross-Site Request Forgery (CSRF) (high 8.8) - [CVE-2020-13154](https://insights.sbomify.com/CVE-2020-13154/): Missing authorization in zohocorp:manageengine servicedesk plus (medium 6.5) - [CVE-2020-13153](https://insights.sbomify.com/CVE-2020-13153/): Cross-site scripting in misp-project:misp (medium 6.1) - [CVE-2020-13152](https://insights.sbomify.com/CVE-2020-13152/): Denial of service in kde:amarok (medium 5.5) - [CVE-2020-13151](https://insights.sbomify.com/CVE-2020-13151/): Code injection in aerospike:aerospike server (critical 9.8) - [CVE-2020-13150](https://insights.sbomify.com/CVE-2020-13150/): Auth bypass in dlink:dsl-2750u firmware (high 7.8) - [CVE-2020-1315](https://insights.sbomify.com/CVE-2020-1315/): Information disclosure in Internet Explorer 11 (medium 5.3) - [CVE-2020-13149](https://insights.sbomify.com/CVE-2020-13149/): Misconfiguration in msi:dragon center (high 7.8) - [CVE-2020-13146](https://insights.sbomify.com/CVE-2020-13146/): Code injection in edx:open edx platform (high 8.8) - [CVE-2020-13145](https://insights.sbomify.com/CVE-2020-13145/): Cross-site scripting in edx:open edx platform (medium 5.4) - [CVE-2020-13144](https://insights.sbomify.com/CVE-2020-13144/): Code injection in edx:open edx platform (high 8.8) - [CVE-2020-13143](https://insights.sbomify.com/CVE-2020-13143/): Memory corruption in canonical:ubuntu linux (medium 6.5) - [CVE-2020-1314](https://insights.sbomify.com/CVE-2020-1314/): Privilege escalation in Windows (high 7.8) - [CVE-2020-13136](https://insights.sbomify.com/CVE-2020-13136/): Weak cryptography in dlink:dsp-w215 firmware (high 7.5) - [CVE-2020-13135](https://insights.sbomify.com/CVE-2020-13135/): Weak cryptography in dlink:dsp-w215 firmware (medium 6.5) - [CVE-2020-13134](https://insights.sbomify.com/CVE-2020-13134/): Cross-site scripting in tufin:securechange (medium 4.8) - [CVE-2020-13133](https://insights.sbomify.com/CVE-2020-13133/): Cross-site scripting in tufin:securechange (medium 6.1) - [CVE-2020-13132](https://insights.sbomify.com/CVE-2020-13132/): Memory corruption in yubico:libykpiv (medium 4.3) - [CVE-2020-13131](https://insights.sbomify.com/CVE-2020-13131/): Information disclosure in yubico:libykpiv (medium 4.3) - [CVE-2020-1313](https://insights.sbomify.com/CVE-2020-1313/): Privilege escalation in Windows 10 Version 1903 for 32-bit Systems (high 7.8) - [CVE-2020-13129](https://insights.sbomify.com/CVE-2020-13129/): Information disclosure in heinekingmedia:stashcat (high 7.2) - [CVE-2020-13128](https://insights.sbomify.com/CVE-2020-13128/): Denial of service in gwtupload project:gwtupload (high 7.5) --- From sbomify Insights: https://insights.sbomify.com/years/2020/page/177/