# Vulnerabilities published in 2020


- [CVE-2020-12880](https://insights.sbomify.com/CVE-2020-12880/): Security feature bypass in ivanti:connect secure (medium 5.5)
- [CVE-2020-12878](https://insights.sbomify.com/CVE-2020-12878/): Privilege escalation in digi:connectport x2e firmware (high 7.8)
- [CVE-2020-12877](https://insights.sbomify.com/CVE-2020-12877/): Missing authorization in veritas:aptare (high 7.5)
- [CVE-2020-12876](https://insights.sbomify.com/CVE-2020-12876/): Missing authorization in veritas:aptare (medium 5.3)
- [CVE-2020-12875](https://insights.sbomify.com/CVE-2020-12875/): Missing authorization in veritas:aptare (medium 6.3)
- [CVE-2020-12874](https://insights.sbomify.com/CVE-2020-12874/): Auth bypass in veritas:aptare (medium 6.5)
- [CVE-2020-12873](https://insights.sbomify.com/CVE-2020-12873/): Code injection in atlassian:alfresco enterprise content management (high 8.8)
- [CVE-2020-12872](https://insights.sbomify.com/CVE-2020-12872/): Weak cryptography in yaws:yaws (medium 5.5)
- [CVE-2020-12870](https://insights.sbomify.com/CVE-2020-12870/): SQL injection in rainbowfishsoftware:pacsone server (critical 9.8)
- [CVE-2020-1287](https://insights.sbomify.com/CVE-2020-1287/): Privilege escalation in Windows (high 7.8)
- [CVE-2020-12869](https://insights.sbomify.com/CVE-2020-12869/): Cross-site scripting in rainbowfishsoftware:pacsone server (medium 5.4)
- [CVE-2020-12867](https://insights.sbomify.com/CVE-2020-12867/): Null dereference in canonical:ubuntu linux (medium 5.5)
- [CVE-2020-12866](https://insights.sbomify.com/CVE-2020-12866/): Null dereference in canonical:ubuntu linux (medium 5.7)
- [CVE-2020-12865](https://insights.sbomify.com/CVE-2020-12865/): Memory corruption in canonical:ubuntu linux (high 8.0)
- [CVE-2020-12864](https://insights.sbomify.com/CVE-2020-12864/): Memory corruption in canonical:ubuntu linux (medium 4.3)
- [CVE-2020-12863](https://insights.sbomify.com/CVE-2020-12863/): Memory corruption in canonical:ubuntu linux (medium 4.3)
- [CVE-2020-12862](https://insights.sbomify.com/CVE-2020-12862/): Memory corruption in canonical:ubuntu linux (medium 4.3)
- [CVE-2020-12861](https://insights.sbomify.com/CVE-2020-12861/): Memory corruption in canonical:ubuntu linux (high 8.8)
- [CVE-2020-12860](https://insights.sbomify.com/CVE-2020-12860/): Information disclosure in health:covidsafe (medium 5.3)
- [CVE-2020-1286](https://insights.sbomify.com/CVE-2020-1286/): Code injection in Windows (high 8.8)
- [CVE-2020-12859](https://insights.sbomify.com/CVE-2020-12859/): Information disclosure in health:covidsafe (medium 5.3)
- [CVE-2020-12858](https://insights.sbomify.com/CVE-2020-12858/): Weak cryptography in health:covidsafe (high 7.5)
- [CVE-2020-12857](https://insights.sbomify.com/CVE-2020-12857/): Information disclosure in health:covidsafe (high 7.5)
- [CVE-2020-12856](https://insights.sbomify.com/CVE-2020-12856/): Information disclosure in alberta:abtracetogether (critical 9.8)
- [CVE-2020-12855](https://insights.sbomify.com/CVE-2020-12855/): Open redirect in seczetta:neprofile (high 8.8)
- [CVE-2020-12854](https://insights.sbomify.com/CVE-2020-12854/): File upload in seczetta:neprofile (high 8.8)
- [CVE-2020-12853](https://insights.sbomify.com/CVE-2020-12853/): Cross-site scripting in pydio:cells (medium 6.1)
- [CVE-2020-12852](https://insights.sbomify.com/CVE-2020-12852/): Code injection in pydio:cells (medium 6.8)
- [CVE-2020-12851](https://insights.sbomify.com/CVE-2020-12851/): Path traversal in pydio:cells (high 8.1)
- [CVE-2020-12850](https://insights.sbomify.com/CVE-2020-12850/): Privilege escalation in pydio:cells (high 7.0)
- [CVE-2020-1285](https://insights.sbomify.com/CVE-2020-1285/): GDI+ Remote Code Execution Vulnerability (high 8.4)
- [CVE-2020-12849](https://insights.sbomify.com/CVE-2020-12849/): Missing authorization in pydio:cells (medium 5.4)
- [CVE-2020-12848](https://insights.sbomify.com/CVE-2020-12848/): Auth bypass in pydio:cells (medium 5.4)
- [CVE-2020-12847](https://insights.sbomify.com/CVE-2020-12847/): Command injection in pydio:cells (high 7.2)
- [CVE-2020-12846](https://insights.sbomify.com/CVE-2020-12846/): File upload in synacor:zimbra collaboration suite (high 8.0)
- [CVE-2020-12845](https://insights.sbomify.com/CVE-2020-12845/): Null dereference in cherokee-project:cherokee (high 7.5)
- [CVE-2020-12843](https://insights.sbomify.com/CVE-2020-12843/): File upload in gogogate:ismartgate pro firmware (critical 9.8)
- [CVE-2020-12842](https://insights.sbomify.com/CVE-2020-12842/): Privilege escalation in gogogate:ismartgate pro firmware (critical 9.8)
- [CVE-2020-12841](https://insights.sbomify.com/CVE-2020-12841/): Cross-site request forgery in gogogate:ismartgate pro firmware (medium 6.5)
- [CVE-2020-12840](https://insights.sbomify.com/CVE-2020-12840/): Cross-site request forgery in gogogate:ismartgate pro firmware (medium 6.5)
- [CVE-2020-1284](https://insights.sbomify.com/CVE-2020-1284/): Denial of service in Windows 10 Version 2004 for 32-bit Systems (medium 6.5)
- [CVE-2020-12839](https://insights.sbomify.com/CVE-2020-12839/): Privilege escalation in gogogate:ismartgate pro firmware (critical 9.8)
- [CVE-2020-12838](https://insights.sbomify.com/CVE-2020-12838/): Privilege escalation in gogogate:ismartgate pro firmware (critical 9.8)
- [CVE-2020-12837](https://insights.sbomify.com/CVE-2020-12837/): File upload in gogogate:ismartgate pro firmware (high 7.5)
- [CVE-2020-12835](https://insights.sbomify.com/CVE-2020-12835/): Deserialization in smartbear:readyapi (critical 9.8)
- [CVE-2020-12834](https://insights.sbomify.com/CVE-2020-12834/): Misconfiguration in eq-3:ccu3 firmware (critical 9.8)
- [CVE-2020-12832](https://insights.sbomify.com/CVE-2020-12832/): Path traversal in simplefilelist:simple-file-list (critical 9.8)
- [CVE-2020-12831](https://insights.sbomify.com/CVE-2020-12831/): Information disclosure in linuxfoundation:free range routing (medium 5.3)
- [CVE-2020-12830](https://insights.sbomify.com/CVE-2020-12830/): Memory corruption in westerndigital:my cloud firmware (critical 9.8)
- [CVE-2020-1283](https://insights.sbomify.com/CVE-2020-1283/): Denial of service in Windows (medium 6.5)
- [CVE-2020-12829](https://insights.sbomify.com/CVE-2020-12829/): Integer overflow in canonical:ubuntu linux (low 3.8)
- [CVE-2020-12828](https://insights.sbomify.com/CVE-2020-12828/): Privilege escalation in pango:virtual private network software development kit (critical 9.8)
- [CVE-2020-12827](https://insights.sbomify.com/CVE-2020-12827/): MJML vulnerable to path traversal (high 7.2)
- [CVE-2020-12826](https://insights.sbomify.com/CVE-2020-12826/): Integer overflow in canonical:ubuntu linux (medium 5.3)
- [CVE-2020-12825](https://insights.sbomify.com/CVE-2020-12825/): Denial of service in gnome:libcroco (high 7.1)
- [CVE-2020-12824](https://insights.sbomify.com/CVE-2020-12824/): Denial of service in pexip:pexip infinity (high 7.5)
- [CVE-2020-12823](https://insights.sbomify.com/CVE-2020-12823/): Memory corruption in debian:debian linux (critical 9.8)
- [CVE-2020-12821](https://insights.sbomify.com/CVE-2020-12821/): Denial of service in protocol:gossipsub (critical 9.8)
- [CVE-2020-12820](https://insights.sbomify.com/CVE-2020-12820/): Memory corruption in FortiOS (medium 5.4)
- [CVE-2020-1282](https://insights.sbomify.com/CVE-2020-1282/): Privilege escalation in Windows (high 7.8)
- [CVE-2020-12819](https://insights.sbomify.com/CVE-2020-12819/): Memory corruption in FortiOS (medium 5.4)
- [CVE-2020-12818](https://insights.sbomify.com/CVE-2020-12818/): Other in Fortinet FortiOS (medium 5.3)
- [CVE-2020-12817](https://insights.sbomify.com/CVE-2020-12817/): Cross-site scripting in Fortinet FortiAnalyzer (high 8.8)
- [CVE-2020-12816](https://insights.sbomify.com/CVE-2020-12816/): Cross-site scripting in Fortinet FortiNAC (medium 6.1)
- [CVE-2020-12815](https://insights.sbomify.com/CVE-2020-12815/): Cross-site scripting in Fortinet FortiTester (medium 5.4)
- [CVE-2020-12814](https://insights.sbomify.com/CVE-2020-12814/): Cross-site scripting in Fortinet FortiAnalyzer (medium 4.1)
- [CVE-2020-12812](https://insights.sbomify.com/CVE-2020-12812/): Fortinet FortiOS SSL VPN Improper Authentication (high 7.5, exploited in the wild)
- [CVE-2020-12811](https://insights.sbomify.com/CVE-2020-12811/): Cross-site scripting in FortiAnalyzer (medium 4.9)
- [CVE-2020-1281](https://insights.sbomify.com/CVE-2020-1281/): Memory corruption in Windows (high 8.8)
- [CVE-2020-12803](https://insights.sbomify.com/CVE-2020-12803/): XForms submissions could overwrite local files (medium 6.5)
- [CVE-2020-12802](https://insights.sbomify.com/CVE-2020-12802/): remote graphics contained in docx format retrieved in 'stealth mode' (medium 5.3)
- [CVE-2020-12801](https://insights.sbomify.com/CVE-2020-12801/): Crash-recovered MSOffice encrypted documents defaulted to not to using encryption on next save (medium 5.3)
- [CVE-2020-12800](https://insights.sbomify.com/CVE-2020-12800/): File upload in codedropz:drag and drop multiple file upload - contact form 7 (critical 9.8)
- [CVE-2020-1280](https://insights.sbomify.com/CVE-2020-1280/): Privilege escalation in Windows (high 7.8)
- [CVE-2020-12798](https://insights.sbomify.com/CVE-2020-12798/): Security feature bypass in sun-denshi:universal forensic extraction device firmware (high 7.8)
- [CVE-2020-12797](https://insights.sbomify.com/CVE-2020-12797/): Incorrect Permission Assignment for Critical Resource in Hashicorp Consul (medium 5.3)
- [CVE-2020-12790](https://insights.sbomify.com/CVE-2020-12790/): SEOmatic for CraftCMS allows Server-Side Template Injection (high 7.5)
- [CVE-2020-1279](https://insights.sbomify.com/CVE-2020-1279/): Privilege escalation in Windows (high 7.8)
- [CVE-2020-12789](https://insights.sbomify.com/CVE-2020-12789/): Hardcoded credentials in microchip:atsama5d21c-cu firmware (high 7.5)
- [CVE-2020-12788](https://insights.sbomify.com/CVE-2020-12788/): Weak cryptography in microchip:atsama5d21c-cu firmware (high 7.5)
- [CVE-2020-12787](https://insights.sbomify.com/CVE-2020-12787/): Security feature bypass in microchip:atsama5d21c-cu firmware (high 7.5)
- [CVE-2020-12785](https://insights.sbomify.com/CVE-2020-12785/): Information disclosure in cpanel:cpanel (high 8.1)
- [CVE-2020-12784](https://insights.sbomify.com/CVE-2020-12784/): Denial of service in cpanel:cpanel (medium 5.3)
- [CVE-2020-12783](https://insights.sbomify.com/CVE-2020-12783/): Auth bypass in canonical:ubuntu linux (high 7.5)
- [CVE-2020-12782](https://insights.sbomify.com/CVE-2020-12782/): Openfind MailGates - Command Injection (critical 9.8)
- [CVE-2020-12781](https://insights.sbomify.com/CVE-2020-12781/): Combodo iTop - CSRF (medium 5.7)
- [CVE-2020-12780](https://insights.sbomify.com/CVE-2020-12780/): Combodo iTop - Security Misconfiguration (high 7.5)
- [CVE-2020-1278](https://insights.sbomify.com/CVE-2020-1278/): Privilege escalation in Microsoft Visual Studio (high 7.8)
- [CVE-2020-12779](https://insights.sbomify.com/CVE-2020-12779/): Combodo iTop - Stored XSS (medium 6.8)
- [CVE-2020-12778](https://insights.sbomify.com/CVE-2020-12778/): Combodo iTop - Reflected XSS (high 7.4)
- [CVE-2020-12777](https://insights.sbomify.com/CVE-2020-12777/): Combodo iTop - Broken Access Control (high 7.5)
- [CVE-2020-12776](https://insights.sbomify.com/CVE-2020-12776/): Openfind Mail2000 - Broken Access Control (medium 6.6)
- [CVE-2020-12775](https://insights.sbomify.com/CVE-2020-12775/): Hicos citizen certificate client-side component - Command Injection (critical 9.8)
- [CVE-2020-12774](https://insights.sbomify.com/CVE-2020-12774/): D-Link DSL-7740C - Command Injection (high 8.2)
- [CVE-2020-12773](https://insights.sbomify.com/CVE-2020-12773/): Realtek ADSL/PON Modem SoC - Security Misconfiguration (critical 9.6)
- [CVE-2020-12772](https://insights.sbomify.com/CVE-2020-12772/): Information disclosure in igniterealtime:spark (high 8.8)
- [CVE-2020-12771](https://insights.sbomify.com/CVE-2020-12771/): Denial of service in canonical:ubuntu linux (medium 5.5)
- [CVE-2020-12770](https://insights.sbomify.com/CVE-2020-12770/): Other in canonical:ubuntu linux (medium 6.7)
- [CVE-2020-1277](https://insights.sbomify.com/CVE-2020-1277/): Privilege escalation in Windows (high 7.8)
- [CVE-2020-12769](https://insights.sbomify.com/CVE-2020-12769/): Race condition in canonical:ubuntu linux (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/179/