# Vulnerabilities published in 2020


- [CVE-2020-12270](https://insights.sbomify.com/CVE-2020-12270/): Weak cryptography in bluezone:bluezone (medium 6.5)
- [CVE-2020-1227](https://insights.sbomify.com/CVE-2020-1227/): Microsoft Office SharePoint XSS Vulnerability (medium 5.4)
- [CVE-2020-12268](https://insights.sbomify.com/CVE-2020-12268/): Memory corruption in artifex:jbig2dec (critical 9.8)
- [CVE-2020-12267](https://insights.sbomify.com/CVE-2020-12267/): Use after free in qt:qt (critical 9.8)
- [CVE-2020-12266](https://insights.sbomify.com/CVE-2020-12266/): Missing authorization in wavlink:jetstream ac3000 firmware (high 7.5)
- [CVE-2020-12265](https://insights.sbomify.com/CVE-2020-12265/): Path Traversal in decompress (critical 9.8)
- [CVE-2020-12262](https://insights.sbomify.com/CVE-2020-12262/): Cross-site scripting in intelbras:tip200 firmware (medium 5.4)
- [CVE-2020-12261](https://insights.sbomify.com/CVE-2020-12261/): Cross-site scripting in opmantek:open-audit (medium 5.4)
- [CVE-2020-1226](https://insights.sbomify.com/CVE-2020-1226/): Use after free in Microsoft 365 Apps for Enterprise for 32-bit Systems (high 8.8)
- [CVE-2020-12259](https://insights.sbomify.com/CVE-2020-12259/): Cross-site scripting in rconfig:rconfig (medium 5.4)
- [CVE-2020-12258](https://insights.sbomify.com/CVE-2020-12258/): Auth bypass in rconfig:rconfig (critical 9.1)
- [CVE-2020-12257](https://insights.sbomify.com/CVE-2020-12257/): Cross-site request forgery in rconfig:rconfig (high 8.8)
- [CVE-2020-12256](https://insights.sbomify.com/CVE-2020-12256/): Cross-site scripting in rconfig:rconfig (medium 5.4)
- [CVE-2020-12255](https://insights.sbomify.com/CVE-2020-12255/): File upload in rconfig:rconfig (high 8.8)
- [CVE-2020-12254](https://insights.sbomify.com/CVE-2020-12254/): Privilege escalation in avira:antivirus (high 7.8)
- [CVE-2020-12252](https://insights.sbomify.com/CVE-2020-12252/): File upload in gigamon:gigavue (medium 6.2)
- [CVE-2020-12251](https://insights.sbomify.com/CVE-2020-12251/): Path traversal in gigamon:gigavue (low 2.2)
- [CVE-2020-1225](https://insights.sbomify.com/CVE-2020-1225/): Use after free in Microsoft 365 Apps for Enterprise for 32-bit Systems (high 8.8)
- [CVE-2020-12248](https://insights.sbomify.com/CVE-2020-12248/): Memory corruption in foxitsoftware:phantompdf (high 8.8)
- [CVE-2020-12247](https://insights.sbomify.com/CVE-2020-12247/): Memory corruption in foxitsoftware:phantompdf (high 7.1)
- [CVE-2020-12246](https://insights.sbomify.com/CVE-2020-12246/): Command injection in beeline:smart box firmware (high 8.8)
- [CVE-2020-12245](https://insights.sbomify.com/CVE-2020-12245/): Grafana XSS in header column rename (medium 6.1)
- [CVE-2020-12244](https://insights.sbomify.com/CVE-2020-12244/): Security feature bypass in debian:debian linux (high 7.5)
- [CVE-2020-12243](https://insights.sbomify.com/CVE-2020-12243/): Denial of service in apple:mac os x (high 7.5)
- [CVE-2020-12242](https://insights.sbomify.com/CVE-2020-12242/): Privilege escalation in valvesoftware:source (high 7.8)
- [CVE-2020-1224](https://insights.sbomify.com/CVE-2020-1224/): Microsoft Excel Information Disclosure Vulnerability (medium 5.5)
- [CVE-2020-1223](https://insights.sbomify.com/CVE-2020-1223/): Code injection in Microsoft Word for Android (high 8.8)
- [CVE-2020-1222](https://insights.sbomify.com/CVE-2020-1222/): Memory corruption in Windows (high 7.8)
- [CVE-2020-1220](https://insights.sbomify.com/CVE-2020-1220/): Open redirect in Microsoft Edge (Chromium-based) in IE Mode on Windows 10 Version 1607 for 32-bit Systems (medium 6.1)
- [CVE-2020-1219](https://insights.sbomify.com/CVE-2020-1219/): Memory corruption in ChakraCore (high 7.5)
- [CVE-2020-1218](https://insights.sbomify.com/CVE-2020-1218/): Microsoft Word Remote Code Execution Vulnerability (high 7.8)
- [CVE-2020-1217](https://insights.sbomify.com/CVE-2020-1217/): Information disclosure in Windows (high 7.8)
- [CVE-2020-1216](https://insights.sbomify.com/CVE-2020-1216/): Memory corruption in Internet Explorer 11 (high 7.5)
- [CVE-2020-1215](https://insights.sbomify.com/CVE-2020-1215/): Memory corruption in Internet Explorer 11 (high 7.5)
- [CVE-2020-12149](https://insights.sbomify.com/CVE-2020-12149/): OS Command Injection - Management File Upload (medium 6.8)
- [CVE-2020-12148](https://insights.sbomify.com/CVE-2020-12148/): OS Command Injection - nslookup API (medium 6.8)
- [CVE-2020-12147](https://insights.sbomify.com/CVE-2020-12147/): Unauthorized queries against the Silver Peak Unity OrchestratorTM MySQL database. (medium 6.6)
- [CVE-2020-12146](https://insights.sbomify.com/CVE-2020-12146/): Silver Peak Unity OrchestratorTM subject to path traversal. (medium 6.6)
- [CVE-2020-12145](https://insights.sbomify.com/CVE-2020-12145/): Silver Peak Unity OrchestratorTM authentication can be subverted through manipulation of HTTP headers. (medium 6.6)
- [CVE-2020-12144](https://insights.sbomify.com/CVE-2020-12144/): The certificate used to identify the Silver Peak Cloud Portal to EdgeConnect devices is not validated (medium 6.0)
- [CVE-2020-12143](https://insights.sbomify.com/CVE-2020-12143/): The certificate used to identify Orchestrator to EdgeConnect devices is not validated (medium 6.0)
- [CVE-2020-12142](https://insights.sbomify.com/CVE-2020-12142/): IPSec UDP key material can be retrieved from EdgeConnect by a user with admin credentials (medium 4.8)
- [CVE-2020-12141](https://insights.sbomify.com/CVE-2020-12141/): Memory corruption in contiki-ng:contiki-ng (critical 9.1)
- [CVE-2020-12140](https://insights.sbomify.com/CVE-2020-12140/): Memory corruption in contiki-ng:contiki-ng (high 8.8)
- [CVE-2020-1214](https://insights.sbomify.com/CVE-2020-1214/): Memory corruption in Internet Explorer 11 (high 7.5)
- [CVE-2020-12138](https://insights.sbomify.com/CVE-2020-12138/): Privilege escalation in amd:atillk64 (high 8.8)
- [CVE-2020-12137](https://insights.sbomify.com/CVE-2020-12137/): Cross-site scripting in canonical:ubuntu linux (medium 6.1)
- [CVE-2020-12135](https://insights.sbomify.com/CVE-2020-12135/): Integer overflow in mongodb:c driver (medium 5.5)
- [CVE-2020-12134](https://insights.sbomify.com/CVE-2020-12134/): Missing authorization in nanometrics:centaur (critical 9.8)
- [CVE-2020-12133](https://insights.sbomify.com/CVE-2020-12133/): Deserialization in farukawa:electric consciousmap (critical 9.8)
- [CVE-2020-12132](https://insights.sbomify.com/CVE-2020-12132/): Cross-site scripting in fifthplay:s.a.m.i (medium 6.1)
- [CVE-2020-12131](https://insights.sbomify.com/CVE-2020-12131/): Cross-site scripting in app2pro:airdisk pro (medium 6.1)
- [CVE-2020-12130](https://insights.sbomify.com/CVE-2020-12130/): Cross-site scripting in app2pro:airdisk pro (medium 6.1)
- [CVE-2020-1213](https://insights.sbomify.com/CVE-2020-1213/): Memory corruption in Internet Explorer 11 (high 7.5)
- [CVE-2020-12129](https://insights.sbomify.com/CVE-2020-12129/): Cross-site scripting in app2pro:airdisk pro (medium 6.1)
- [CVE-2020-12128](https://insights.sbomify.com/CVE-2020-12128/): Path traversal in file transfer ifamily project:file transfer ifamily (high 7.5)
- [CVE-2020-12127](https://insights.sbomify.com/CVE-2020-12127/): Missing authorization in wavlink:wn530h4 firmware (high 7.5)
- [CVE-2020-12126](https://insights.sbomify.com/CVE-2020-12126/): Auth bypass in wavlink:wn530h4 firmware (critical 9.8)
- [CVE-2020-12125](https://insights.sbomify.com/CVE-2020-12125/): Memory corruption in wavlink:wn530h4 firmware (critical 9.8)
- [CVE-2020-12124](https://insights.sbomify.com/CVE-2020-12124/): Command injection in wavlink:wn530h4 firmware (critical 9.8)
- [CVE-2020-12123](https://insights.sbomify.com/CVE-2020-12123/): Cross-site request forgery in wavlink:wn530h4 firmware (high 8.1)
- [CVE-2020-12122](https://insights.sbomify.com/CVE-2020-12122/): Other in maxpcsecure:max spyware detector (high 7.8)
- [CVE-2020-12120](https://insights.sbomify.com/CVE-2020-12120/): Information disclosure in prestashop:correos express (high 7.5)
- [CVE-2020-1212](https://insights.sbomify.com/CVE-2020-1212/): Memory corruption in Windows (high 7.8)
- [CVE-2020-12119](https://insights.sbomify.com/CVE-2020-12119/): Business logic in ledger:ledger live (high 8.1)
- [CVE-2020-12118](https://insights.sbomify.com/CVE-2020-12118/): Incorrect Default Permissions in Binance tss-lib (high 8.2)
- [CVE-2020-12117](https://insights.sbomify.com/CVE-2020-12117/): Missing authorization in moxa:nport 5100a firmware (medium 5.3)
- [CVE-2020-12116](https://insights.sbomify.com/CVE-2020-12116/): Path traversal in zohocorp:manageengine opmanager (high 7.5)
- [CVE-2020-12114](https://insights.sbomify.com/CVE-2020-12114/): Race condition in linux:linux kernel (medium 4.7)
- [CVE-2020-12113](https://insights.sbomify.com/CVE-2020-12113/): Cross-site scripting in bigbluebutton:bigbluebutton (medium 6.1)
- [CVE-2020-12112](https://insights.sbomify.com/CVE-2020-12112/): Path traversal in bigbluebutton:bigbluebutton (high 7.5)
- [CVE-2020-12111](https://insights.sbomify.com/CVE-2020-12111/): Command injection in tp-link:nc260 firmware (high 8.8)
- [CVE-2020-12110](https://insights.sbomify.com/CVE-2020-12110/): Hardcoded credentials in tp-link:nc200 firmware (critical 9.8)
- [CVE-2020-1211](https://insights.sbomify.com/CVE-2020-1211/): Privilege escalation in Windows (high 7.8)
- [CVE-2020-12109](https://insights.sbomify.com/CVE-2020-12109/): Command injection in tp-link:nc200 firmware (high 8.8)
- [CVE-2020-12108](https://insights.sbomify.com/CVE-2020-12108/): Other in canonical:ubuntu linux (medium 6.5)
- [CVE-2020-12107](https://insights.sbomify.com/CVE-2020-12107/): Command injection in stengg:vpncrypt m10 firmware (critical 9.8)
- [CVE-2020-12106](https://insights.sbomify.com/CVE-2020-12106/): Missing authorization in stengg:vpncrypt m10 firmware (critical 9.8)
- [CVE-2020-12105](https://insights.sbomify.com/CVE-2020-12105/): Security feature bypass in infradead:openconnect (medium 5.9)
- [CVE-2020-12104](https://insights.sbomify.com/CVE-2020-12104/): SQL injection in internet-formation:wp-advanced-search (high 8.8)
- [CVE-2020-12103](https://insights.sbomify.com/CVE-2020-12103/): Path traversal in prasathmani:tiny file manager (high 7.7)
- [CVE-2020-12102](https://insights.sbomify.com/CVE-2020-12102/): Path traversal in prasathmani:tiny file manager (high 7.7)
- [CVE-2020-12101](https://insights.sbomify.com/CVE-2020-12101/): Missing authorization in xt-commerce:xt-commerce (medium 4.3)
- [CVE-2020-12100](https://insights.sbomify.com/CVE-2020-12100/): Denial of service in canonical:ubuntu linux (high 7.5)
- [CVE-2020-1210](https://insights.sbomify.com/CVE-2020-1210/): Microsoft SharePoint Remote Code Execution Vulnerability (critical 9.9)
- [CVE-2020-1209](https://insights.sbomify.com/CVE-2020-1209/): Privilege escalation in Windows 10 Version 1903 for 32-bit Systems (high 7.8)
- [CVE-2020-12083](https://insights.sbomify.com/CVE-2020-12083/): Privilege escalation in flexera:flexnet code insight (critical 9.9)
- [CVE-2020-12082](https://insights.sbomify.com/CVE-2020-12082/): Cross-site scripting in flexera:flexnet code insight (medium 5.4)
- [CVE-2020-12081](https://insights.sbomify.com/CVE-2020-12081/): Information disclosure in flexera:flexnet publisher (high 7.5)
- [CVE-2020-12080](https://insights.sbomify.com/CVE-2020-12080/): Denial of service in flexera:flexnet publisher (high 7.5)
- [CVE-2020-1208](https://insights.sbomify.com/CVE-2020-1208/): Memory corruption in Windows (high 7.8)
- [CVE-2020-12079](https://insights.sbomify.com/CVE-2020-12079/): Security feature bypass in beakerbrowser:beaker (critical 10.0)
- [CVE-2020-12078](https://insights.sbomify.com/CVE-2020-12078/): Command injection in opmantek:open-audit (high 8.8)
- [CVE-2020-12077](https://insights.sbomify.com/CVE-2020-12077/): File upload in mappresspro:mappress (high 8.8)
- [CVE-2020-12076](https://insights.sbomify.com/CVE-2020-12076/): Cross-site request forgery in supsystic:data tables generator (critical 9.6)
- [CVE-2020-12075](https://insights.sbomify.com/CVE-2020-12075/): Missing authorization in supsystic:data tables generator (medium 6.3)
- [CVE-2020-12074](https://insights.sbomify.com/CVE-2020-12074/): Privilege escalation in webtoffee:import export wordpress users (high 8.8)
- [CVE-2020-12073](https://insights.sbomify.com/CVE-2020-12073/): Missing authorization in cyberchimps:gutenberg \& elementor templates importer for responsive (critical 9.1)
- [CVE-2020-12071](https://insights.sbomify.com/CVE-2020-12071/): Cross-site scripting in anchorcms:anchor (medium 4.8)
- [CVE-2020-12070](https://insights.sbomify.com/CVE-2020-12070/): Information disclosure in advanced-woo-search:advanced woo search (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/184/