# Vulnerabilities published in 2020


- [CVE-2020-1207](https://insights.sbomify.com/CVE-2020-1207/): Use after free in Windows (high 7.8)
- [CVE-2020-12069](https://insights.sbomify.com/CVE-2020-12069/): CODESYS V3 prone to Inadequate Password Hashing (high 7.8)
- [CVE-2020-12068](https://insights.sbomify.com/CVE-2020-12068/): Privilege escalation in codesys:control for beaglebone (medium 6.5)
- [CVE-2020-12067](https://insights.sbomify.com/CVE-2020-12067/): Auth bypass in pilz:pmc (high 7.5)
- [CVE-2020-12066](https://insights.sbomify.com/CVE-2020-12066/): Denial of service in canonical:ubuntu linux (high 7.5)
- [CVE-2020-12063](https://insights.sbomify.com/CVE-2020-12063/): Security feature bypass in postfix:postfix (medium 5.3)
- [CVE-2020-12062](https://insights.sbomify.com/CVE-2020-12062/): Other in openbsd:openssh (high 7.5)
- [CVE-2020-12061](https://insights.sbomify.com/CVE-2020-12061/): Information disclosure in nitrokey:fido u2f firmware (critical 9.8)
- [CVE-2020-1206](https://insights.sbomify.com/CVE-2020-1206/): Information disclosure in Windows 10 Version 1903 for 32-bit Systems (high 7.5)
- [CVE-2020-12059](https://insights.sbomify.com/CVE-2020-12059/): Null dereference in canonical:ubuntu linux (high 7.5)
- [CVE-2020-12058](https://insights.sbomify.com/CVE-2020-12058/): Cross-site scripting in oscommerce:ce phoenix (medium 6.1)
- [CVE-2020-12054](https://insights.sbomify.com/CVE-2020-12054/): Cross-site scripting in catchplugins:catch breadcrumb (medium 6.1)
- [CVE-2020-12053](https://insights.sbomify.com/CVE-2020-12053/): Auth bypass in unisys:stealth (critical 9.8)
- [CVE-2020-12052](https://insights.sbomify.com/CVE-2020-12052/): Cross-site scripting in grafana:grafana (medium 6.1)
- [CVE-2020-12051](https://insights.sbomify.com/CVE-2020-12051/): Information disclosure in mediawiki:mediawiki (high 7.5)
- [CVE-2020-12050](https://insights.sbomify.com/CVE-2020-12050/): Race condition in fedoraproject:fedora (high 7.0)
- [CVE-2020-1205](https://insights.sbomify.com/CVE-2020-1205/): Microsoft SharePoint Spoofing Vulnerability (medium 4.6)
- [CVE-2020-12049](https://insights.sbomify.com/CVE-2020-12049/): Denial of service in canonical:ubuntu linux (medium 5.5)
- [CVE-2020-12048](https://insights.sbomify.com/CVE-2020-12048/): Information disclosure in Baxter Phoenix Hemodialysis Delivery System (high 7.5)
- [CVE-2020-12047](https://insights.sbomify.com/CVE-2020-12047/): Hardcoded credentials in Baxter Sigma Spectrum Infusion Pumps (critical 9.8)
- [CVE-2020-12046](https://insights.sbomify.com/CVE-2020-12046/): Security feature bypass in Opto 22 SoftPAC Project (medium 5.7)
- [CVE-2020-12045](https://insights.sbomify.com/CVE-2020-12045/): Hardcoded credentials in Baxter Sigma Spectrum Infusion Pumps (critical 9.8)
- [CVE-2020-12043](https://insights.sbomify.com/CVE-2020-12043/): Misconfiguration in Baxter Sigma Spectrum Infusion Pumps (critical 9.8)
- [CVE-2020-12042](https://insights.sbomify.com/CVE-2020-12042/): Path traversal in Opto 22 SoftPAC Project (medium 6.5)
- [CVE-2020-12041](https://insights.sbomify.com/CVE-2020-12041/): Misconfiguration in Baxter Sigma Spectrum Infusion Pumps (critical 9.4)
- [CVE-2020-12040](https://insights.sbomify.com/CVE-2020-12040/): Information disclosure in Baxter Sigma Spectrum Infusion Pumps (critical 9.8)
- [CVE-2020-1204](https://insights.sbomify.com/CVE-2020-1204/): Privilege escalation in Windows (high 7.1)
- [CVE-2020-12039](https://insights.sbomify.com/CVE-2020-12039/): Hardcoded credentials in Baxter Sigma Spectrum Infusion Pumps (low 2.4)
- [CVE-2020-12038](https://insights.sbomify.com/CVE-2020-12038/): Memory corruption in EDS Subsystem, FactoryTalk Linx software (Previously called RSLinx Enterprise), RSLinx Classic, RSNetWorx software, Studio 5000 Logix Designer software (medium 5.5)
- [CVE-2020-12037](https://insights.sbomify.com/CVE-2020-12037/): Information disclosure in Baxter PrismaFlex and PrisMax (high 7.5)
- [CVE-2020-12036](https://insights.sbomify.com/CVE-2020-12036/): Information disclosure in Baxter PrismaFlex and PrisMax (high 7.5)
- [CVE-2020-12035](https://insights.sbomify.com/CVE-2020-12035/): Hardcoded credentials in Baxter PrismaFlex and PrisMax (medium 4.9)
- [CVE-2020-12034](https://insights.sbomify.com/CVE-2020-12034/): SQL injection in EDS Subsystem, FactoryTalk Linx software (Previously called RSLinx Enterprise), RSLinx Classic, RSNetWorx software, Studio 5000 Logix Designer software (high 8.2)
- [CVE-2020-12033](https://insights.sbomify.com/CVE-2020-12033/): Other in Rockwell Automation FactoryTalk Services Platform (high 8.8)
- [CVE-2020-12032](https://insights.sbomify.com/CVE-2020-12032/): Information disclosure in Baxter ExactaMix EM 2400 & EM 1200 (critical 9.1)
- [CVE-2020-12031](https://insights.sbomify.com/CVE-2020-12031/): Rockwell Automation FactoryTalk View SE (high 7.5)
- [CVE-2020-12030](https://insights.sbomify.com/CVE-2020-12030/): Emerson WirelessHART Gateway (critical 10.0)
- [CVE-2020-1203](https://insights.sbomify.com/CVE-2020-1203/): Memory corruption in Microsoft Visual Studio (high 7.8)
- [CVE-2020-12029](https://insights.sbomify.com/CVE-2020-12029/): Rockwell Automation FactoryTalk View SE (critical 9.0)
- [CVE-2020-12028](https://insights.sbomify.com/CVE-2020-12028/): Rockwell Automation FactoryTalk View SE (high 7.3)
- [CVE-2020-12027](https://insights.sbomify.com/CVE-2020-12027/): Rockwell Automation FactoryTalk View SE (medium 4.3)
- [CVE-2020-12026](https://insights.sbomify.com/CVE-2020-12026/): Path traversal in Advantech WebAccess Node (high 8.8)
- [CVE-2020-12025](https://insights.sbomify.com/CVE-2020-12025/): XML external entity in Rockwell Automation Logix Designer Studio 5000 Versions 32.00, 32.01, and 32.02 (low 3.3)
- [CVE-2020-12024](https://insights.sbomify.com/CVE-2020-12024/): Security feature bypass in Baxter ExactaMix EM 2400 & EM 1200 (medium 6.1)
- [CVE-2020-12023](https://insights.sbomify.com/CVE-2020-12023/): Philips IntelliBridge Enterprise IBE Insertion of Sensitive Information into Log File (low 2.0)
- [CVE-2020-12022](https://insights.sbomify.com/CVE-2020-12022/): Memory corruption in Advantech WebAccess Node (critical 9.8)
- [CVE-2020-12021](https://insights.sbomify.com/CVE-2020-12021/): Cross-site scripting in OSIsoft PI Web API 2019 (critical 9.0)
- [CVE-2020-12020](https://insights.sbomify.com/CVE-2020-12020/): Missing authorization in Baxter ExactaMix EM 2400 & EM 1200 (medium 6.1)
- [CVE-2020-1202](https://insights.sbomify.com/CVE-2020-1202/): Privilege escalation in Microsoft Visual Studio (high 7.8)
- [CVE-2020-12019](https://insights.sbomify.com/CVE-2020-12019/): Memory corruption in WebAccess Node (critical 9.8)
- [CVE-2020-12018](https://insights.sbomify.com/CVE-2020-12018/): Memory corruption in Advantech WebAccess Node (high 7.5)
- [CVE-2020-12017](https://insights.sbomify.com/CVE-2020-12017/): Auth bypass in GE Grid Solutions Reason RT Clocks (critical 9.8)
- [CVE-2020-12016](https://insights.sbomify.com/CVE-2020-12016/): Hardcoded credentials in Baxter ExactaMix EM 2400 & EM 1200 (critical 9.8)
- [CVE-2020-12015](https://insights.sbomify.com/CVE-2020-12015/): Deserialization in GenBroker32 (high 7.5)
- [CVE-2020-12014](https://insights.sbomify.com/CVE-2020-12014/): SQL injection in Advantech WebAccess Node (high 7.5)
- [CVE-2020-12013](https://insights.sbomify.com/CVE-2020-12013/): SQL injection in GenBroker32 (critical 9.1)
- [CVE-2020-12012](https://insights.sbomify.com/CVE-2020-12012/): Hardcoded credentials in Baxter ExactaMix EM 2400 & EM 1200 (medium 6.1)
- [CVE-2020-12011](https://insights.sbomify.com/CVE-2020-12011/): Memory corruption in GenBroker32 (critical 9.8)
- [CVE-2020-12010](https://insights.sbomify.com/CVE-2020-12010/): Path traversal in Advantech WebAccess Node (high 7.1)
- [CVE-2020-1201](https://insights.sbomify.com/CVE-2020-1201/): Privilege escalation in Windows (high 7.8)
- [CVE-2020-12009](https://insights.sbomify.com/CVE-2020-12009/): Deserialization in GenBroker32 (high 7.5)
- [CVE-2020-12008](https://insights.sbomify.com/CVE-2020-12008/): Information disclosure in Baxter ExactaMix EM 2400 & EM 1200 (high 7.5)
- [CVE-2020-12007](https://insights.sbomify.com/CVE-2020-12007/): Deserialization in GenBroker32 (critical 9.8)
- [CVE-2020-12006](https://insights.sbomify.com/CVE-2020-12006/): Path traversal in Advantech WebAccess Node (critical 9.8)
- [CVE-2020-12005](https://insights.sbomify.com/CVE-2020-12005/): Denial of service in FactoryTalk Linx, RSLinx Classic, Connected Components Workbench, ControlFLASH Plus, FactoryTalk Asset Centre, FactoryTalk Linx CommDTM, Studio 5000 Launcher, Studio 5000 Logix Designer software (high 7.5)
- [CVE-2020-12004](https://insights.sbomify.com/CVE-2020-12004/): Missing authorization in Ignition 8 Gateway (high 7.5)
- [CVE-2020-12003](https://insights.sbomify.com/CVE-2020-12003/): Path traversal in FactoryTalk Linx, RSLinx Classic, Connected Components Workbench, ControlFLASH Plus, FactoryTalk Asset Centre, FactoryTalk Linx CommDTM, Studio 5000 Launcher, Studio 5000 Logix Designer software (high 7.5)
- [CVE-2020-12002](https://insights.sbomify.com/CVE-2020-12002/): Memory corruption in Advantech WebAccess Node (critical 9.8)
- [CVE-2020-12001](https://insights.sbomify.com/CVE-2020-12001/): Path traversal in FactoryTalk Linx, RSLinx Classic, Connected Components Workbench, ControlFLASH Plus, FactoryTalk Asset Centre, FactoryTalk Linx CommDTM, Studio 5000 Launcher, Studio 5000 Logix Designer software (critical 9.8)
- [CVE-2020-12000](https://insights.sbomify.com/CVE-2020-12000/): Deserialization in Ignition 8 Gateway (high 7.5)
- [CVE-2020-1200](https://insights.sbomify.com/CVE-2020-1200/): Microsoft SharePoint Remote Code Execution Vulnerability (high 8.6)
- [CVE-2020-11999](https://insights.sbomify.com/CVE-2020-11999/): Code injection in FactoryTalk Linx, RSLinx Classic, Connected Components Workbench, ControlFLASH Plus, FactoryTalk Asset Centre, FactoryTalk Linx CommDTM, Studio 5000 Launcher, Studio 5000 Logix Designer software (high 8.1)
- [CVE-2020-11998](https://insights.sbomify.com/CVE-2020-11998/): Remote code execution in Apache ActiveMQ (critical 9.8)
- [CVE-2020-11997](https://insights.sbomify.com/CVE-2020-11997/): Missing authorization in Apache Guacamole (medium 4.3)
- [CVE-2020-11996](https://insights.sbomify.com/CVE-2020-11996/): Uncontrolled Resource Consumption in Apache Tomcat (high 7.5)
- [CVE-2020-11995](https://insights.sbomify.com/CVE-2020-11995/): Apache Dubbo default deserialization protocol Hessian2 cause CRE (critical 9.8)
- [CVE-2020-11994](https://insights.sbomify.com/CVE-2020-11994/): Server side template injection in Apache Camel (high 7.5)
- [CVE-2020-11993](https://insights.sbomify.com/CVE-2020-11993/): Race condition in Apache HTTP Server (high 7.5)
- [CVE-2020-11991](https://insights.sbomify.com/CVE-2020-11991/): XML external entity in Apache Cocoon (high 7.5)
- [CVE-2020-11990](https://insights.sbomify.com/CVE-2020-11990/): Information disclosure in Apache Cordova ( cordova-plugin-camera ) (low 3.3)
- [CVE-2020-1199](https://insights.sbomify.com/CVE-2020-1199/): Privilege escalation in Windows (high 7.8)
- [CVE-2020-11989](https://insights.sbomify.com/CVE-2020-11989/): Improper Authentication in Apache Shiro (critical 9.8)
- [CVE-2020-11988](https://insights.sbomify.com/CVE-2020-11988/): Server-side request forgery (SSRF) in Apache XmlGraphics Commons (high 8.2)
- [CVE-2020-11987](https://insights.sbomify.com/CVE-2020-11987/): Server-side request forgery (SSRF) in Apache Batik (high 8.2)
- [CVE-2020-11986](https://insights.sbomify.com/CVE-2020-11986/): Code injection in Apache NetBeans (critical 9.8)
- [CVE-2020-11985](https://insights.sbomify.com/CVE-2020-11985/): Security feature bypass in Apache HTTP Server (medium 5.3)
- [CVE-2020-11984](https://insights.sbomify.com/CVE-2020-11984/): Memory corruption in Apache HTTP Server (critical 9.8)
- [CVE-2020-11983](https://insights.sbomify.com/CVE-2020-11983/): Multiple stored XSS in RBAC Admin screens in Apache Airflow (medium 5.4)
- [CVE-2020-11982](https://insights.sbomify.com/CVE-2020-11982/): Insecure default config of Celery worker in Apache Airflow (critical 9.8)
- [CVE-2020-11981](https://insights.sbomify.com/CVE-2020-11981/): Command injection via Celery broker in Apache Airflow (critical 9.8)
- [CVE-2020-11980](https://insights.sbomify.com/CVE-2020-11980/): Server-Side Request Forgery in Karaf (medium 6.3)
- [CVE-2020-1198](https://insights.sbomify.com/CVE-2020-1198/): Microsoft Office SharePoint XSS Vulnerability (high 7.4)
- [CVE-2020-11979](https://insights.sbomify.com/CVE-2020-11979/): Code injection in Apache Ant (high 7.5)
- [CVE-2020-11978](https://insights.sbomify.com/CVE-2020-11978/): Apache Airflow Command Injection (high 8.8, exploited in the wild)
- [CVE-2020-11977](https://insights.sbomify.com/CVE-2020-11977/): Shell command injection in Apache Syncope (high 7.2)
- [CVE-2020-11976](https://insights.sbomify.com/CVE-2020-11976/): Exposure of Sensitive Information to an Unauthorized Actor in Apache Wicket (high 7.5)
- [CVE-2020-11975](https://insights.sbomify.com/CVE-2020-11975/): Improper Input Validation in Apache Unomi (critical 9.8)
- [CVE-2020-11974](https://insights.sbomify.com/CVE-2020-11974/): Remote code execution in DolphinScheduler (critical 9.8)
- [CVE-2020-11973](https://insights.sbomify.com/CVE-2020-11973/): Apache Camel Netty enables Java deserialization by default (critical 9.8)
- [CVE-2020-11972](https://insights.sbomify.com/CVE-2020-11972/): Deserialization of Untrusted Data in Apache Camel RabbitMQ (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/185/