# Vulnerabilities published in 2020


- [CVE-2020-11554](https://insights.sbomify.com/CVE-2020-11554/): Information disclosure in castlerock:snmpc online (high 7.5)
- [CVE-2020-11553](https://insights.sbomify.com/CVE-2020-11553/): Cross-site request forgery in castlerock:snmpc online (high 8.8)
- [CVE-2020-11552](https://insights.sbomify.com/CVE-2020-11552/): Privilege escalation in zohocorp:manageengine adselfservice plus (critical 9.8)
- [CVE-2020-11551](https://insights.sbomify.com/CVE-2020-11551/): Missing authorization in netgear:rbs50y firmware (critical 9.6)
- [CVE-2020-11550](https://insights.sbomify.com/CVE-2020-11550/): Information disclosure in netgear:rbs50y firmware (high 7.4)
- [CVE-2020-1155](https://insights.sbomify.com/CVE-2020-1155/): Windows Runtime Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2020-11549](https://insights.sbomify.com/CVE-2020-11549/): Hardcoded credentials in netgear:rbs50y firmware (high 8.3)
- [CVE-2020-11548](https://insights.sbomify.com/CVE-2020-11548/): Code injection in search meter project:search meter (critical 9.8)
- [CVE-2020-11547](https://insights.sbomify.com/CVE-2020-11547/): Missing authorization in paessler:prtg network monitor (medium 5.3)
- [CVE-2020-11546](https://insights.sbomify.com/CVE-2020-11546/): Code injection in superwebmailer:superwebmailer (critical 9.8)
- [CVE-2020-11545](https://insights.sbomify.com/CVE-2020-11545/): SQL injection in projectworlds:official car rental system (critical 9.8)
- [CVE-2020-11544](https://insights.sbomify.com/CVE-2020-11544/): File upload in projectworlds:official car rental system (high 7.2)
- [CVE-2020-11543](https://insights.sbomify.com/CVE-2020-11543/): Hardcoded credentials in opsramp:gateway (critical 9.8)
- [CVE-2020-11542](https://insights.sbomify.com/CVE-2020-11542/): Auth bypass in 3xlogic:infinias eidc32 firmware (critical 9.8)
- [CVE-2020-11541](https://insights.sbomify.com/CVE-2020-11541/): XML external entity in techsmith:snagit (medium 5.5)
- [CVE-2020-1154](https://insights.sbomify.com/CVE-2020-1154/): Windows Common Log File System Driver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2020-11539](https://insights.sbomify.com/CVE-2020-11539/): Auth bypass in titan:sf rush smart band firmware (high 8.1)
- [CVE-2020-11538](https://insights.sbomify.com/CVE-2020-11538/): Out-of-bounds read in Pillow (high 8.1)
- [CVE-2020-11537](https://insights.sbomify.com/CVE-2020-11537/): SQL injection in onlyoffice:document server (critical 9.8)
- [CVE-2020-11536](https://insights.sbomify.com/CVE-2020-11536/): Path traversal in onlyoffice:document server (critical 9.8)
- [CVE-2020-11535](https://insights.sbomify.com/CVE-2020-11535/): Code injection in onlyoffice:document server (critical 9.8)
- [CVE-2020-11534](https://insights.sbomify.com/CVE-2020-11534/): Command injection in onlyoffice:document server (critical 9.8)
- [CVE-2020-11533](https://insights.sbomify.com/CVE-2020-11533/): Information disclosure in ivanti:workspace control (medium 5.5)
- [CVE-2020-11532](https://insights.sbomify.com/CVE-2020-11532/): Hardcoded credentials in zohocorp:manageengine adaudit plus (critical 9.8)
- [CVE-2020-11531](https://insights.sbomify.com/CVE-2020-11531/): Path traversal in zohocorp:manageengine adaudit plus (high 8.8)
- [CVE-2020-11530](https://insights.sbomify.com/CVE-2020-11530/): SQL injection in idangero:chop slider (critical 9.8)
- [CVE-2020-1153](https://insights.sbomify.com/CVE-2020-1153/): Microsoft Graphics Components Remote Code Execution Vulnerability (high 7.8)
- [CVE-2020-11529](https://insights.sbomify.com/CVE-2020-11529/): Open Redirect in Grav (medium 6.1)
- [CVE-2020-11528](https://insights.sbomify.com/CVE-2020-11528/): Memory corruption in bit2spr project:bit2spr (high 7.5)
- [CVE-2020-11527](https://insights.sbomify.com/CVE-2020-11527/): Path traversal in zohocorp:manageengine opmanager (high 7.5)
- [CVE-2020-11526](https://insights.sbomify.com/CVE-2020-11526/): Memory corruption in canonical:ubuntu linux (low 2.2)
- [CVE-2020-11525](https://insights.sbomify.com/CVE-2020-11525/): Memory corruption in canonical:ubuntu linux (low 2.2)
- [CVE-2020-11524](https://insights.sbomify.com/CVE-2020-11524/): Memory corruption in canonical:ubuntu linux (medium 6.6)
- [CVE-2020-11523](https://insights.sbomify.com/CVE-2020-11523/): Integer overflow in canonical:ubuntu linux (medium 6.6)
- [CVE-2020-11522](https://insights.sbomify.com/CVE-2020-11522/): Memory corruption in canonical:ubuntu linux (medium 6.5)
- [CVE-2020-11521](https://insights.sbomify.com/CVE-2020-11521/): Memory corruption in canonical:ubuntu linux (medium 6.6)
- [CVE-2020-11520](https://insights.sbomify.com/CVE-2020-11520/): Memory corruption in winmagic:securedoc (high 7.8)
- [CVE-2020-1152](https://insights.sbomify.com/CVE-2020-1152/): Windows Win32k Elevation of Privilege Vulnerability (medium 5.8)
- [CVE-2020-11519](https://insights.sbomify.com/CVE-2020-11519/): Privilege escalation in winmagic:securedoc (high 7.8)
- [CVE-2020-11518](https://insights.sbomify.com/CVE-2020-11518/): Code injection in zohocorp:manageengine adselfservice plus (critical 9.8)
- [CVE-2020-11516](https://insights.sbomify.com/CVE-2020-11516/): Cross-site scripting in contact-form-7-datepicker project:contact-form-7-datepicker (medium 5.4)
- [CVE-2020-11515](https://insights.sbomify.com/CVE-2020-11515/): Missing authorization in rankmath:seo (medium 6.1)
- [CVE-2020-11514](https://insights.sbomify.com/CVE-2020-11514/): Missing authorization in rankmath:seo (critical 9.8)
- [CVE-2020-11512](https://insights.sbomify.com/CVE-2020-11512/): Cross-site scripting in idxbroker:impress for idx broker (medium 5.4)
- [CVE-2020-11511](https://insights.sbomify.com/CVE-2020-11511/): Missing authorization in thimpress:learnpress (high 8.1)
- [CVE-2020-1151](https://insights.sbomify.com/CVE-2020-1151/): Windows Runtime Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2020-11509](https://insights.sbomify.com/CVE-2020-11509/): Cross-site scripting in wpleadplus:wp lead plus x (medium 6.1)
- [CVE-2020-11508](https://insights.sbomify.com/CVE-2020-11508/): Cross-site scripting in wpleadplus:wp lead plus x (medium 5.4)
- [CVE-2020-11507](https://insights.sbomify.com/CVE-2020-11507/): Privilege escalation in malwarebytes:adwcleaner (high 7.8)
- [CVE-2020-11506](https://insights.sbomify.com/CVE-2020-11506/): Security feature bypass in gitlab:gitlab (high 7.5)
- [CVE-2020-11505](https://insights.sbomify.com/CVE-2020-11505/): Information disclosure in gitlab:gitlab (high 7.5)
- [CVE-2020-11503](https://insights.sbomify.com/CVE-2020-11503/): Memory corruption in sophos:sfos (critical 9.8)
- [CVE-2020-11501](https://insights.sbomify.com/CVE-2020-11501/): Weak cryptography in canonical:ubuntu linux (high 7.4)
- [CVE-2020-11500](https://insights.sbomify.com/CVE-2020-11500/): Weak cryptography in zoom:meetings (high 7.5)
- [CVE-2020-1150](https://insights.sbomify.com/CVE-2020-1150/): Media Foundation Memory Corruption Vulnerability (high 7.8)
- [CVE-2020-11499](https://insights.sbomify.com/CVE-2020-11499/): Cross-site scripting in firmware analysis and comparison tool project:firmware analysis and comparison tool (low 3.3)
- [CVE-2020-11498](https://insights.sbomify.com/CVE-2020-11498/): Path traversal in slack:nebula (high 8.8)
- [CVE-2020-11497](https://insights.sbomify.com/CVE-2020-11497/): Business logic in woocommerce:nab transact (high 7.5)
- [CVE-2020-11496](https://insights.sbomify.com/CVE-2020-11496/): Command injection in sprecher-automation:sprecon-e (medium 6.7)
- [CVE-2020-11494](https://insights.sbomify.com/CVE-2020-11494/): Information disclosure in canonical:ubuntu linux (medium 4.4)
- [CVE-2020-11493](https://insights.sbomify.com/CVE-2020-11493/): Information disclosure in foxitsoftware:phantompdf (high 8.1)
- [CVE-2020-11492](https://insights.sbomify.com/CVE-2020-11492/): Race condition in docker:docker desktop (high 7.8)
- [CVE-2020-11491](https://insights.sbomify.com/CVE-2020-11491/): Path traversal in zevenet:zen load balancer (medium 4.9)
- [CVE-2020-11490](https://insights.sbomify.com/CVE-2020-11490/): Command injection in zevenet:zen load balancer (high 7.2)
- [CVE-2020-1149](https://insights.sbomify.com/CVE-2020-1149/): Windows Runtime Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2020-11489](https://insights.sbomify.com/CVE-2020-11489/): Hardcoded credentials in NVIDIA DGX Servers (high 7.5)
- [CVE-2020-11488](https://insights.sbomify.com/CVE-2020-11488/): Weak cryptography in NVIDIA DGX Servers (medium 6.7)
- [CVE-2020-11487](https://insights.sbomify.com/CVE-2020-11487/): Hardcoded credentials in NVIDIA DGX Servers (high 7.5)
- [CVE-2020-11486](https://insights.sbomify.com/CVE-2020-11486/): File upload in NVIDIA DGX Servers (critical 9.8)
- [CVE-2020-11485](https://insights.sbomify.com/CVE-2020-11485/): Cross-site request forgery in NVIDIA DGX Servers (high 8.8)
- [CVE-2020-11484](https://insights.sbomify.com/CVE-2020-11484/): Information disclosure in NVIDIA DGX Servers (medium 4.9)
- [CVE-2020-11483](https://insights.sbomify.com/CVE-2020-11483/): Hardcoded credentials in NVIDIA DGX Servers (critical 9.8)
- [CVE-2020-1148](https://insights.sbomify.com/CVE-2020-1148/): Cross-site scripting in Microsoft SharePoint Enterprise Server (medium 5.4)
- [CVE-2020-11476](https://insights.sbomify.com/CVE-2020-11476/): Unrestricted Uploads in Concrete5 (high 7.2)
- [CVE-2020-11474](https://insights.sbomify.com/CVE-2020-11474/): Other in ncp-e:secure enterprise client (high 7.8)
- [CVE-2020-11470](https://insights.sbomify.com/CVE-2020-11470/): Security feature bypass in zoom:meetings (low 2.3)
- [CVE-2020-1147](https://insights.sbomify.com/CVE-2020-1147/): Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution (high 7.8, exploited in the wild)
- [CVE-2020-11469](https://insights.sbomify.com/CVE-2020-11469/): Privilege escalation in zoom:meetings (medium 6.3)
- [CVE-2020-11467](https://insights.sbomify.com/CVE-2020-11467/): Deserialization in deskpro:deskpro (critical 9.1)
- [CVE-2020-11466](https://insights.sbomify.com/CVE-2020-11466/): Missing authorization in deskpro:deskpro (high 7.6)
- [CVE-2020-11465](https://insights.sbomify.com/CVE-2020-11465/): Missing authorization in deskpro:deskpro (high 8.8)
- [CVE-2020-11464](https://insights.sbomify.com/CVE-2020-11464/): Missing authorization in deskpro:deskpro (medium 6.5)
- [CVE-2020-11463](https://insights.sbomify.com/CVE-2020-11463/): Missing authorization in deskpro:deskpro (high 7.5)
- [CVE-2020-11462](https://insights.sbomify.com/CVE-2020-11462/): XML external entity in openvpn:openvpn access server (high 7.5)
- [CVE-2020-1146](https://insights.sbomify.com/CVE-2020-1146/): Microsoft Store Runtime Elevation of Privilege Vulnerability (medium 6.6)
- [CVE-2020-11458](https://insights.sbomify.com/CVE-2020-11458/): Information disclosure in misp-project:misp (medium 4.9)
- [CVE-2020-11457](https://insights.sbomify.com/CVE-2020-11457/): Cross-site scripting in netgate:pfsense (medium 5.4)
- [CVE-2020-11456](https://insights.sbomify.com/CVE-2020-11456/): Cross-site scripting in limesurvey:limesurvey (medium 5.4)
- [CVE-2020-11455](https://insights.sbomify.com/CVE-2020-11455/): Path traversal in limesurvey:limesurvey (critical 9.8)
- [CVE-2020-11454](https://insights.sbomify.com/CVE-2020-11454/): Cross-site scripting in microstrategy:microstrategy web (medium 5.4)
- [CVE-2020-11453](https://insights.sbomify.com/CVE-2020-11453/): Server-side request forgery in microstrategy:microstrategy web (medium 5.3)
- [CVE-2020-11452](https://insights.sbomify.com/CVE-2020-11452/): Server-side request forgery in microstrategy:microstrategy web (medium 4.3)
- [CVE-2020-11451](https://insights.sbomify.com/CVE-2020-11451/): File upload in microstrategy:microstrategy web (high 7.2)
- [CVE-2020-11450](https://insights.sbomify.com/CVE-2020-11450/): Information disclosure in microstrategy:microstrategy web (high 7.5)
- [CVE-2020-1145](https://insights.sbomify.com/CVE-2020-1145/): Windows GDI Information Disclosure Vulnerability (medium 5.5)
- [CVE-2020-11449](https://insights.sbomify.com/CVE-2020-11449/): Information disclosure in technicolor:tc7337 firmware (high 7.5)
- [CVE-2020-11448](https://insights.sbomify.com/CVE-2020-11448/): Cross-site scripting in bell:home hub 3000 firmware (medium 6.1)
- [CVE-2020-11447](https://insights.sbomify.com/CVE-2020-11447/): Information disclosure in bell:home hub 3000 firmware (medium 4.3)
- [CVE-2020-11446](https://insights.sbomify.com/CVE-2020-11446/): Privilege escalation in eset:antivirus and antispyware (high 7.8)
- [CVE-2020-11445](https://insights.sbomify.com/CVE-2020-11445/): Auth bypass in tp-link:kc200 firmware (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/190/