# Vulnerabilities published in 2020


- [CVE-2020-11047](https://insights.sbomify.com/CVE-2020-11047/): Out-of-bounds Read in FreeRDP (medium 5.5)
- [CVE-2020-11046](https://insights.sbomify.com/CVE-2020-11046/): Improper Restriction of Operations within the Bounds of a Memory Buffer in FreeRDP (medium 5.5)
- [CVE-2020-11045](https://insights.sbomify.com/CVE-2020-11045/): Out-of-bounds Read in FreeRDP (low 2.2)
- [CVE-2020-11044](https://insights.sbomify.com/CVE-2020-11044/): Double Free in FreeRDP (low 2.2)
- [CVE-2020-11043](https://insights.sbomify.com/CVE-2020-11043/): Out-of-bounds Read in FreeRDP (low 2.2)
- [CVE-2020-11042](https://insights.sbomify.com/CVE-2020-11042/): Out-of-bounds Read in FreeRDP (medium 5.5)
- [CVE-2020-11041](https://insights.sbomify.com/CVE-2020-11041/): Improper Validation of Array Index in FreeRDP (low 2.2)
- [CVE-2020-11040](https://insights.sbomify.com/CVE-2020-11040/): Out-of-bounds Read in FreeRDP (low 2.2)
- [CVE-2020-1104](https://insights.sbomify.com/CVE-2020-1104/): Microsoft SharePoint Spoofing Vulnerability (medium 5.4)
- [CVE-2020-11039](https://insights.sbomify.com/CVE-2020-11039/): Integer Overflow in FreeRDP (high 8.0)
- [CVE-2020-11038](https://insights.sbomify.com/CVE-2020-11038/): Integer Overflow to Buffer Overflow in FreeRDP (medium 6.9)
- [CVE-2020-11037](https://insights.sbomify.com/CVE-2020-11037/): Potential Observable Timing Discrepancy in Wagtail (medium 6.1)
- [CVE-2020-11036](https://insights.sbomify.com/CVE-2020-11036/): XSS in GLPI (high 7.6)
- [CVE-2020-11035](https://insights.sbomify.com/CVE-2020-11035/): weak CSRF tokens in GLPI (high 7.5)
- [CVE-2020-11034](https://insights.sbomify.com/CVE-2020-11034/): bypass of manageRedirect in GLPI (medium 6.1)
- [CVE-2020-11033](https://insights.sbomify.com/CVE-2020-11033/): Able to read any token through API user endpoint in GLPI (medium 6.6)
- [CVE-2020-11032](https://insights.sbomify.com/CVE-2020-11032/): SQL injection on addme_observer and addme_assign in GLPI (high 7.6)
- [CVE-2020-11031](https://insights.sbomify.com/CVE-2020-11031/): Insecure encryption algorithm in GLPI (high 7.8)
- [CVE-2020-11030](https://insights.sbomify.com/CVE-2020-11030/): Cross-site scripting (XSS) in Search block in WordPress (medium 6.4)
- [CVE-2020-1103](https://insights.sbomify.com/CVE-2020-1103/): Microsoft SharePoint Information Disclosure Vulnerability (medium 6.5)
- [CVE-2020-11029](https://insights.sbomify.com/CVE-2020-11029/): Cross-site scripting in stats method (object cache) in WordPress (medium 5.8)
- [CVE-2020-11028](https://insights.sbomify.com/CVE-2020-11028/): Unauthenticated disclosure of certain private posts in WordPress (medium 5.8)
- [CVE-2020-11027](https://insights.sbomify.com/CVE-2020-11027/): Password reset links invalidation issue in WordPress (medium 6.1)
- [CVE-2020-11026](https://insights.sbomify.com/CVE-2020-11026/): Specially crafted filenames in WordPress leading to XSS (high 8.7)
- [CVE-2020-11025](https://insights.sbomify.com/CVE-2020-11025/): Authenticated cross-site scripting (XSS) in WordPress Customizer (medium 5.8)
- [CVE-2020-11024](https://insights.sbomify.com/CVE-2020-11024/): Man-in-the-middle attack in Moonlight iOS/tvOS (medium 6.1)
- [CVE-2020-11023](https://insights.sbomify.com/CVE-2020-11023/): JQuery Cross-Site Scripting (XSS) (medium 6.9, exploited in the wild)
- [CVE-2020-11022](https://insights.sbomify.com/CVE-2020-11022/): jQuery has a potential XSS vulnerability (medium 6.9)
- [CVE-2020-11021](https://insights.sbomify.com/CVE-2020-11021/): HTTP request which redirect to another hostname do not strip authorization header in Actions Http-Client (medium 6.3)
- [CVE-2020-11020](https://insights.sbomify.com/CVE-2020-11020/): Authentication and extension bypass in Faye (high 8.5)
- [CVE-2020-1102](https://insights.sbomify.com/CVE-2020-1102/): Microsoft SharePoint Remote Code Execution Vulnerability (high 8.8)
- [CVE-2020-11019](https://insights.sbomify.com/CVE-2020-11019/): Out of bound read in update_recv in FreeRDP (medium 4.3)
- [CVE-2020-11018](https://insights.sbomify.com/CVE-2020-11018/): Out of bound read in cliprdr_server_receive_capabilities in FreeRDP (medium 6.5)
- [CVE-2020-11017](https://insights.sbomify.com/CVE-2020-11017/): Double free in cliprdr_server_receive_capabilities in FreeRDP (medium 6.5)
- [CVE-2020-11016](https://insights.sbomify.com/CVE-2020-11016/): Remote code execution in Message sending functionality in IntelMQ Manager (critical 9.1)
- [CVE-2020-11015](https://insights.sbomify.com/CVE-2020-11015/): Device Authentication Vulnerability in thinx-device-api IoT Device Management Server (high 7.5)
- [CVE-2020-11014](https://insights.sbomify.com/CVE-2020-11014/): BIP LI01 output reordering may cause malformed SLP MINT transactions in Electron-Cash-SLP (medium 6.1)
- [CVE-2020-11013](https://insights.sbomify.com/CVE-2020-11013/): lookup Function Information Discolosure in Helm (high 8.5)
- [CVE-2020-11012](https://insights.sbomify.com/CVE-2020-11012/): Authentication bypass MinIO Admin API (critical 9.3)
- [CVE-2020-11011](https://insights.sbomify.com/CVE-2020-11011/): RCE via file upload in Phproject (critical 9.9)
- [CVE-2020-11010](https://insights.sbomify.com/CVE-2020-11010/): SQL injection in Tortoise ORM (medium 6.3)
- [CVE-2020-1101](https://insights.sbomify.com/CVE-2020-1101/): Microsoft Office SharePoint XSS Vulnerability (medium 5.4)
- [CVE-2020-11009](https://insights.sbomify.com/CVE-2020-11009/): IDOR can reveal execution data and logs to unauthorized user in Rundeck (medium 6.5)
- [CVE-2020-11008](https://insights.sbomify.com/CVE-2020-11008/): Malicious URLs can still cause Git to send a stored credential to the wrong server (medium 4.0)
- [CVE-2020-11007](https://insights.sbomify.com/CVE-2020-11007/): Negative charge in shopping cart possible in Shopizer (medium 6.5)
- [CVE-2020-11006](https://insights.sbomify.com/CVE-2020-11006/): Potential remote code execution in Shopizer (critical 9.1)
- [CVE-2020-11005](https://insights.sbomify.com/CVE-2020-11005/): Internal NCryptDecrypt method could be used externally from WindowsHello library. (medium 5.1)
- [CVE-2020-11004](https://insights.sbomify.com/CVE-2020-11004/): SQL Injection in Admidio (high 7.7)
- [CVE-2020-11003](https://insights.sbomify.com/CVE-2020-11003/): CSRF and DNS Rebinding in Oasis (medium 4.8)
- [CVE-2020-11002](https://insights.sbomify.com/CVE-2020-11002/): Remote Code Execution (RCE) vulnerability in dropwizard-validation (high 8.0)
- [CVE-2020-11001](https://insights.sbomify.com/CVE-2020-11001/): Possible XSS attack in Wagtail (medium 5.8)
- [CVE-2020-11000](https://insights.sbomify.com/CVE-2020-11000/): Improper URL validation in GreenBrowser (medium 5.7)
- [CVE-2020-1100](https://insights.sbomify.com/CVE-2020-1100/): Microsoft Office SharePoint XSS Vulnerability (medium 5.4)
- [CVE-2020-10997](https://insights.sbomify.com/CVE-2020-10997/): Information disclosure in percona:xtrabackup (medium 6.5)
- [CVE-2020-10996](https://insights.sbomify.com/CVE-2020-10996/): Hardcoded credentials in percona:xtradb cluster (high 8.1)
- [CVE-2020-10995](https://insights.sbomify.com/CVE-2020-10995/): Denial of service in debian:debian linux (high 7.5)
- [CVE-2020-10994](https://insights.sbomify.com/CVE-2020-10994/): Out-of-bounds reads in Pillow (medium 5.5)
- [CVE-2020-10993](https://insights.sbomify.com/CVE-2020-10993/): XML external entity in osmand:osmand (critical 9.1)
- [CVE-2020-10992](https://insights.sbomify.com/CVE-2020-10992/): XML external entity in azkaban project:azkaban (critical 9.8)
- [CVE-2020-10991](https://insights.sbomify.com/CVE-2020-10991/): XML external entity in mulesoft:aplkit (critical 9.8)
- [CVE-2020-10990](https://insights.sbomify.com/CVE-2020-10990/): XML external entity in accenture:mercury (critical 9.8)
- [CVE-2020-1099](https://insights.sbomify.com/CVE-2020-1099/): Microsoft Office SharePoint XSS Vulnerability (medium 5.4)
- [CVE-2020-10989](https://insights.sbomify.com/CVE-2020-10989/): Cross-site scripting in tenda:ac15 firmware (medium 6.1)
- [CVE-2020-10988](https://insights.sbomify.com/CVE-2020-10988/): Hardcoded credentials in tenda:ac15 firmware (critical 9.8)
- [CVE-2020-10987](https://insights.sbomify.com/CVE-2020-10987/): Tenda AC1900 Router AC15 Model Remote Code Execution (critical 9.8, exploited in the wild)
- [CVE-2020-10986](https://insights.sbomify.com/CVE-2020-10986/): Cross-site request forgery in tenda:ac15 firmware (medium 6.5)
- [CVE-2020-10985](https://insights.sbomify.com/CVE-2020-10985/): Cross-site scripting in gambio:gambio gx (medium 4.8)
- [CVE-2020-10984](https://insights.sbomify.com/CVE-2020-10984/): Cross-site request forgery in gambio:gambio gx (high 8.8)
- [CVE-2020-10983](https://insights.sbomify.com/CVE-2020-10983/): SQL injection in gambio:gambio gx (medium 4.9)
- [CVE-2020-10982](https://insights.sbomify.com/CVE-2020-10982/): SQL injection in gambio:gambio gx (medium 4.9)
- [CVE-2020-10981](https://insights.sbomify.com/CVE-2020-10981/): Missing authorization in gitlab:gitlab (medium 4.3)
- [CVE-2020-10980](https://insights.sbomify.com/CVE-2020-10980/): Server-side request forgery in gitlab:gitlab (critical 9.8)
- [CVE-2020-1098](https://insights.sbomify.com/CVE-2020-1098/): Windows Shell Infrastructure Component Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2020-10979](https://insights.sbomify.com/CVE-2020-10979/): Information disclosure in gitlab:gitlab (medium 4.3)
- [CVE-2020-10978](https://insights.sbomify.com/CVE-2020-10978/): Information disclosure in gitlab:gitlab (medium 5.3)
- [CVE-2020-10977](https://insights.sbomify.com/CVE-2020-10977/): Path traversal in gitlab:gitlab (medium 5.5)
- [CVE-2020-10976](https://insights.sbomify.com/CVE-2020-10976/): Information disclosure in gitlab:gitlab (high 7.5)
- [CVE-2020-10975](https://insights.sbomify.com/CVE-2020-10975/): Information disclosure in gitlab:gitlab (medium 4.3)
- [CVE-2020-10974](https://insights.sbomify.com/CVE-2020-10974/): Missing authorization in wavlink:jetstream ac3000 firmware (high 7.5)
- [CVE-2020-10973](https://insights.sbomify.com/CVE-2020-10973/): Missing authorization in wavlink:wn530hg4 firmware (high 7.5)
- [CVE-2020-10972](https://insights.sbomify.com/CVE-2020-10972/): Information disclosure in wavlink:wn530hg4 firmware (high 7.5)
- [CVE-2020-10971](https://insights.sbomify.com/CVE-2020-10971/): Cross-site request forgery in wavlink:wl-wn530hg4 firmware (high 8.8)
- [CVE-2020-1097](https://insights.sbomify.com/CVE-2020-1097/): Windows Graphics Component Information Disclosure Vulnerability (medium 6.5)
- [CVE-2020-10969](https://insights.sbomify.com/CVE-2020-10969/): jackson-databind mishandles the interaction between serialization gadgets and typing (high 8.8)
- [CVE-2020-10968](https://insights.sbomify.com/CVE-2020-10968/): jackson-databind mishandles the interaction between serialization gadgets and typing (high 8.8)
- [CVE-2020-10967](https://insights.sbomify.com/CVE-2020-10967/): Denial of service in dovecot:dovecot (medium 5.3)
- [CVE-2020-10966](https://insights.sbomify.com/CVE-2020-10966/): Other in hestiacp:control panel (medium 6.5)
- [CVE-2020-10965](https://insights.sbomify.com/CVE-2020-10965/): Auth bypass in teradici:pcoip management console (high 8.1)
- [CVE-2020-10964](https://insights.sbomify.com/CVE-2020-10964/): File upload in s9y:serendipity (critical 9.8)
- [CVE-2020-10963](https://insights.sbomify.com/CVE-2020-10963/): FrozenNode Laravel-Administrator unrestricted file upload (high 7.2)
- [CVE-2020-10962](https://insights.sbomify.com/CVE-2020-10962/): Privilege escalation in psappdeploytoolkit:powershell app deployment toolkit (high 7.8)
- [CVE-2020-10960](https://insights.sbomify.com/CVE-2020-10960/): MediaWiki makeCollapsible allows applying event handler to any CSS selector (medium 5.3)
- [CVE-2020-1096](https://insights.sbomify.com/CVE-2020-1096/): Microsoft Edge PDF Remote Code Execution Vulnerability (medium 4.2)
- [CVE-2020-10959](https://insights.sbomify.com/CVE-2020-10959/): MediaWiki Open Redirect vulnerability (medium 6.1)
- [CVE-2020-10958](https://insights.sbomify.com/CVE-2020-10958/): Use after free in dovecot:dovecot (medium 5.3)
- [CVE-2020-10957](https://insights.sbomify.com/CVE-2020-10957/): Null dereference in dovecot:dovecot (high 7.5)
- [CVE-2020-10956](https://insights.sbomify.com/CVE-2020-10956/): Server-side request forgery in gitlab:gitlab (critical 9.8)
- [CVE-2020-10955](https://insights.sbomify.com/CVE-2020-10955/): Missing authorization in debian:debian linux (medium 6.5)
- [CVE-2020-10954](https://insights.sbomify.com/CVE-2020-10954/): Denial of service in gitlab:gitlab (high 7.5)
- [CVE-2020-10953](https://insights.sbomify.com/CVE-2020-10953/): Path traversal in gitlab:gitlab (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/194/