# Vulnerabilities published in 2020


- [CVE-2020-10288](https://insights.sbomify.com/CVE-2020-10288/): RVD#3327: No authentication required for accesing ABB IRC5 FTP server (critical 9.8)
- [CVE-2020-10287](https://insights.sbomify.com/CVE-2020-10287/): RVD#3326: Hardcoded default credentials on IRC 5 OPC Server (critical 9.1)
- [CVE-2020-10286](https://insights.sbomify.com/CVE-2020-10286/): Privilege escalation in xArm 5 Lite, xArm 6 and xArm 7 (critical 9.4)
- [CVE-2020-10285](https://insights.sbomify.com/CVE-2020-10285/): RVD#3322: Weak authentication implementation make the system vulnerable to a brute-force attack over adjacent networks (critical 9.4)
- [CVE-2020-10284](https://insights.sbomify.com/CVE-2020-10284/): RVD#3321: No Authentication required to exert manual control of the robot (critical 9.1)
- [CVE-2020-10283](https://insights.sbomify.com/CVE-2020-10283/): RVD#3317: MAVLink version handshaking allows for an attacker to bypass authentication (high 8.1)
- [CVE-2020-10282](https://insights.sbomify.com/CVE-2020-10282/): RVD#3316: No authentication in MAVLink protocol (critical 9.8)
- [CVE-2020-10281](https://insights.sbomify.com/CVE-2020-10281/): RVD#3315: Cleartext transmission of sensitive information in MAVLink protocol version 1.0 and 2.0 (high 7.5)
- [CVE-2020-10280](https://insights.sbomify.com/CVE-2020-10280/): RVD#2568: Apache server is vulnerable to a DoS (high 8.2)
- [CVE-2020-1028](https://insights.sbomify.com/CVE-2020-1028/): Media Foundation Memory Corruption Vulnerability (high 7.8)
- [CVE-2020-10279](https://insights.sbomify.com/CVE-2020-10279/): RVD#2569: Insecure operating system defaults in MiR robots (critical 10.0)
- [CVE-2020-10278](https://insights.sbomify.com/CVE-2020-10278/): RVD#2561: Unprotected BIOS allows user to boot from live OS image. (medium 6.1)
- [CVE-2020-10277](https://insights.sbomify.com/CVE-2020-10277/): RVD#2562: Booting from a live image leads to exfiltration of sensible information and privilege escalation (medium 6.4)
- [CVE-2020-10276](https://insights.sbomify.com/CVE-2020-10276/): RVD#2558: Default credentials on SICK PLC allows disabling safety features (critical 9.8)
- [CVE-2020-10275](https://insights.sbomify.com/CVE-2020-10275/): RVD#2565: Weak token generation for the REST API. (critical 9.8)
- [CVE-2020-10274](https://insights.sbomify.com/CVE-2020-10274/): RVD#2556: MiR REST API allows for data exfiltration by unauthorized attackers (e.g. indoor maps) (high 7.1)
- [CVE-2020-10273](https://insights.sbomify.com/CVE-2020-10273/): RVD#2560: Unprotected intellectual property in Mobile Industrial Robots (MiR) controllers (high 7.5)
- [CVE-2020-10272](https://insights.sbomify.com/CVE-2020-10272/): RVD#2554: MiR ROS computational graph presents no authentication mechanisms (critical 10.0)
- [CVE-2020-10271](https://insights.sbomify.com/CVE-2020-10271/): Misconfiguration in MiR100 (critical 10.0)
- [CVE-2020-10270](https://insights.sbomify.com/CVE-2020-10270/): RVD#2557: Hardcoded Credentials on MiRX00 Control Dashboard (critical 9.8)
- [CVE-2020-1027](https://insights.sbomify.com/CVE-2020-1027/): Microsoft Windows Kernel Privilege Escalation (high 7.8, exploited in the wild)
- [CVE-2020-10269](https://insights.sbomify.com/CVE-2020-10269/): RVD#2566: Hardcoded Credentials on MiRX00 wireless Access Point (critical 9.8)
- [CVE-2020-10268](https://insights.sbomify.com/CVE-2020-10268/): RVD#2550: Terminate Critical Services in KUKA controller KR C4 (medium 6.1)
- [CVE-2020-10267](https://insights.sbomify.com/CVE-2020-10267/): RVD#1489: Unprotected intelectual property in Universal Robots controller CB 3.1 across firmware versions (high 7.5)
- [CVE-2020-10266](https://insights.sbomify.com/CVE-2020-10266/): RVD#1487: No integrity checks on UR+ platform artifacts when installed in the robot (high 8.8)
- [CVE-2020-10265](https://insights.sbomify.com/CVE-2020-10265/): RVD#1443: UR dashboard server enables unauthenticated remote control of core robot functions (critical 9.4)
- [CVE-2020-10264](https://insights.sbomify.com/CVE-2020-10264/): RTDE Interface allows unauthenticated reading of robot data and unauthenticated writing of registers and outputs (high 8.8)
- [CVE-2020-10263](https://insights.sbomify.com/CVE-2020-10263/): Auth bypass in mi:xiaomi xiaoai speaker pro lx06 firmware (medium 6.8)
- [CVE-2020-10262](https://insights.sbomify.com/CVE-2020-10262/): Auth bypass in mi:xiaomi xiaoai speaker pro lx06 firmware (medium 6.8)
- [CVE-2020-1026](https://insights.sbomify.com/CVE-2020-1026/): Incorrect Calculation in the MSR JavaScript Cryptography Library (critical 9.8)
- [CVE-2020-10257](https://insights.sbomify.com/CVE-2020-10257/): Missing authorization in themerex:addons (critical 9.8)
- [CVE-2020-10256](https://insights.sbomify.com/CVE-2020-10256/): Weak cryptography in 1password:command line interface (critical 9.8)
- [CVE-2020-10255](https://insights.sbomify.com/CVE-2020-10255/): Security feature bypass in micron:ddr4 sdram (critical 9.0)
- [CVE-2020-10254](https://insights.sbomify.com/CVE-2020-10254/): Auth bypass in owncloud:owncloud (medium 5.9)
- [CVE-2020-10252](https://insights.sbomify.com/CVE-2020-10252/): Server-side request forgery in owncloud:owncloud (high 8.3)
- [CVE-2020-10251](https://insights.sbomify.com/CVE-2020-10251/): Memory corruption in imagemagick:imagemagick (medium 5.5)
- [CVE-2020-10250](https://insights.sbomify.com/CVE-2020-10250/): Command injection in meinbwa:direx-pro firmware (critical 9.8)
- [CVE-2020-1025](https://insights.sbomify.com/CVE-2020-1025/): Microsoft Office Elevation of Privilege Vulnerability (critical 9.8)
- [CVE-2020-10249](https://insights.sbomify.com/CVE-2020-10249/): Information disclosure in meinbwa:direx-pro firmware (medium 5.3)
- [CVE-2020-10248](https://insights.sbomify.com/CVE-2020-10248/): Information disclosure in meinbwa:direx-pro firmware (high 7.5)
- [CVE-2020-10247](https://insights.sbomify.com/CVE-2020-10247/): Cross-site scripting in misp-project:misp (medium 6.1)
- [CVE-2020-10246](https://insights.sbomify.com/CVE-2020-10246/): Cross-site scripting in misp-project:misp (medium 6.1)
- [CVE-2020-10245](https://insights.sbomify.com/CVE-2020-10245/): Memory corruption in codesys:control for beaglebone (critical 9.8)
- [CVE-2020-10244](https://insights.sbomify.com/CVE-2020-10244/): Weak cryptography in jpaseto project:jpaseto (high 7.5)
- [CVE-2020-10243](https://insights.sbomify.com/CVE-2020-10243/): SQL injection in joomla:joomla\! (critical 9.8)
- [CVE-2020-10242](https://insights.sbomify.com/CVE-2020-10242/): Cross-site scripting in joomla:joomla\! (medium 6.1)
- [CVE-2020-10241](https://insights.sbomify.com/CVE-2020-10241/): Cross-site request forgery in joomla:joomla\! (high 8.8)
- [CVE-2020-10240](https://insights.sbomify.com/CVE-2020-10240/): Business logic in joomla:joomla\! (medium 5.3)
- [CVE-2020-1024](https://insights.sbomify.com/CVE-2020-1024/): Microsoft SharePoint Remote Code Execution Vulnerability (high 8.8)
- [CVE-2020-10239](https://insights.sbomify.com/CVE-2020-10239/): Missing authorization in joomla:joomla\! (high 8.8)
- [CVE-2020-10238](https://insights.sbomify.com/CVE-2020-10238/): Missing authorization in joomla:joomla\! (high 7.5)
- [CVE-2020-10237](https://insights.sbomify.com/CVE-2020-10237/): Froxlor Exposure of Sensitive Information to an Unauthorized Actor (medium 5.5)
- [CVE-2020-10236](https://insights.sbomify.com/CVE-2020-10236/): Froxlor Information Disclosure (medium 6.1)
- [CVE-2020-10235](https://insights.sbomify.com/CVE-2020-10235/): Froxlor arbitrary code execution via the database configuration options (high 8.8)
- [CVE-2020-10234](https://insights.sbomify.com/CVE-2020-10234/): Null dereference in iobit:advanced systemcare (medium 6.5)
- [CVE-2020-10233](https://insights.sbomify.com/CVE-2020-10233/): Memory corruption in sleuthkit:the sleuth kit (critical 9.1)
- [CVE-2020-10232](https://insights.sbomify.com/CVE-2020-10232/): Memory corruption in debian:debian linux (critical 9.8)
- [CVE-2020-10231](https://insights.sbomify.com/CVE-2020-10231/): Null dereference in tp-link:nc200 firmware (high 7.5)
- [CVE-2020-10230](https://insights.sbomify.com/CVE-2020-10230/): SQL injection in control-webpanel:webpanel (critical 9.8)
- [CVE-2020-1023](https://insights.sbomify.com/CVE-2020-1023/): Microsoft SharePoint Remote Code Execution Vulnerability (high 8.8)
- [CVE-2020-10229](https://insights.sbomify.com/CVE-2020-10229/): Cross-site request forgery in vtenext:vtenext (high 8.8)
- [CVE-2020-10228](https://insights.sbomify.com/CVE-2020-10228/): File upload in vtenext:vtenext (high 8.8)
- [CVE-2020-10227](https://insights.sbomify.com/CVE-2020-10227/): Cross-site scripting in vtenext:vtenext (medium 6.1)
- [CVE-2020-10225](https://insights.sbomify.com/CVE-2020-10225/): File upload in phpgurukul:job portal (critical 9.8)
- [CVE-2020-10224](https://insights.sbomify.com/CVE-2020-10224/): File upload in phpgurukul:online book store (critical 9.8)
- [CVE-2020-10223](https://insights.sbomify.com/CVE-2020-10223/): Memory corruption in gonitro:nitro pro (high 8.1)
- [CVE-2020-10222](https://insights.sbomify.com/CVE-2020-10222/): Memory corruption in gonitro:nitro pro (high 8.1)
- [CVE-2020-10221](https://insights.sbomify.com/CVE-2020-10221/): rConfig OS Command Injection (high 8.8, exploited in the wild)
- [CVE-2020-10220](https://insights.sbomify.com/CVE-2020-10220/): SQL injection in rconfig:rconfig (critical 9.8)
- [CVE-2020-1022](https://insights.sbomify.com/CVE-2020-1022/): Other in Dynamics 365 Business Central 2019 Release Wave 2 (On-Premise) (high 8.0)
- [CVE-2020-10218](https://insights.sbomify.com/CVE-2020-10218/): SQL injection in sapplica:sentrifugo (medium 6.5)
- [CVE-2020-10216](https://insights.sbomify.com/CVE-2020-10216/): Command injection in dlink:dir-825 firmware (high 8.8)
- [CVE-2020-10215](https://insights.sbomify.com/CVE-2020-10215/): Command injection in dlink:dir-825 firmware (high 8.8)
- [CVE-2020-10214](https://insights.sbomify.com/CVE-2020-10214/): Memory corruption in dlink:dir-825 firmware (high 8.8)
- [CVE-2020-10213](https://insights.sbomify.com/CVE-2020-10213/): Command injection in dlink:dir-825 firmware (high 8.8)
- [CVE-2020-10212](https://insights.sbomify.com/CVE-2020-10212/): Server-side request forgery in tecrail:responsive filemanager (critical 9.8)
- [CVE-2020-10211](https://insights.sbomify.com/CVE-2020-10211/): Code injection in mitel:mivoice connect (critical 9.8)
- [CVE-2020-10210](https://insights.sbomify.com/CVE-2020-10210/): Hardcoded credentials in amino:ak45x firmware (critical 9.8)
- [CVE-2020-1021](https://insights.sbomify.com/CVE-2020-1021/): Windows Error Reporting Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2020-10209](https://insights.sbomify.com/CVE-2020-10209/): Command injection in amino:ak45x firmware (high 8.1)
- [CVE-2020-10208](https://insights.sbomify.com/CVE-2020-10208/): Command injection in amino:ak45x firmware (critical 9.9)
- [CVE-2020-10207](https://insights.sbomify.com/CVE-2020-10207/): Hardcoded credentials in amino:ak45x firmware (critical 9.8)
- [CVE-2020-10206](https://insights.sbomify.com/CVE-2020-10206/): Hardcoded credentials in amino:ak45x firmware (medium 4.4)
- [CVE-2020-10204](https://insights.sbomify.com/CVE-2020-10204/): Remote Code Execution - JavaEL Injection (low privileged accounts) in Nexus Repository Manager (high 7.2)
- [CVE-2020-10203](https://insights.sbomify.com/CVE-2020-10203/): Persistent Cross-Site scripting in Nexus Repository Manager (medium 4.8)
- [CVE-2020-1020](https://insights.sbomify.com/CVE-2020-1020/): Microsoft Windows Adobe Font Manager Library Remote Code Execution (high 8.8, exploited in the wild)
- [CVE-2020-10199](https://insights.sbomify.com/CVE-2020-10199/): Sonatype Nexus Repository Remote Code Execution (high 8.8, exploited in the wild)
- [CVE-2020-10196](https://insights.sbomify.com/CVE-2020-10196/): Cross-site scripting in sygnoos:popup builder (medium 6.1)
- [CVE-2020-10195](https://insights.sbomify.com/CVE-2020-10195/): Missing authorization in sygnoos:popup builder (medium 6.3)
- [CVE-2020-10194](https://insights.sbomify.com/CVE-2020-10194/): Missing authorization in zimbra:zm-mailbox (medium 6.5)
- [CVE-2020-10193](https://insights.sbomify.com/CVE-2020-10193/): Security feature bypass in eset:cyber security (high 7.5)
- [CVE-2020-10192](https://insights.sbomify.com/CVE-2020-10192/): Cross-site scripting in munkireport project:munkireport (medium 6.1)
- [CVE-2020-10191](https://insights.sbomify.com/CVE-2020-10191/): Cross-site scripting in munkireport project:munkireport (medium 5.4)
- [CVE-2020-10190](https://insights.sbomify.com/CVE-2020-10190/): SQL injection in munkireport project:munkireport (high 8.8)
- [CVE-2020-1019](https://insights.sbomify.com/CVE-2020-1019/): Privilege escalation in Microsoft RMS Sharing for Mac (high 7.8)
- [CVE-2020-10189](https://insights.sbomify.com/CVE-2020-10189/): Zoho ManageEngine Desktop Central File Upload (critical 9.8, exploited in the wild)
- [CVE-2020-10188](https://insights.sbomify.com/CVE-2020-10188/): Memory corruption in arista:eos (critical 9.8)
- [CVE-2020-10187](https://insights.sbomify.com/CVE-2020-10187/): Exposure of Sensitive Information to an Unauthorized Actor in Doorkeeper (high 7.5)
- [CVE-2020-10185](https://insights.sbomify.com/CVE-2020-10185/): Auth bypass in yubico:yubikey one time password validation server (high 8.6)
- [CVE-2020-10184](https://insights.sbomify.com/CVE-2020-10184/): SQL injection in yubico:yubikey one time password validation server (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/201/