# Vulnerabilities published in 2020


- [CVE-2020-10181](https://insights.sbomify.com/CVE-2020-10181/): Sumavision EMR Cross-Site Request Forgery (CSRF) (critical 9.8, exploited in the wild)
- [CVE-2020-10180](https://insights.sbomify.com/CVE-2020-10180/): Security feature bypass in eset:cyber security (critical 9.8)
- [CVE-2020-1018](https://insights.sbomify.com/CVE-2020-1018/): Information disclosure in Dynamics 365 Business Central 2019 Spring Update (high 7.5)
- [CVE-2020-10177](https://insights.sbomify.com/CVE-2020-10177/): Out-of-bounds reads in Pillow (medium 5.5)
- [CVE-2020-10176](https://insights.sbomify.com/CVE-2020-10176/): Code injection in assaabloy:yale wipc-301w firmware (critical 9.8)
- [CVE-2020-10174](https://insights.sbomify.com/CVE-2020-10174/): Race condition in canonical:ubuntu linux (high 7.0)
- [CVE-2020-10173](https://insights.sbomify.com/CVE-2020-10173/): Command injection in comtrend:vr-3033 firmware (high 8.8)
- [CVE-2020-1017](https://insights.sbomify.com/CVE-2020-1017/): Privilege escalation in Windows (high 7.8)
- [CVE-2020-1016](https://insights.sbomify.com/CVE-2020-1016/): Information disclosure in Windows (medium 5.5)
- [CVE-2020-1015](https://insights.sbomify.com/CVE-2020-1015/): Privilege escalation in Windows (high 7.8)
- [CVE-2020-10148](https://insights.sbomify.com/CVE-2020-10148/): SolarWinds Orion Authentication Bypass (critical 9.8, exploited in the wild)
- [CVE-2020-10146](https://insights.sbomify.com/CVE-2020-10146/): Microsoft Teams displayName stored cross-site scripting vulnerability (medium 5.7)
- [CVE-2020-10145](https://insights.sbomify.com/CVE-2020-10145/): Misconfiguration in ColdFusion (high 7.8)
- [CVE-2020-10143](https://insights.sbomify.com/CVE-2020-10143/): Privilege escalation in Reflect (high 7.8)
- [CVE-2020-10140](https://insights.sbomify.com/CVE-2020-10140/): Privilege escalation in True Image (high 7.8)
- [CVE-2020-1014](https://insights.sbomify.com/CVE-2020-1014/): Privilege escalation in Windows (high 7.8)
- [CVE-2020-10139](https://insights.sbomify.com/CVE-2020-10139/): Privilege escalation in True Image 2021 (high 7.8)
- [CVE-2020-10138](https://insights.sbomify.com/CVE-2020-10138/): Privilege escalation in Cyber Backup (high 7.8)
- [CVE-2020-10137](https://insights.sbomify.com/CVE-2020-10137/): Security feature bypass in UZB-7 (medium 6.5)
- [CVE-2020-10136](https://insights.sbomify.com/CVE-2020-10136/): IP-in-IP protocol allows a remote, unauthenticated attacker to route arbitrary network traffic (medium 5.3)
- [CVE-2020-10135](https://insights.sbomify.com/CVE-2020-10135/): Bluetooth devices supporting BR/EDR v5.2 and earlier are vulnerable to impersonation attacks (medium 5.4)
- [CVE-2020-10134](https://insights.sbomify.com/CVE-2020-10134/): Bluetooth devices supporting LE and specific BR/EDR implementations are vulnerable to method confusion attacks (medium 6.3)
- [CVE-2020-10132](https://insights.sbomify.com/CVE-2020-10132/): CVE-2020-10132 (medium 6.1)
- [CVE-2020-10131](https://insights.sbomify.com/CVE-2020-10131/): CVE-2020-10131 (critical 9.8)
- [CVE-2020-10130](https://insights.sbomify.com/CVE-2020-10130/): CVE-2020-10130 (high 8.8)
- [CVE-2020-1013](https://insights.sbomify.com/CVE-2020-1013/): Group Policy Elevation of Privilege Vulnerability (high 7.5)
- [CVE-2020-10129](https://insights.sbomify.com/CVE-2020-10129/): CVE-2020-10129 (high 8.8)
- [CVE-2020-10128](https://insights.sbomify.com/CVE-2020-10128/): SearchBlox product before V-9.2.1 is vulnerable to Stored-Cross Site Scripting (medium 5.4)
- [CVE-2020-10126](https://insights.sbomify.com/CVE-2020-10126/): Security feature bypass in SelfServ ATM (high 7.6)
- [CVE-2020-10125](https://insights.sbomify.com/CVE-2020-10125/): Weak cryptography in SelfServ ATM (high 7.6)
- [CVE-2020-10124](https://insights.sbomify.com/CVE-2020-10124/): Weak cryptography in SelfServ ATM (high 7.1)
- [CVE-2020-10123](https://insights.sbomify.com/CVE-2020-10123/): Auth bypass in SelfServ ATM (medium 5.3)
- [CVE-2020-10122](https://insights.sbomify.com/CVE-2020-10122/): Missing authorization in cpanel:cpanel (medium 6.5)
- [CVE-2020-10121](https://insights.sbomify.com/CVE-2020-10121/): Code injection in cpanel:cpanel (critical 9.8)
- [CVE-2020-10120](https://insights.sbomify.com/CVE-2020-10120/): Command injection in cpanel:cpanel (high 7.2)
- [CVE-2020-1012](https://insights.sbomify.com/CVE-2020-1012/): WinINet API Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2020-10119](https://insights.sbomify.com/CVE-2020-10119/): Command injection in cpanel:cpanel (critical 9.8)
- [CVE-2020-10118](https://insights.sbomify.com/CVE-2020-10118/): Missing authorization in cpanel:cpanel (critical 9.1)
- [CVE-2020-10117](https://insights.sbomify.com/CVE-2020-10117/): Security feature bypass in cpanel:cpanel (critical 9.1)
- [CVE-2020-10116](https://insights.sbomify.com/CVE-2020-10116/): Missing authorization in cpanel:cpanel (medium 5.3)
- [CVE-2020-10115](https://insights.sbomify.com/CVE-2020-10115/): Code injection in cpanel:cpanel (high 7.2)
- [CVE-2020-10114](https://insights.sbomify.com/CVE-2020-10114/): Cross-site scripting in cpanel:cpanel (medium 6.1)
- [CVE-2020-10113](https://insights.sbomify.com/CVE-2020-10113/): Cross-site scripting in cpanel:cpanel (medium 6.1)
- [CVE-2020-10112](https://insights.sbomify.com/CVE-2020-10112/): Other in citrix:gateway firmware (medium 5.4)
- [CVE-2020-10111](https://insights.sbomify.com/CVE-2020-10111/): Other in citrix:gateway firmware (high 7.5)
- [CVE-2020-10110](https://insights.sbomify.com/CVE-2020-10110/): Information disclosure in citrix:gateway firmware (medium 5.3)
- [CVE-2020-1011](https://insights.sbomify.com/CVE-2020-1011/): Privilege escalation in Windows (high 7.8)
- [CVE-2020-10109](https://insights.sbomify.com/CVE-2020-10109/): HTTP Request Smuggling in Twisted (critical 9.8)
- [CVE-2020-10108](https://insights.sbomify.com/CVE-2020-10108/): Improper Input Validation in Twisted (critical 9.8)
- [CVE-2020-10107](https://insights.sbomify.com/CVE-2020-10107/): Cross-site scripting in phpgurukul:daily expense tracker system (medium 5.4)
- [CVE-2020-10106](https://insights.sbomify.com/CVE-2020-10106/): SQL injection in phpgurukul:daily expense tracker system (critical 9.8)
- [CVE-2020-10105](https://insights.sbomify.com/CVE-2020-10105/): Information disclosure in zammad:zammad (medium 5.3)
- [CVE-2020-10104](https://insights.sbomify.com/CVE-2020-10104/): Information disclosure in zammad:zammad (medium 4.3)
- [CVE-2020-10103](https://insights.sbomify.com/CVE-2020-10103/): Cross-site scripting in zammad:zammad (medium 5.4)
- [CVE-2020-10102](https://insights.sbomify.com/CVE-2020-10102/): Information disclosure in zammad:zammad (medium 5.3)
- [CVE-2020-10101](https://insights.sbomify.com/CVE-2020-10101/): Denial of service in zammad:zammad (high 7.5)
- [CVE-2020-10100](https://insights.sbomify.com/CVE-2020-10100/): Missing authorization in zammad:zammad (medium 6.5)
- [CVE-2020-1010](https://insights.sbomify.com/CVE-2020-1010/): Microsoft Windows Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2020-10099](https://insights.sbomify.com/CVE-2020-10099/): Cross-site scripting in zammad:zammad (medium 5.4)
- [CVE-2020-10098](https://insights.sbomify.com/CVE-2020-10098/): Cross-site scripting in zammad:zammad (medium 5.4)
- [CVE-2020-10097](https://insights.sbomify.com/CVE-2020-10097/): Information disclosure in zammad:zammad (medium 5.3)
- [CVE-2020-10096](https://insights.sbomify.com/CVE-2020-10096/): Information disclosure in zammad:zammad (high 7.5)
- [CVE-2020-10095](https://insights.sbomify.com/CVE-2020-10095/): Various Lexmark devices have CSRF that allows an attacker to modify the configuration of the device. (high 8.1)
- [CVE-2020-10094](https://insights.sbomify.com/CVE-2020-10094/): Cross-site scripting in lexmark:6500e firmware (medium 5.4)
- [CVE-2020-10093](https://insights.sbomify.com/CVE-2020-10093/): Cross-site scripting in lexmark:6500e firmware (medium 5.4)
- [CVE-2020-10092](https://insights.sbomify.com/CVE-2020-10092/): Cross-site scripting in gitlab:gitlab (medium 6.1)
- [CVE-2020-10091](https://insights.sbomify.com/CVE-2020-10091/): Cross-site scripting in gitlab:gitlab (medium 6.1)
- [CVE-2020-10090](https://insights.sbomify.com/CVE-2020-10090/): Information disclosure in gitlab:gitlab (medium 5.3)
- [CVE-2020-1009](https://insights.sbomify.com/CVE-2020-1009/): Privilege escalation in Windows (high 7.8)
- [CVE-2020-10089](https://insights.sbomify.com/CVE-2020-10089/): Denial of service in gitlab:gitlab (high 7.5)
- [CVE-2020-10088](https://insights.sbomify.com/CVE-2020-10088/): Privilege escalation in gitlab:gitlab (high 8.1)
- [CVE-2020-10087](https://insights.sbomify.com/CVE-2020-10087/): Information disclosure in gitlab:gitlab (high 7.5)
- [CVE-2020-10086](https://insights.sbomify.com/CVE-2020-10086/): Path traversal in gitlab:gitlab (medium 5.3)
- [CVE-2020-10085](https://insights.sbomify.com/CVE-2020-10085/): Information disclosure in gitlab:gitlab (medium 5.3)
- [CVE-2020-10084](https://insights.sbomify.com/CVE-2020-10084/): Information disclosure in gitlab:gitlab (medium 5.3)
- [CVE-2020-10083](https://insights.sbomify.com/CVE-2020-10083/): Missing authorization in gitlab:gitlab (critical 9.1)
- [CVE-2020-10082](https://insights.sbomify.com/CVE-2020-10082/): Denial of service in gitlab:gitlab (medium 5.3)
- [CVE-2020-10081](https://insights.sbomify.com/CVE-2020-10081/): Missing authorization in gitlab:gitlab (medium 6.5)
- [CVE-2020-10080](https://insights.sbomify.com/CVE-2020-10080/): Missing authorization in gitlab:gitlab (medium 5.3)
- [CVE-2020-1008](https://insights.sbomify.com/CVE-2020-1008/): Memory corruption in Windows (high 7.8)
- [CVE-2020-10079](https://insights.sbomify.com/CVE-2020-10079/): Auth bypass in gitlab:gitlab (medium 5.3)
- [CVE-2020-10078](https://insights.sbomify.com/CVE-2020-10078/): Cross-site scripting in gitlab:gitlab (medium 6.1)
- [CVE-2020-10077](https://insights.sbomify.com/CVE-2020-10077/): Server-side request forgery in gitlab:gitlab (critical 9.8)
- [CVE-2020-10076](https://insights.sbomify.com/CVE-2020-10076/): Cross-site scripting in gitlab:gitlab (medium 6.1)
- [CVE-2020-10075](https://insights.sbomify.com/CVE-2020-10075/): Cross-site scripting in gitlab:gitlab (medium 6.1)
- [CVE-2020-10074](https://insights.sbomify.com/CVE-2020-10074/): Auth bypass in gitlab:gitlab (critical 9.8)
- [CVE-2020-10073](https://insights.sbomify.com/CVE-2020-10073/): Denial of service in gitlab:gitlab (high 7.5)
- [CVE-2020-10072](https://insights.sbomify.com/CVE-2020-10072/): Improper Handling of Insufficient Permissions or Privileges in zephyr (medium 5.9)
- [CVE-2020-10071](https://insights.sbomify.com/CVE-2020-10071/): Insufficient publish message length validation in MQTT (critical 9.0)
- [CVE-2020-10070](https://insights.sbomify.com/CVE-2020-10070/): MQTT buffer overflow on receive buffer (critical 9.0)
- [CVE-2020-1007](https://insights.sbomify.com/CVE-2020-1007/): Information disclosure in Windows (medium 5.5)
- [CVE-2020-10069](https://insights.sbomify.com/CVE-2020-10069/): Zephyr Bluetooth unchecked packet data results in denial of service (medium 4.3)
- [CVE-2020-10068](https://insights.sbomify.com/CVE-2020-10068/): Zephyr Bluetooth DLE duplicate requests vulnerability (medium 5.1)
- [CVE-2020-10067](https://insights.sbomify.com/CVE-2020-10067/): Integer Overflow In is_in_region Allows User Thread To Access Kernel Memory (high 7.5)
- [CVE-2020-10066](https://insights.sbomify.com/CVE-2020-10066/): Incorrect Error Handling in Bluetooth HCI core (low 2.5)
- [CVE-2020-10065](https://insights.sbomify.com/CVE-2020-10065/): Missing Size Checks in Bluetooth HCI over SPI (low 3.8)
- [CVE-2020-10064](https://insights.sbomify.com/CVE-2020-10064/): Improper Input Frame Validation in ieee802154 Processing (high 8.3)
- [CVE-2020-10063](https://insights.sbomify.com/CVE-2020-10063/): Remote Denial of Service in CoAP Option Parsing Due To Integer Overflow (medium 6.8)
- [CVE-2020-10062](https://insights.sbomify.com/CVE-2020-10062/): Packet length decoding error in MQTT (critical 9.0)
- [CVE-2020-10061](https://insights.sbomify.com/CVE-2020-10061/): Error handling invalid packet sequence (high 8.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/202/