# Vulnerabilities published in 2020


- [CVE-2020-8592](https://insights.sbomify.com/CVE-2020-8592/): SQL injection in n/a (critical 9.8)
- [CVE-2020-8591](https://insights.sbomify.com/CVE-2020-8591/): Auth bypass in n/a (critical 9.8)
- [CVE-2020-8590](https://insights.sbomify.com/CVE-2020-8590/): Information disclosure in Clustered Data ONTAP (low 3.3)
- [CVE-2020-8589](https://insights.sbomify.com/CVE-2020-8589/): Information disclosure in Clustered Data ONTAP (low 3.5)
- [CVE-2020-8588](https://insights.sbomify.com/CVE-2020-8588/): Information disclosure in Clustered Data ONTAP (low 3.5)
- [CVE-2020-8587](https://insights.sbomify.com/CVE-2020-8587/): Information disclosure in OnCommand System Manager 9.x (medium 5.5)
- [CVE-2020-8585](https://insights.sbomify.com/CVE-2020-8585/): Information disclosure in OnCommand Unified Manager for 7-Mode (core package) (medium 5.5)
- [CVE-2020-8584](https://insights.sbomify.com/CVE-2020-8584/): Code injection in Element OS (critical 9.8)
- [CVE-2020-8583](https://insights.sbomify.com/CVE-2020-8583/): Information disclosure in NetApp SolidFire & HCI Storage Node (Element Software) ) (high 7.5)
- [CVE-2020-8582](https://insights.sbomify.com/CVE-2020-8582/): Information disclosure in NetApp SolidFire & HCI Storage Node (Element Software) (medium 6.5)
- [CVE-2020-8581](https://insights.sbomify.com/CVE-2020-8581/): Missing authorization in Clustered Data ONTAP (medium 6.5)
- [CVE-2020-8580](https://insights.sbomify.com/CVE-2020-8580/): Denial of service in E-Series SANtricity OS Controller Software (high 7.5)
- [CVE-2020-8579](https://insights.sbomify.com/CVE-2020-8579/): Denial of service in clustered Data ONTAP (high 7.5)
- [CVE-2020-8578](https://insights.sbomify.com/CVE-2020-8578/): Information disclosure in Clustered Data ONTAP (low 3.3)
- [CVE-2020-8577](https://insights.sbomify.com/CVE-2020-8577/): Information disclosure in E-Series SANtricity OS Controller Software (medium 5.9)
- [CVE-2020-8576](https://insights.sbomify.com/CVE-2020-8576/): Information disclosure in Clustered Data ONTAP (medium 5.4)
- [CVE-2020-8575](https://insights.sbomify.com/CVE-2020-8575/): Denial of service in Active IQ Unified Manager for VMware vSphere and Windows 7.3 and above (medium 4.4)
- [CVE-2020-8574](https://insights.sbomify.com/CVE-2020-8574/): Code injection in Active IQ Unified Manager for Linux 7.3 and above (high 7.8)
- [CVE-2020-8573](https://insights.sbomify.com/CVE-2020-8573/): Hardcoded credentials in NetApp HCI Baseboard Management Controller (BMC) HCI H610C, NetApp HCI Baseboard Management Controller (BMC) HCI H615C, NetApp HCI Baseboard Management Controller (BMC) HCI H610S (medium 6.5)
- [CVE-2020-8572](https://insights.sbomify.com/CVE-2020-8572/): Information disclosure in Sensitive Information Disclosure Vulnerability in Element OS and Element HealthTools (high 7.5)
- [CVE-2020-8571](https://insights.sbomify.com/CVE-2020-8571/): Denial of service in StorageGRID (formerly StorageGRID Webscale) (high 7.5)
- [CVE-2020-8570](https://insights.sbomify.com/CVE-2020-8570/): Kubernetes Java client libraries unvalidated path traversal in Copy implementation (critical 9.1)
- [CVE-2020-8569](https://insights.sbomify.com/CVE-2020-8569/): Kubernetes CSI snapshot-controller DoS (medium 4.3)
- [CVE-2020-8568](https://insights.sbomify.com/CVE-2020-8568/): Kubernetes Secrets Store CSI Driver sync/rotate directory traversal (medium 5.8)
- [CVE-2020-8567](https://insights.sbomify.com/CVE-2020-8567/): Kubernetes Secrets Store CSI Driver plugin directory traversals (medium 4.9)
- [CVE-2020-8566](https://insights.sbomify.com/CVE-2020-8566/): Ceph RBD adminSecrets exposed in logs when loglevel >= 4 (medium 4.7)
- [CVE-2020-8565](https://insights.sbomify.com/CVE-2020-8565/): Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel >= 9 (medium 4.7)
- [CVE-2020-8564](https://insights.sbomify.com/CVE-2020-8564/): Docker config secrets leaked when file is malformed and loglevel >= 4 (medium 4.7)
- [CVE-2020-8563](https://insights.sbomify.com/CVE-2020-8563/): Secret leaks in logs for vSphere Provider kube-controller-manager (medium 4.7)
- [CVE-2020-8562](https://insights.sbomify.com/CVE-2020-8562/): Bypass of Kubernetes API Server proxy TOCTOU (low 2.2)
- [CVE-2020-8561](https://insights.sbomify.com/CVE-2020-8561/): Webhook redirect in kube-apiserver (medium 4.1)
- [CVE-2020-8559](https://insights.sbomify.com/CVE-2020-8559/): Privilege escalation from compromised node to cluster (medium 6.4)
- [CVE-2020-8558](https://insights.sbomify.com/CVE-2020-8558/): Kubernetes node setting allows for neighboring hosts to bypass localhost boundary (medium 5.4)
- [CVE-2020-8557](https://insights.sbomify.com/CVE-2020-8557/): Kubernetes node disk Denial of Service by writing to container /etc/hosts (medium 5.5)
- [CVE-2020-8555](https://insights.sbomify.com/CVE-2020-8555/): Kubernetes kube-controller-manager SSRF (medium 6.3)
- [CVE-2020-8554](https://insights.sbomify.com/CVE-2020-8554/): Kubernetes man in the middle using LoadBalancer or ExternalIPs (medium 6.3)
- [CVE-2020-8553](https://insights.sbomify.com/CVE-2020-8553/): Kubernetes ingress-nginx Compromise of auth via subset/superset namespace names (medium 5.9)
- [CVE-2020-8552](https://insights.sbomify.com/CVE-2020-8552/): Kubernetes API server denial of service (medium 5.3)
- [CVE-2020-8551](https://insights.sbomify.com/CVE-2020-8551/): Kubernetes kubelet denial of service (medium 4.3)
- [CVE-2020-8549](https://insights.sbomify.com/CVE-2020-8549/): Cross-site scripting in n/a (medium 6.1)
- [CVE-2020-8548](https://insights.sbomify.com/CVE-2020-8548/): Cross-site scripting in n/a (medium 6.1)
- [CVE-2020-8547](https://insights.sbomify.com/CVE-2020-8547/): Auth bypass in n/a (critical 9.8)
- [CVE-2020-8545](https://insights.sbomify.com/CVE-2020-8545/): Path traversal in n/a (high 7.5)
- [CVE-2020-8544](https://insights.sbomify.com/CVE-2020-8544/): OX App Suite through 7.10.3 allows SSRF. (medium 6.5)
- [CVE-2020-8543](https://insights.sbomify.com/CVE-2020-8543/): Other in n/a (high 7.5)
- [CVE-2020-8542](https://insights.sbomify.com/CVE-2020-8542/): OX App Suite through 7.10.3 allows XSS. (medium 5.4)
- [CVE-2020-8541](https://insights.sbomify.com/CVE-2020-8541/): XML external entity in n/a (medium 6.5)
- [CVE-2020-8540](https://insights.sbomify.com/CVE-2020-8540/): XML external entity in n/a (critical 9.8)
- [CVE-2020-8539](https://insights.sbomify.com/CVE-2020-8539/): Command injection in n/a (high 7.8)
- [CVE-2020-8521](https://insights.sbomify.com/CVE-2020-8521/): SQL injection in phpzag live add edit delete data tables records with ajax php mysql (critical 9.8)
- [CVE-2020-8520](https://insights.sbomify.com/CVE-2020-8520/): SQL injection in phpzag live add edit delete data tables records with ajax php mysql (critical 9.8)
- [CVE-2020-8519](https://insights.sbomify.com/CVE-2020-8519/): SQL injection in phpzag live add edit delete data tables records with ajax php mysql (critical 9.8)
- [CVE-2020-8518](https://insights.sbomify.com/CVE-2020-8518/): Code injection in n/a (critical 9.8)
- [CVE-2020-8517](https://insights.sbomify.com/CVE-2020-8517/): Memory corruption in n/a (high 7.5)
- [CVE-2020-8516](https://insights.sbomify.com/CVE-2020-8516/): Information disclosure in n/a (medium 5.3)
- [CVE-2020-8515](https://insights.sbomify.com/CVE-2020-8515/): Multiple DrayTek Vigor Routers Web Management Page (critical 9.8, exploited in the wild)
- [CVE-2020-8514](https://insights.sbomify.com/CVE-2020-8514/): Cross-site scripting in n/a (medium 6.1)
- [CVE-2020-8512](https://insights.sbomify.com/CVE-2020-8512/): Cross-site scripting in n/a (medium 6.1)
- [CVE-2020-8511](https://insights.sbomify.com/CVE-2020-8511/): File upload in n/a (high 7.2)
- [CVE-2020-8510](https://insights.sbomify.com/CVE-2020-8510/): Auth bypass in n/a (critical 9.8)
- [CVE-2020-8509](https://insights.sbomify.com/CVE-2020-8509/): Missing authorization in n/a (high 7.5)
- [CVE-2020-8508](https://insights.sbomify.com/CVE-2020-8508/): Privilege escalation in n/a (critical 9.8)
- [CVE-2020-8507](https://insights.sbomify.com/CVE-2020-8507/): Information disclosure in n/a (high 7.5)
- [CVE-2020-8506](https://insights.sbomify.com/CVE-2020-8506/): Information disclosure in n/a (medium 5.3)
- [CVE-2020-8505](https://insights.sbomify.com/CVE-2020-8505/): Cross-site request forgery in n/a (medium 6.5)
- [CVE-2020-8504](https://insights.sbomify.com/CVE-2020-8504/): Cross-site request forgery in n/a (medium 6.5)
- [CVE-2020-8503](https://insights.sbomify.com/CVE-2020-8503/): Missing authorization in n/a (medium 6.5)
- [CVE-2020-8500](https://insights.sbomify.com/CVE-2020-8500/): File upload in n/a (high 7.2)
- [CVE-2020-8498](https://insights.sbomify.com/CVE-2020-8498/): Cross-site scripting in n/a (medium 5.4)
- [CVE-2020-8497](https://insights.sbomify.com/CVE-2020-8497/): Missing authorization in n/a (medium 5.3)
- [CVE-2020-8496](https://insights.sbomify.com/CVE-2020-8496/): Cross-site scripting in n/a (medium 6.9)
- [CVE-2020-8495](https://insights.sbomify.com/CVE-2020-8495/): Privilege escalation in n/a (high 7.5)
- [CVE-2020-8494](https://insights.sbomify.com/CVE-2020-8494/): Privilege escalation in n/a (high 7.5)
- [CVE-2020-8493](https://insights.sbomify.com/CVE-2020-8493/): Cross-site scripting in n/a (medium 6.9)
- [CVE-2020-8492](https://insights.sbomify.com/CVE-2020-8492/): Denial of service in n/a (medium 6.5)
- [CVE-2020-8489](https://insights.sbomify.com/CVE-2020-8489/): ABB System 800xA Inter process communication vulnerability - 800xA Information Management (high 7.8)
- [CVE-2020-8488](https://insights.sbomify.com/CVE-2020-8488/): ABB System 800xA Inter process communication vulnerability - 800xA Batch Management (high 7.8)
- [CVE-2020-8487](https://insights.sbomify.com/CVE-2020-8487/): ABB System 800xA Inter process communication vulnerability - System 800xA Base (medium 6.6)
- [CVE-2020-8486](https://insights.sbomify.com/CVE-2020-8486/): ABB System 800xA Inter process communication vulnerability - 800xA RNRP (medium 6.6)
- [CVE-2020-8485](https://insights.sbomify.com/CVE-2020-8485/): ABB System 800xA Inter process communication vulnerability - 800xA for Mod 300 (high 7.8)
- [CVE-2020-8484](https://insights.sbomify.com/CVE-2020-8484/): ABB System 800xA Inter process communication vulnerability - 800xA for DCI (high 7.8)
- [CVE-2020-8482](https://insights.sbomify.com/CVE-2020-8482/): ABB Device Library Wizard Information Disclosure Vulnerability (high 7.8)
- [CVE-2020-8481](https://insights.sbomify.com/CVE-2020-8481/): ABB Central Licensing System - Information disclosure (critical 9.8)
- [CVE-2020-8479](https://insights.sbomify.com/CVE-2020-8479/): ABB Central Licensing System - XML External Entity Injection (critical 9.4)
- [CVE-2020-8478](https://insights.sbomify.com/CVE-2020-8478/): ABB System 800xA Inter process communication vulnerability (medium 5.3)
- [CVE-2020-8477](https://insights.sbomify.com/CVE-2020-8477/): ABB System 800xA Information Manager Remote Code Execution (high 8.8)
- [CVE-2020-8476](https://insights.sbomify.com/CVE-2020-8476/): ABB Central Licensing System - Elevation of Privilege Vulnerability (medium 5.3)
- [CVE-2020-8475](https://insights.sbomify.com/CVE-2020-8475/): ABB Central Licensing System - Denial of Service Vulnerability (medium 5.3)
- [CVE-2020-8474](https://insights.sbomify.com/CVE-2020-8474/): ABB System 800xA Weak Registry Permissions (high 7.8)
- [CVE-2020-8473](https://insights.sbomify.com/CVE-2020-8473/): ABB System 800xA Weak File Permissions - ABB System 800xA Base (high 7.3)
- [CVE-2020-8472](https://insights.sbomify.com/CVE-2020-8472/): ABB System 800xA Weak File Permissions - different products (medium 5.5)
- [CVE-2020-8471](https://insights.sbomify.com/CVE-2020-8471/): ABB Central Licensing System - Weak File Permissions (high 7.8)
- [CVE-2020-8470](https://insights.sbomify.com/CVE-2020-8470/): Path traversal in Trend Micro OfficeScan, Trend Micro Apex One, Trend Micro Worry-Free Business Security (WFBS) (high 7.5)
- [CVE-2020-8469](https://insights.sbomify.com/CVE-2020-8469/): Privilege escalation in Trend Micro Password Manager for Windows (high 7.8)
- [CVE-2020-8468](https://insights.sbomify.com/CVE-2020-8468/): Trend Micro Multiple Products Content Validation Escape (high 8.8, exploited in the wild)
- [CVE-2020-8467](https://insights.sbomify.com/CVE-2020-8467/): Trend Micro Apex One and OfficeScan Remote Code Execution (high 8.8, exploited in the wild)
- [CVE-2020-8466](https://insights.sbomify.com/CVE-2020-8466/): Command injection in Trend Micro InterScan Web Security Virtual Appliance (critical 9.8)
- [CVE-2020-8465](https://insights.sbomify.com/CVE-2020-8465/): Auth bypass in Trend Micro InterScan Web Security Virtual Appliance (critical 9.8)
- [CVE-2020-8464](https://insights.sbomify.com/CVE-2020-8464/): Server-side request forgery in Trend Micro InterScan Web Security Virtual Appliance (high 7.5)
- [CVE-2020-8463](https://insights.sbomify.com/CVE-2020-8463/): Auth bypass in Trend Micro InterScan Web Security Virtual Appliance (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/31/