# Vulnerabilities published in 2020 - [CVE-2020-8272](https://insights.sbomify.com/CVE-2020-8272/): Auth bypass in Citrix SD-WAN Center (high 7.5) - [CVE-2020-8271](https://insights.sbomify.com/CVE-2020-8271/): Path traversal in Citrix SD-WAN Center (critical 9.8) - [CVE-2020-8270](https://insights.sbomify.com/CVE-2020-8270/): Command injection in Citrix Virtual Apps and Desktops (high 8.8) - [CVE-2020-8269](https://insights.sbomify.com/CVE-2020-8269/): Privilege escalation in Citrix Virtual Apps and Desktops (high 8.8) - [CVE-2020-8268](https://insights.sbomify.com/CVE-2020-8268/): Prototype pollution in json8-merge-patch (high 7.5) - [CVE-2020-8267](https://insights.sbomify.com/CVE-2020-8267/): Auth bypass in UniFi Protect (medium 5.3) - [CVE-2020-8265](https://insights.sbomify.com/CVE-2020-8265/): Use after free in Node (high 8.1) - [CVE-2020-8264](https://insights.sbomify.com/CVE-2020-8264/): Cross-site scripting in actionpack (medium 6.1) - [CVE-2020-8263](https://insights.sbomify.com/CVE-2020-8263/): Cross-site scripting in Pulse Connect Secure / Pulse Policy Secure (medium 5.4) - [CVE-2020-8262](https://insights.sbomify.com/CVE-2020-8262/): Cross-site scripting in Pulse Connect Secure / Pulse Policy Secure (medium 6.1) - [CVE-2020-8261](https://insights.sbomify.com/CVE-2020-8261/): Other in Pulse Connect Secure / Pulse Policy Secure (medium 4.3) - [CVE-2020-8260](https://insights.sbomify.com/CVE-2020-8260/): Ivanti Pulse Connect Secure Code Execution (high 7.2, exploited in the wild) - [CVE-2020-8259](https://insights.sbomify.com/CVE-2020-8259/): Weak cryptography in Nextcloud Server (high 8.1) - [CVE-2020-8258](https://insights.sbomify.com/CVE-2020-8258/): Privilege escalation in Citrix Gateway Plug-in for Windows (high 7.5) - [CVE-2020-8257](https://insights.sbomify.com/CVE-2020-8257/): Privilege escalation in Citrix Gateway Plug-in for Windows (critical 9.8) - [CVE-2020-8256](https://insights.sbomify.com/CVE-2020-8256/): XML external entity in Pulse Connect Secure (medium 4.9) - [CVE-2020-8255](https://insights.sbomify.com/CVE-2020-8255/): Path traversal in Pulse Connect Secure / Pulse Policy Secure (medium 4.9) - [CVE-2020-8254](https://insights.sbomify.com/CVE-2020-8254/): Path traversal in Pulse Secure Desktop Client (high 8.8) - [CVE-2020-8253](https://insights.sbomify.com/CVE-2020-8253/): Auth bypass in Citrix XenMobile Server (high 7.5) - [CVE-2020-8252](https://insights.sbomify.com/CVE-2020-8252/): Memory corruption in Node (high 7.8) - [CVE-2020-8251](https://insights.sbomify.com/CVE-2020-8251/): Denial of service in Node (high 7.5) - [CVE-2020-8250](https://insights.sbomify.com/CVE-2020-8250/): Privilege escalation in Pulse Secure Desktop Client (high 7.8) - [CVE-2020-8249](https://insights.sbomify.com/CVE-2020-8249/): Memory corruption in Pulse Secure Desktop Client (high 7.8) - [CVE-2020-8248](https://insights.sbomify.com/CVE-2020-8248/): Privilege escalation in Pulse Secure Desktop Client (high 7.8) - [CVE-2020-8247](https://insights.sbomify.com/CVE-2020-8247/): Privilege escalation in Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP (high 8.8) - [CVE-2020-8246](https://insights.sbomify.com/CVE-2020-8246/): Denial of service in Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP (high 7.5) - [CVE-2020-8245](https://insights.sbomify.com/CVE-2020-8245/): Cross-site scripting in Citrix ADC, Citrix Gateway (medium 6.1) - [CVE-2020-8244](https://insights.sbomify.com/CVE-2020-8244/): Remote Memory Exposure in bl (medium 6.5) - [CVE-2020-8243](https://insights.sbomify.com/CVE-2020-8243/): Ivanti Pulse Connect Secure Code Execution (high 7.2, exploited in the wild) - [CVE-2020-8242](https://insights.sbomify.com/CVE-2020-8242/): SQL injection in ExpressionEngine (high 7.2) - [CVE-2020-8241](https://insights.sbomify.com/CVE-2020-8241/): Other in Pulse Secure Dektop Client (high 7.5) - [CVE-2020-8240](https://insights.sbomify.com/CVE-2020-8240/): Privilege escalation in Pulse Secure Desktop Client (high 7.8) - [CVE-2020-8239](https://insights.sbomify.com/CVE-2020-8239/): Privilege escalation in Pulse Secure Desktop Cient (critical 9.8) - [CVE-2020-8238](https://insights.sbomify.com/CVE-2020-8238/): Cross-site scripting in Pulse Connect Secure/ Pulse Policy Secure (medium 6.1) - [CVE-2020-8237](https://insights.sbomify.com/CVE-2020-8237/): Uncontrolled Resource Consumption in json-bigint (high 7.5) - [CVE-2020-8236](https://insights.sbomify.com/CVE-2020-8236/): Security feature bypass in Nextcloud Server (medium 6.8) - [CVE-2020-8235](https://insights.sbomify.com/CVE-2020-8235/): Missing authorization in Nextcloud Deck app (medium 4.3) - [CVE-2020-8234](https://insights.sbomify.com/CVE-2020-8234/): Command injection in EdgeSwitch firmware v1.9.0 and prior (critical 9.8) - [CVE-2020-8233](https://insights.sbomify.com/CVE-2020-8233/): Command injection in EdgeSwitch firmware v1.9.0 and prior (high 8.8) - [CVE-2020-8232](https://insights.sbomify.com/CVE-2020-8232/): Information disclosure in EdgeSwitch firmware v1.9.0 and prior (medium 6.5) - [CVE-2020-8231](https://insights.sbomify.com/CVE-2020-8231/): Use after free in https://github.com/curl/curl (high 7.5) - [CVE-2020-8230](https://insights.sbomify.com/CVE-2020-8230/): Memory corruption in Desktop Client (medium 5.5) - [CVE-2020-8229](https://insights.sbomify.com/CVE-2020-8229/): Denial of service in Desktop Client (medium 5.5) - [CVE-2020-8228](https://insights.sbomify.com/CVE-2020-8228/): Business logic in Nextcloud Preferred Provider (medium 5.3) - [CVE-2020-8227](https://insights.sbomify.com/CVE-2020-8227/): Path traversal in Desktop Client (medium 6.8) - [CVE-2020-8226](https://insights.sbomify.com/CVE-2020-8226/): phpBB Server-Side Request Forgery Vulnerability (medium 5.8) - [CVE-2020-8225](https://insights.sbomify.com/CVE-2020-8225/): Information disclosure in Desktop Client (high 7.5) - [CVE-2020-8224](https://insights.sbomify.com/CVE-2020-8224/): Code injection in Desktop Client (high 7.8) - [CVE-2020-8223](https://insights.sbomify.com/CVE-2020-8223/): Privilege escalation in Nextcloud Server (medium 6.5) - [CVE-2020-8222](https://insights.sbomify.com/CVE-2020-8222/): Path traversal in Pulse Connect Secure (medium 6.8) - [CVE-2020-8221](https://insights.sbomify.com/CVE-2020-8221/): Path traversal in Pulse Connect Secure (medium 4.9) - [CVE-2020-8220](https://insights.sbomify.com/CVE-2020-8220/): Command injection in Pulse Connect Secure (medium 6.5) - [CVE-2020-8219](https://insights.sbomify.com/CVE-2020-8219/): Missing authorization in Pulse Connect Secure (high 7.2) - [CVE-2020-8218](https://insights.sbomify.com/CVE-2020-8218/): Pulse Connect Secure Code Injection (high 7.2, exploited in the wild) - [CVE-2020-8217](https://insights.sbomify.com/CVE-2020-8217/): Cross-site scripting in Pulse Connect Secure (medium 5.4) - [CVE-2020-8216](https://insights.sbomify.com/CVE-2020-8216/): Information disclosure in Pulse Connect Secure (medium 4.3) - [CVE-2020-8215](https://insights.sbomify.com/CVE-2020-8215/): Buffer overflow in canvas (high 8.8) - [CVE-2020-8214](https://insights.sbomify.com/CVE-2020-8214/): Path traversal in servey (high 7.5) - [CVE-2020-8213](https://insights.sbomify.com/CVE-2020-8213/): Information disclosure in Protect for UniFi Cloud Key Gen2 Plus (medium 5.3) - [CVE-2020-8212](https://insights.sbomify.com/CVE-2020-8212/): Missing authorization in Citrix XenMobile Server (critical 9.8) - [CVE-2020-8211](https://insights.sbomify.com/CVE-2020-8211/): SQL injection in Citrix XenMobile Server (critical 9.8) - [CVE-2020-8210](https://insights.sbomify.com/CVE-2020-8210/): Information disclosure in Citrix XenMobile Server (high 7.5) - [CVE-2020-8209](https://insights.sbomify.com/CVE-2020-8209/): Path traversal in Citrix XenMobile Server (high 7.5) - [CVE-2020-8208](https://insights.sbomify.com/CVE-2020-8208/): Cross-site scripting in Citrix XenMobile Server (medium 6.1) - [CVE-2020-8207](https://insights.sbomify.com/CVE-2020-8207/): Privilege escalation in Citrix Workspace App for Windows (high 8.8) - [CVE-2020-8206](https://insights.sbomify.com/CVE-2020-8206/): Auth bypass in Pulse Connect Secure (high 8.1) - [CVE-2020-8205](https://insights.sbomify.com/CVE-2020-8205/): Server-Side Request Forgery in @uppy/companion (high 7.5) - [CVE-2020-8204](https://insights.sbomify.com/CVE-2020-8204/): Cross-site scripting in Pulse Connect Secure (medium 6.1) - [CVE-2020-8203](https://insights.sbomify.com/CVE-2020-8203/): Prototype Pollution in lodash (high 7.4) - [CVE-2020-8202](https://insights.sbomify.com/CVE-2020-8202/): Denial of service in Nextcloud Preferred Providers (medium 5.3) - [CVE-2020-8201](https://insights.sbomify.com/CVE-2020-8201/): Other in Node (high 7.4) - [CVE-2020-8200](https://insights.sbomify.com/CVE-2020-8200/): Information disclosure in Citrix StoreFront (medium 6.5) - [CVE-2020-8199](https://insights.sbomify.com/CVE-2020-8199/): Privilege escalation in Citrix Gateway Plug-in for Linux (high 7.8) - [CVE-2020-8198](https://insights.sbomify.com/CVE-2020-8198/): Cross-site scripting in Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP (medium 6.1) - [CVE-2020-8197](https://insights.sbomify.com/CVE-2020-8197/): Privilege escalation in Citrix ADC, Citrix Gateway (high 8.8) - [CVE-2020-8196](https://insights.sbomify.com/CVE-2020-8196/): Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure (medium 4.3, exploited in the wild) - [CVE-2020-8195](https://insights.sbomify.com/CVE-2020-8195/): Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure (medium 6.5, exploited in the wild) - [CVE-2020-8194](https://insights.sbomify.com/CVE-2020-8194/): Code injection in Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP (medium 6.5) - [CVE-2020-8193](https://insights.sbomify.com/CVE-2020-8193/): Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass (medium 6.5, exploited in the wild) - [CVE-2020-8192](https://insights.sbomify.com/CVE-2020-8192/): Denial of service in fastify (medium 6.5) - [CVE-2020-8191](https://insights.sbomify.com/CVE-2020-8191/): Cross-site scripting in Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP (medium 6.1) - [CVE-2020-8190](https://insights.sbomify.com/CVE-2020-8190/): Privilege escalation in Citrix ADC, Citrix Gateway (high 7.5) - [CVE-2020-8189](https://insights.sbomify.com/CVE-2020-8189/): Cross-site scripting in Desktop Client (medium 5.4) - [CVE-2020-8188](https://insights.sbomify.com/CVE-2020-8188/): Command injection in Protect for UniFi Cloud Key Gen2 Plus, UniFi Dream Machine Pro, UNVR (high 8.8) - [CVE-2020-8187](https://insights.sbomify.com/CVE-2020-8187/): Denial of service in Citrix ADC, Citrix Gateway (high 7.5) - [CVE-2020-8186](https://insights.sbomify.com/CVE-2020-8186/): Injection and Command Injection in devcert (critical 9.8) - [CVE-2020-8185](https://insights.sbomify.com/CVE-2020-8185/): Untrusted users can run pending migrations in production in Rails (medium 6.5) - [CVE-2020-8184](https://insights.sbomify.com/CVE-2020-8184/): Rack allows Percent-encoded cookies to overwrite existing prefixed cookie names (high 7.5) - [CVE-2020-8183](https://insights.sbomify.com/CVE-2020-8183/): Information disclosure in Nextcloud Server (high 7.5) - [CVE-2020-8182](https://insights.sbomify.com/CVE-2020-8182/): Missing authorization in Nextcloud Deck (high 8.0) - [CVE-2020-8181](https://insights.sbomify.com/CVE-2020-8181/): File upload in Nextcloud Contact (medium 4.3) - [CVE-2020-8180](https://insights.sbomify.com/CVE-2020-8180/): Code injection in Nextcloud Talk (critical 9.9) - [CVE-2020-8179](https://insights.sbomify.com/CVE-2020-8179/): Missing authorization in Nextcloud Deck (medium 4.1) - [CVE-2020-8178](https://insights.sbomify.com/CVE-2020-8178/): Command injection in jison (critical 9.8) - [CVE-2020-8177](https://insights.sbomify.com/CVE-2020-8177/): Path traversal in https://github.com/curl/curl (high 7.8) - [CVE-2020-8176](https://insights.sbomify.com/CVE-2020-8176/): Cross-site scripting in @shopify/koa-shopify-auth (medium 6.1) - [CVE-2020-8175](https://insights.sbomify.com/CVE-2020-8175/): Uncontrolled resource consumption in jpeg-js (medium 5.5) - [CVE-2020-8174](https://insights.sbomify.com/CVE-2020-8174/): Memory corruption in https://github.com/nodejs/node (high 8.1) - [CVE-2020-8173](https://insights.sbomify.com/CVE-2020-8173/): Weak cryptography in Nextcloud Server (low 2.2) - [CVE-2020-8172](https://insights.sbomify.com/CVE-2020-8172/): Security feature bypass in https://github.com/nodejs/node (high 7.4) --- From sbomify Insights: https://insights.sbomify.com/years/2020/page/33/