# Vulnerabilities published in 2020


- [CVE-2020-8171](https://insights.sbomify.com/CVE-2020-8171/): Command injection in AirMax AirOS for TI, XW and XM boards (critical 9.8)
- [CVE-2020-8170](https://insights.sbomify.com/CVE-2020-8170/): Cross-site scripting in AirMax AirOS for TI, XW and XM boards (medium 6.1)
- [CVE-2020-8169](https://insights.sbomify.com/CVE-2020-8169/): Information disclosure in https://github.com/curl/curl (high 7.5)
- [CVE-2020-8168](https://insights.sbomify.com/CVE-2020-8168/): Cross-site request forgery in AirMax AirOS for TI, XW and XM boards (high 8.8)
- [CVE-2020-8167](https://insights.sbomify.com/CVE-2020-8167/): CSRF Vulnerability in rails-ujs (medium 6.5)
- [CVE-2020-8166](https://insights.sbomify.com/CVE-2020-8166/): Ability to forge per-form CSRF tokens in Rails (medium 4.3)
- [CVE-2020-8165](https://insights.sbomify.com/CVE-2020-8165/): ActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore (critical 9.8)
- [CVE-2020-8164](https://insights.sbomify.com/CVE-2020-8164/): Possible Strong Parameters Bypass in ActionPack (high 7.5)
- [CVE-2020-8163](https://insights.sbomify.com/CVE-2020-8163/): Remote code execution via user-provided local names in ActionView (high 8.8)
- [CVE-2020-8162](https://insights.sbomify.com/CVE-2020-8162/): Circumvention of file size limits in ActiveStorage (high 7.5)
- [CVE-2020-8161](https://insights.sbomify.com/CVE-2020-8161/): Directory traversal in Rack::Directory app bundled with Rack (high 8.6)
- [CVE-2020-8160](https://insights.sbomify.com/CVE-2020-8160/): Cross-site scripting in MendixSSO (medium 6.1)
- [CVE-2020-8159](https://insights.sbomify.com/CVE-2020-8159/): Arbitrary file write in actionpack-page_caching gem (critical 9.8)
- [CVE-2020-8158](https://insights.sbomify.com/CVE-2020-8158/): TypeORM vulnerable to MAID and Prototype Pollution (critical 9.8)
- [CVE-2020-8157](https://insights.sbomify.com/CVE-2020-8157/): Auth bypass in UniFi Cloud Key Gen2, Cloud Key Gen2 plus (medium 6.8)
- [CVE-2020-8156](https://insights.sbomify.com/CVE-2020-8156/): Security feature bypass in Nextcloud Mail (high 7.0)
- [CVE-2020-8155](https://insights.sbomify.com/CVE-2020-8155/): Cross-site scripting in Nextcloud Server (medium 5.4)
- [CVE-2020-8154](https://insights.sbomify.com/CVE-2020-8154/): Missing authorization in Nextcloud Server (high 7.7)
- [CVE-2020-8153](https://insights.sbomify.com/CVE-2020-8153/): Missing authorization in Nextcloud Groupfolders (high 8.1)
- [CVE-2020-8152](https://insights.sbomify.com/CVE-2020-8152/): Weak cryptography in Nextcloud Server (medium 4.4)
- [CVE-2020-8151](https://insights.sbomify.com/CVE-2020-8151/): Information disclosure issue in Active Resource (high 7.5)
- [CVE-2020-8150](https://insights.sbomify.com/CVE-2020-8150/): Weak cryptography in Nextcloud Server (medium 4.1)
- [CVE-2020-8149](https://insights.sbomify.com/CVE-2020-8149/): Arbitrary shell command execution in logkitty (critical 9.8)
- [CVE-2020-8148](https://insights.sbomify.com/CVE-2020-8148/): Auth bypass in UniFi Cloud Key Gen2 (medium 5.3)
- [CVE-2020-8147](https://insights.sbomify.com/CVE-2020-8147/): Prototype Pollution (critical 9.8)
- [CVE-2020-8146](https://insights.sbomify.com/CVE-2020-8146/): Privilege escalation in UniFi Video Controller (for Windows 7/8/10 x64) (high 7.8)
- [CVE-2020-8145](https://insights.sbomify.com/CVE-2020-8145/): Missing authorization in UniFi Video Controller (for Windows 7/8/10 x64) (medium 6.5)
- [CVE-2020-8144](https://insights.sbomify.com/CVE-2020-8144/): Path traversal in UniFi Video Controller (for Windows 7/8/10 x64) (high 8.4)
- [CVE-2020-8143](https://insights.sbomify.com/CVE-2020-8143/): Open redirect in https://github.com/revive-adserver/revive-adserver (medium 6.1)
- [CVE-2020-8142](https://insights.sbomify.com/CVE-2020-8142/): Auth bypass in https://github.com/revive-adserver/revive-adserver (medium 6.8)
- [CVE-2020-8141](https://insights.sbomify.com/CVE-2020-8141/): Improper Control of Generation of Code in doT (high 8.8)
- [CVE-2020-8140](https://insights.sbomify.com/CVE-2020-8140/): Code injection in Desktop Client (medium 6.7)
- [CVE-2020-8139](https://insights.sbomify.com/CVE-2020-8139/): Missing authorization in Nextcloud Server (medium 6.5)
- [CVE-2020-8138](https://insights.sbomify.com/CVE-2020-8138/): Server-side request forgery in Nextcloud Server (medium 6.5)
- [CVE-2020-8137](https://insights.sbomify.com/CVE-2020-8137/): Code injection in blamer (critical 9.8)
- [CVE-2020-8136](https://insights.sbomify.com/CVE-2020-8136/): Uncontrolled Resource Consumption in fastify-multipart (high 7.5)
- [CVE-2020-8135](https://insights.sbomify.com/CVE-2020-8135/): Server-Side Request Forgery in @uppy/companion (critical 9.8)
- [CVE-2020-8134](https://insights.sbomify.com/CVE-2020-8134/): Server-side request forgery in Ghost CMS (high 8.1)
- [CVE-2020-8133](https://insights.sbomify.com/CVE-2020-8133/): Weak cryptography in Nextcloud Server (medium 5.3)
- [CVE-2020-8132](https://insights.sbomify.com/CVE-2020-8132/): Improper Input Validation and Code Injection in pdf-image (critical 9.8)
- [CVE-2020-8131](https://insights.sbomify.com/CVE-2020-8131/): Path Traversal in Yarn (high 7.5)
- [CVE-2020-8130](https://insights.sbomify.com/CVE-2020-8130/): OS Command Injection in Rake (medium 6.4)
- [CVE-2020-8129](https://insights.sbomify.com/CVE-2020-8129/): Code Injection in script-manager (critical 9.8)
- [CVE-2020-8128](https://insights.sbomify.com/CVE-2020-8128/): Server-Side Request Forgery and Inclusion of Functionality from Untrusted Control Sphere in jsreport (critical 9.8)
- [CVE-2020-8127](https://insights.sbomify.com/CVE-2020-8127/): Cross-site Scripting in reveal.js (medium 6.1)
- [CVE-2020-8126](https://insights.sbomify.com/CVE-2020-8126/): Command injection in EdgeSwitch (high 7.8)
- [CVE-2020-8125](https://insights.sbomify.com/CVE-2020-8125/): Improper Input Validation in klona (critical 9.8)
- [CVE-2020-8124](https://insights.sbomify.com/CVE-2020-8124/): Improper Validation and Sanitization in url-parse (medium 5.3)
- [CVE-2020-8123](https://insights.sbomify.com/CVE-2020-8123/): Uncontrolled Resource Consumption in strapi (medium 4.9)
- [CVE-2020-8122](https://insights.sbomify.com/CVE-2020-8122/): Business logic in Nextcloud server (medium 4.3)
- [CVE-2020-8121](https://insights.sbomify.com/CVE-2020-8121/): Information disclosure in Nextcloud Server (high 8.1)
- [CVE-2020-8120](https://insights.sbomify.com/CVE-2020-8120/): Cross-site scripting in Nextcloud Server (medium 6.1)
- [CVE-2020-8119](https://insights.sbomify.com/CVE-2020-8119/): Missing authorization in Nextcloud Server (medium 4.3)
- [CVE-2020-8118](https://insights.sbomify.com/CVE-2020-8118/): Server-side request forgery in Nextcloud Server (medium 5.0)
- [CVE-2020-8117](https://insights.sbomify.com/CVE-2020-8117/): Information disclosure in Nextcloud Server (medium 4.3)
- [CVE-2020-8116](https://insights.sbomify.com/CVE-2020-8116/): dot-prop Prototype Pollution vulnerability (high 7.3)
- [CVE-2020-8115](https://insights.sbomify.com/CVE-2020-8115/): Cross-site scripting in https://github.com/revive-adserver/revive-adserver (medium 6.1)
- [CVE-2020-8114](https://insights.sbomify.com/CVE-2020-8114/): Misconfiguration in gitlab:gitlab (critical 9.8)
- [CVE-2020-8113](https://insights.sbomify.com/CVE-2020-8113/): Privilege escalation in gitlab:gitlab (critical 9.8)
- [CVE-2020-8112](https://insights.sbomify.com/CVE-2020-8112/): Memory corruption in debian:debian linux (high 8.8)
- [CVE-2020-8110](https://insights.sbomify.com/CVE-2020-8110/): Bitdefender ceva_emu.cvd module denial-of-service (VA-8766) (medium 5.9)
- [CVE-2020-8109](https://insights.sbomify.com/CVE-2020-8109/): Bitdefender ace.xmd parser out-of-bounds write (VA-8772) (medium 5.9)
- [CVE-2020-8108](https://insights.sbomify.com/CVE-2020-8108/): Insufficient client validation in Bitdefender Endpoint Security for Mac (VA-8759) (high 8.2)
- [CVE-2020-8107](https://insights.sbomify.com/CVE-2020-8107/): Process Control vulnerability in Bitdefender Antivirus Plus (high 8.2)
- [CVE-2020-8105](https://insights.sbomify.com/CVE-2020-8105/): Command Execution due to unsanitized input (critical 9.6)
- [CVE-2020-8103](https://insights.sbomify.com/CVE-2020-8103/): Link Resolution Privilege Escalation Vulnerability in Bitdefender Antivirus Free (VA-8604) (high 7.2)
- [CVE-2020-8102](https://insights.sbomify.com/CVE-2020-8102/): Insufficient URL sanitization and validation in Safepay Browser (VA-8631) (high 8.8)
- [CVE-2020-8101](https://insights.sbomify.com/CVE-2020-8101/): Command execution due to unsanitized input in LifeShield DIY HD Video Doorbell (medium 6.9)
- [CVE-2020-8100](https://insights.sbomify.com/CVE-2020-8100/): Incomplete validation in detection code in Bitdefender Engines (VA-8589) (critical 9.0)
- [CVE-2020-8099](https://insights.sbomify.com/CVE-2020-8099/): Link Resolution Privilege Escalation Vulnerability in Bitdefender Antivirus Free (VA-8387) (high 7.1)
- [CVE-2020-8097](https://insights.sbomify.com/CVE-2020-8097/): Improper authentication vulnerability in Bitdefender Endpoint Security Tools and Endpoint Security SDK (VA-8646) (high 8.1)
- [CVE-2020-8096](https://insights.sbomify.com/CVE-2020-8096/): Untrusted Search Path Vulnerability in High-Level Antimalware SDK (medium 6.3)
- [CVE-2020-8095](https://insights.sbomify.com/CVE-2020-8095/): Bitdefender Total Security Link Resolution Denial-of-Service Vulnerability (medium 4.9)
- [CVE-2020-8094](https://insights.sbomify.com/CVE-2020-8094/): Untrusted Search Path Vulnerability in Bitdefender Antivirus Free 2020 (VA-8422) (high 8.8)
- [CVE-2020-8093](https://insights.sbomify.com/CVE-2020-8093/): Code Injection into Bitdefender AV for Mac (medium 5.3)
- [CVE-2020-8092](https://insights.sbomify.com/CVE-2020-8092/): Privilege escalation in Bitdefender AV for Mac (low 1.6)
- [CVE-2020-8091](https://insights.sbomify.com/CVE-2020-8091/): Typo3 Cross-Site Scripting in Flash component (ELTS) (medium 4.8)
- [CVE-2020-8090](https://insights.sbomify.com/CVE-2020-8090/): Cross-site scripting in a1:wlan box adb vv2220 firmware (medium 4.8)
- [CVE-2020-8089](https://insights.sbomify.com/CVE-2020-8089/): Cross-site scripting in piwigo:piwigo (medium 5.4)
- [CVE-2020-8088](https://insights.sbomify.com/CVE-2020-8088/): Auth bypass in usebb:usebb (critical 9.8)
- [CVE-2020-8087](https://insights.sbomify.com/CVE-2020-8087/): Command injection in smc:d3g0804w firmware (critical 9.8)
- [CVE-2020-8086](https://insights.sbomify.com/CVE-2020-8086/): Auth bypass in debian:debian linux (critical 9.8)
- [CVE-2020-8037](https://insights.sbomify.com/CVE-2020-8037/): ppp decapsulator can be convinced to allocate a large amount of memory (high 7.5)
- [CVE-2020-8036](https://insights.sbomify.com/CVE-2020-8036/): str2tokbuf used incorrectly by print-someip.c (high 7.5)
- [CVE-2020-8035](https://insights.sbomify.com/CVE-2020-8035/): Cross-site scripting in horde:groupware (medium 6.1)
- [CVE-2020-8034](https://insights.sbomify.com/CVE-2020-8034/): Cross-site scripting in horde:gollem (medium 6.1)
- [CVE-2020-8033](https://insights.sbomify.com/CVE-2020-8033/): Cross-site scripting in commscope:ruckus zoneflex r500 firmware (medium 6.1)
- [CVE-2020-8032](https://insights.sbomify.com/CVE-2020-8032/): Local privilege escalation to root due to insecure tmp file usage (medium 6.7)
- [CVE-2020-8031](https://insights.sbomify.com/CVE-2020-8031/): obs: Stored XSS (medium 6.3)
- [CVE-2020-8030](https://insights.sbomify.com/CVE-2020-8030/): skuba: Insecure /tmp usage when joining node to cluster (low 3.6)
- [CVE-2020-8029](https://insights.sbomify.com/CVE-2020-8029/): skuba: Insecure handling of private key (low 2.9)
- [CVE-2020-8028](https://insights.sbomify.com/CVE-2020-8028/): salt-api is accessible to every user on SUSE Manager Server (critical 9.3)
- [CVE-2020-8027](https://insights.sbomify.com/CVE-2020-8027/): openldap uses fixed paths in /tmp (high 7.3)
- [CVE-2020-8026](https://insights.sbomify.com/CVE-2020-8026/): inn: non-root owned files (high 8.4)
- [CVE-2020-8025](https://insights.sbomify.com/CVE-2020-8025/): outdated entries in permissions profiles for /var/lib/pcp/tmp/* may cause security issues (medium 6.1)
- [CVE-2020-8024](https://insights.sbomify.com/CVE-2020-8024/): Problematic permissions in hylafax+ packaging allow escalation from uucp to other users (medium 5.3)
- [CVE-2020-8023](https://insights.sbomify.com/CVE-2020-8023/): Local privilege escalation from ldap to root when using OPENLDAP_CONFIG_BACKEND=ldap in openldap2 (high 7.7)
- [CVE-2020-8022](https://insights.sbomify.com/CVE-2020-8022/): User-writeable configuration file /usr/lib/tmpfiles.d/tomcat.conf allows for escalation of priviliges (high 7.7)
- [CVE-2020-8021](https://insights.sbomify.com/CVE-2020-8021/): unauthorized read access to files where sourceaccess is disabled via a crafted _service file in Open Build Service (medium 5.3)
- [CVE-2020-8020](https://insights.sbomify.com/CVE-2020-8020/): Persistent XSS in markdown parser used by obs-server (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/34/