# Vulnerabilities published in 2020


- [CVE-2020-8019](https://insights.sbomify.com/CVE-2020-8019/): syslog-ng: Local privilege escalation from new to root in %post (high 7.7)
- [CVE-2020-8018](https://insights.sbomify.com/CVE-2020-8018/): User owned /etc in SLES15-SP1-CHOST-BYOS (high 8.4)
- [CVE-2020-8017](https://insights.sbomify.com/CVE-2020-8017/): race condition on texlive-filesystem cron job allows for the deletion of unintended files (medium 6.2)
- [CVE-2020-8016](https://insights.sbomify.com/CVE-2020-8016/): race condition in the packaging of texlive-filesysten (medium 4.9)
- [CVE-2020-8015](https://insights.sbomify.com/CVE-2020-8015/): Local privilege escalation in exim package from user mail to root (high 8.4)
- [CVE-2020-8014](https://insights.sbomify.com/CVE-2020-8014/): kopano-python-services: Local privilege escalation from kopano to root in kopano-spamd subpackage (high 7.7)
- [CVE-2020-8013](https://insights.sbomify.com/CVE-2020-8013/): permissions: chkstat sets unintended setuid/capabilities for mrsh and wodim (low 2.2)
- [CVE-2020-8012](https://insights.sbomify.com/CVE-2020-8012/): Memory corruption in CA Unified Infrastructure Management (Nimsoft/UIM) (critical 9.8)
- [CVE-2020-8011](https://insights.sbomify.com/CVE-2020-8011/): Null dereference in CA Unified Infrastructure Management (Nimsoft/UIM) (high 7.5)
- [CVE-2020-8010](https://insights.sbomify.com/CVE-2020-8010/): Missing authorization in CA Unified Infrastructure Management (Nimsoft/UIM) (critical 9.8)
- [CVE-2020-8009](https://insights.sbomify.com/CVE-2020-8009/): Path traversal in motu:avb firmware (high 7.5)
- [CVE-2020-8007](https://insights.sbomify.com/CVE-2020-8007/): The pwrstudio web application of EV Charger (in the server in Circontrol Raption through 5.6.2) is vulnerable to OS command injection via th (critical 9.8)
- [CVE-2020-8006](https://insights.sbomify.com/CVE-2020-8006/): Memory corruption in circontrol:raption server (high 8.8)
- [CVE-2020-8004](https://insights.sbomify.com/CVE-2020-8004/): Security feature bypass in st:stm32f1 firmware (high 7.5)
- [CVE-2020-8003](https://insights.sbomify.com/CVE-2020-8003/): Memory corruption in debian:debian linux (medium 5.5)
- [CVE-2020-8002](https://insights.sbomify.com/CVE-2020-8002/): Null dereference in debian:debian linux (medium 5.5)
- [CVE-2020-8001](https://insights.sbomify.com/CVE-2020-8001/): Hardcoded credentials in intelliantech:aptus (critical 9.8)
- [CVE-2020-8000](https://insights.sbomify.com/CVE-2020-8000/): Hardcoded credentials in intelliantech:aptus web (critical 9.8)
- [CVE-2020-7999](https://insights.sbomify.com/CVE-2020-7999/): Hardcoded credentials in intelliantech:aptus (critical 9.8)
- [CVE-2020-7998](https://insights.sbomify.com/CVE-2020-7998/): File upload in super file explorer project:super file explorer (high 8.8)
- [CVE-2020-7997](https://insights.sbomify.com/CVE-2020-7997/): Cross-site scripting in asus:rt-ac66u firmware (medium 6.1)
- [CVE-2020-7996](https://insights.sbomify.com/CVE-2020-7996/): XSS in Dolibarr ERP & CRM (medium 6.1)
- [CVE-2020-7995](https://insights.sbomify.com/CVE-2020-7995/): Dolibarr Improper Restriction of Excessive Authentication Attempts (critical 9.8)
- [CVE-2020-7994](https://insights.sbomify.com/CVE-2020-7994/): Dolibarr cross-site scripting (XSS) vulnerability (medium 6.1)
- [CVE-2020-7993](https://insights.sbomify.com/CVE-2020-7993/): Missing authorization in prototypejs:prototype (medium 4.3)
- [CVE-2020-7991](https://insights.sbomify.com/CVE-2020-7991/): Cross-site request forgery in adive:framework (high 8.8)
- [CVE-2020-7990](https://insights.sbomify.com/CVE-2020-7990/): Cross-site scripting in adive:framework (medium 6.1)
- [CVE-2020-7989](https://insights.sbomify.com/CVE-2020-7989/): Cross-site scripting in adive:framework (medium 6.1)
- [CVE-2020-7988](https://insights.sbomify.com/CVE-2020-7988/): Cross-site request forgery in phpipam:phpipam (high 8.8)
- [CVE-2020-7984](https://insights.sbomify.com/CVE-2020-7984/): Information disclosure in solarwinds:n-central (high 7.5)
- [CVE-2020-7983](https://insights.sbomify.com/CVE-2020-7983/): Cross-site request forgery in commscope:ruckus zoneflex r500 firmware (high 8.1)
- [CVE-2020-7982](https://insights.sbomify.com/CVE-2020-7982/): Security feature bypass in openwrt:lede (high 8.1)
- [CVE-2020-7981](https://insights.sbomify.com/CVE-2020-7981/): SQL Injection in Geocoder (critical 9.8)
- [CVE-2020-7980](https://insights.sbomify.com/CVE-2020-7980/): Command injection in intelliantech:aptus web (critical 9.8)
- [CVE-2020-7979](https://insights.sbomify.com/CVE-2020-7979/): Misconfiguration in gitlab:gitlab (medium 5.3)
- [CVE-2020-7978](https://insights.sbomify.com/CVE-2020-7978/): Denial of service in gitlab:gitlab (high 7.5)
- [CVE-2020-7977](https://insights.sbomify.com/CVE-2020-7977/): Misconfiguration in gitlab:gitlab (medium 5.3)
- [CVE-2020-7976](https://insights.sbomify.com/CVE-2020-7976/): Missing authorization in gitlab:gitlab (medium 5.3)
- [CVE-2020-7974](https://insights.sbomify.com/CVE-2020-7974/): Information disclosure in gitlab:gitlab (medium 5.3)
- [CVE-2020-7973](https://insights.sbomify.com/CVE-2020-7973/): GitLab through 12.7.2 allows XSS. (medium 6.1)
- [CVE-2020-7972](https://insights.sbomify.com/CVE-2020-7972/): Misconfiguration in gitlab:gitlab (high 7.5)
- [CVE-2020-7971](https://insights.sbomify.com/CVE-2020-7971/): Cross-site scripting in gitlab:gitlab (medium 6.1)
- [CVE-2020-7969](https://insights.sbomify.com/CVE-2020-7969/): Information disclosure in gitlab:gitlab (high 7.5)
- [CVE-2020-7968](https://insights.sbomify.com/CVE-2020-7968/): Missing authorization in gitlab:gitlab (high 7.5)
- [CVE-2020-7967](https://insights.sbomify.com/CVE-2020-7967/): Misconfiguration in gitlab:gitlab (medium 4.3)
- [CVE-2020-7966](https://insights.sbomify.com/CVE-2020-7966/): Path traversal in gitlab:gitlab (high 7.5)
- [CVE-2020-7965](https://insights.sbomify.com/CVE-2020-7965/): Cross-Site Request Forgery in Webargs (high 8.8)
- [CVE-2020-7964](https://insights.sbomify.com/CVE-2020-7964/): Missing Authentication for Critical Function in Saleor (medium 5.3)
- [CVE-2020-7962](https://insights.sbomify.com/CVE-2020-7962/): Information disclosure in oneidentity:password manager (medium 5.3)
- [CVE-2020-7961](https://insights.sbomify.com/CVE-2020-7961/): Liferay Portal Deserialization of Untrusted Data (critical 9.8, exploited in the wild)
- [CVE-2020-7959](https://insights.sbomify.com/CVE-2020-7959/): Information disclosure in labvantage:labvantage (medium 5.3)
- [CVE-2020-7958](https://insights.sbomify.com/CVE-2020-7958/): Information disclosure in oneplus:oneplus 7 pro firmware (medium 6.0)
- [CVE-2020-7957](https://insights.sbomify.com/CVE-2020-7957/): Denial of service in dovecot:dovecot (low 3.1)
- [CVE-2020-7956](https://insights.sbomify.com/CVE-2020-7956/): Improper Certificate Validation in HashiCorp Nomad (critical 9.8)
- [CVE-2020-7955](https://insights.sbomify.com/CVE-2020-7955/): Incorrect Authorization in HashiCorp Consul (medium 5.3)
- [CVE-2020-7954](https://insights.sbomify.com/CVE-2020-7954/): Misconfiguration in opservices:opmon (high 7.8)
- [CVE-2020-7953](https://insights.sbomify.com/CVE-2020-7953/): Missing authorization in opservices:opmon (high 7.5)
- [CVE-2020-7952](https://insights.sbomify.com/CVE-2020-7952/): Memory corruption in valvesoftware:dota 2 (high 7.8)
- [CVE-2020-7951](https://insights.sbomify.com/CVE-2020-7951/): Memory corruption in valvesoftware:dota 2 (high 7.8)
- [CVE-2020-7950](https://insights.sbomify.com/CVE-2020-7950/): Memory corruption in valvesoftware:dota 2 (high 7.8)
- [CVE-2020-7949](https://insights.sbomify.com/CVE-2020-7949/): Memory corruption in valvesoftware:dota 2 (high 7.8)
- [CVE-2020-7948](https://insights.sbomify.com/CVE-2020-7948/): Missing authorization in auth0:login by auth0 (high 8.8)
- [CVE-2020-7947](https://insights.sbomify.com/CVE-2020-7947/): Code injection in auth0:login by auth0 (critical 9.8)
- [CVE-2020-7945](https://insights.sbomify.com/CVE-2020-7945/): Information disclosure in Continuous Delivery for Puppet Enterprise (CD4PE) (medium 5.5)
- [CVE-2020-7944](https://insights.sbomify.com/CVE-2020-7944/): Information disclosure in Continuous Delivery for Puppet Enterprise (CD4PE) (high 7.7)
- [CVE-2020-7943](https://insights.sbomify.com/CVE-2020-7943/): Information disclosure in Puppet Enterprise (high 7.5)
- [CVE-2020-7942](https://insights.sbomify.com/CVE-2020-7942/): Improper Certificate Validation in Puppet (medium 6.5)
- [CVE-2020-7941](https://insights.sbomify.com/CVE-2020-7941/): Plone Unauthenticated Write Vulnerability (critical 9.8)
- [CVE-2020-7940](https://insights.sbomify.com/CVE-2020-7940/): Plone allows weak passwords (high 7.5)
- [CVE-2020-7939](https://insights.sbomify.com/CVE-2020-7939/): Plone SQL Injection Vulnerability (high 8.8)
- [CVE-2020-7938](https://insights.sbomify.com/CVE-2020-7938/): Plone Privilege Escallation (high 8.8)
- [CVE-2020-7937](https://insights.sbomify.com/CVE-2020-7937/): Plone cross site scripting (XSS) (medium 5.4)
- [CVE-2020-7936](https://insights.sbomify.com/CVE-2020-7936/): Plone Open Redirect Vulnerability (medium 6.1)
- [CVE-2020-7935](https://insights.sbomify.com/CVE-2020-7935/): File upload in artica:pandora fms (high 7.2)
- [CVE-2020-7934](https://insights.sbomify.com/CVE-2020-7934/): Liferay Portal Vulnerable to Persistent Cross-Site Scripting (XSS) in MyAccountPortlet (medium 5.4)
- [CVE-2020-7932](https://insights.sbomify.com/CVE-2020-7932/): OMERO-web Sensitive Data Exposure (medium 5.7)
- [CVE-2020-7931](https://insights.sbomify.com/CVE-2020-7931/): Code injection in jfrog:artifactory (high 8.8)
- [CVE-2020-7929](https://insights.sbomify.com/CVE-2020-7929/): Specially crafted regex query can cause DoS (medium 6.5)
- [CVE-2020-7928](https://insights.sbomify.com/CVE-2020-7928/): Improper neutralization of null byte leads to read overrun (medium 6.5)
- [CVE-2020-7927](https://insights.sbomify.com/CVE-2020-7927/): Potential privilege escalation in Ops Manager API (high 8.1)
- [CVE-2020-7926](https://insights.sbomify.com/CVE-2020-7926/): Specific query can cause a DoS against MongoDB Server (medium 6.5)
- [CVE-2020-7925](https://insights.sbomify.com/CVE-2020-7925/): Denial of Service when processing malformed Role names (high 7.5)
- [CVE-2020-7924](https://insights.sbomify.com/CVE-2020-7924/): Specific command line parameter might result in accepting invalid certificate (medium 4.2)
- [CVE-2020-7923](https://insights.sbomify.com/CVE-2020-7923/): Specific GeoQuery can cause DoS against MongoDB Server (medium 6.5)
- [CVE-2020-7922](https://insights.sbomify.com/CVE-2020-7922/): Kubernetes Operator generates potentially insecure certificates (medium 6.4)
- [CVE-2020-7921](https://insights.sbomify.com/CVE-2020-7921/): Administrative action may disable enforcement of per-user IP whitelisting (medium 4.6)
- [CVE-2020-7920](https://insights.sbomify.com/CVE-2020-7920/): Denial of service in percona:monitoring and management (high 7.5)
- [CVE-2020-7919](https://insights.sbomify.com/CVE-2020-7919/): Helm uses crypto package vulnerable to panic from malformed X.509 certificate (high 7.5)
- [CVE-2020-7918](https://insights.sbomify.com/CVE-2020-7918/): Missing authorization in totemo:totemomail (medium 5.4)
- [CVE-2020-7916](https://insights.sbomify.com/CVE-2020-7916/): Privilege escalation in thimpress:learnpress (medium 6.5)
- [CVE-2020-7915](https://insights.sbomify.com/CVE-2020-7915/): Cross-site scripting in eaton:5p 850 firmware (medium 4.8)
- [CVE-2020-7914](https://insights.sbomify.com/CVE-2020-7914/): Misconfiguration in jetbrains:intellij idea (high 7.5)
- [CVE-2020-7913](https://insights.sbomify.com/CVE-2020-7913/): Cross-site scripting in jetbrains:youtrack (medium 6.1)
- [CVE-2020-7912](https://insights.sbomify.com/CVE-2020-7912/): Missing authorization in jetbrains:youtrack (medium 5.3)
- [CVE-2020-7911](https://insights.sbomify.com/CVE-2020-7911/): Cross-site scripting in jetbrains:teamcity (medium 6.1)
- [CVE-2020-7910](https://insights.sbomify.com/CVE-2020-7910/): Cross-site scripting in jetbrains:teamcity (medium 5.4)
- [CVE-2020-7909](https://insights.sbomify.com/CVE-2020-7909/): Information disclosure in jetbrains:teamcity (high 7.5)
- [CVE-2020-7908](https://insights.sbomify.com/CVE-2020-7908/): Other in jetbrains:teamcity (medium 4.3)
- [CVE-2020-7907](https://insights.sbomify.com/CVE-2020-7907/): Weak cryptography in jetbrains:scala (high 7.5)
- [CVE-2020-7906](https://insights.sbomify.com/CVE-2020-7906/): Security feature bypass in jetbrains:rider (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/35/