# Vulnerabilities published in 2020


- [CVE-2020-7669](https://insights.sbomify.com/CVE-2020-7669/): Arbitrary File Write via Archive Extraction (Zip Slip) (high 7.5)
- [CVE-2020-7668](https://insights.sbomify.com/CVE-2020-7668/): Arbitrary File Write via Archive Extraction (Zip Slip) (high 7.5)
- [CVE-2020-7667](https://insights.sbomify.com/CVE-2020-7667/): Arbitrary File Write via Archive Extraction (Zip Slip) (high 7.5)
- [CVE-2020-7666](https://insights.sbomify.com/CVE-2020-7666/): Arbitrary File Write via Archive Extraction (Zip Slip) (high 7.5)
- [CVE-2020-7665](https://insights.sbomify.com/CVE-2020-7665/): Arbitrary File Write via Archive Extraction (Zip Slip) (high 7.5)
- [CVE-2020-7664](https://insights.sbomify.com/CVE-2020-7664/): Arbitrary File Write via Archive Extraction (Zip Slip) (high 7.5)
- [CVE-2020-7663](https://insights.sbomify.com/CVE-2020-7663/): Regular Expression Denial of Service in websocket-extensions (RubyGem) (high 7.5)
- [CVE-2020-7662](https://insights.sbomify.com/CVE-2020-7662/): Regular Expression Denial of Service in websocket-extensions (NPM package) (high 7.5)
- [CVE-2020-7661](https://insights.sbomify.com/CVE-2020-7661/): Regular expression denial of service in url-regex (high 7.5)
- [CVE-2020-7660](https://insights.sbomify.com/CVE-2020-7660/): Insecure serialization leading to RCE in serialize-javascript (high 8.1)
- [CVE-2020-7659](https://insights.sbomify.com/CVE-2020-7659/): HTTP Request Smuggling in reel (high 7.5)
- [CVE-2020-7658](https://insights.sbomify.com/CVE-2020-7658/): meinheld vulnerable to HTTP Request Smuggling (medium 6.1)
- [CVE-2020-7656](https://insights.sbomify.com/CVE-2020-7656/): Cross-Site Scripting in jquery (medium 6.1)
- [CVE-2020-7655](https://insights.sbomify.com/CVE-2020-7655/): HTTP Request Smuggling in netius (medium 6.1)
- [CVE-2020-7654](https://insights.sbomify.com/CVE-2020-7654/): Information Exposure in Snyk Broker (high 7.5)
- [CVE-2020-7653](https://insights.sbomify.com/CVE-2020-7653/): Arbitrary File Read in Snyk Broker (medium 6.5)
- [CVE-2020-7652](https://insights.sbomify.com/CVE-2020-7652/): Arbitrary File Read in Snyk Broker (medium 6.5)
- [CVE-2020-7651](https://insights.sbomify.com/CVE-2020-7651/): Arbitrary File Read in Snyk Broker (medium 4.3)
- [CVE-2020-7650](https://insights.sbomify.com/CVE-2020-7650/): Arbitrary File Read in Snyk Broker (medium 6.5)
- [CVE-2020-7649](https://insights.sbomify.com/CVE-2020-7649/): Directory Traversal (medium 4.9)
- [CVE-2020-7648](https://insights.sbomify.com/CVE-2020-7648/): Arbitrary File Read in Snyk Broker (medium 6.5)
- [CVE-2020-7647](https://insights.sbomify.com/CVE-2020-7647/): path traversal in Jooby (medium 5.3)
- [CVE-2020-7646](https://insights.sbomify.com/CVE-2020-7646/): curlrequest allows execution of arbitrary commands (critical 9.8)
- [CVE-2020-7645](https://insights.sbomify.com/CVE-2020-7645/): chrome-launcher subject to OS Command Injection (critical 9.8)
- [CVE-2020-7644](https://insights.sbomify.com/CVE-2020-7644/): Uncontrolled Resource Consumption in fun-map (high 8.1)
- [CVE-2020-7643](https://insights.sbomify.com/CVE-2020-7643/): Prototype pollution in paypal-adaptive (medium 5.3)
- [CVE-2020-7642](https://insights.sbomify.com/CVE-2020-7642/): Cross-site scripting in lazysizes (medium 5.4)
- [CVE-2020-7641](https://insights.sbomify.com/CVE-2020-7641/): Prototype Pollution (medium 4.0)
- [CVE-2020-7640](https://insights.sbomify.com/CVE-2020-7640/): OS Command Injection in pixl-class (critical 9.8)
- [CVE-2020-7639](https://insights.sbomify.com/CVE-2020-7639/): eivindfjeldstad-dot contains prototype pollution vulnerability (medium 5.3)
- [CVE-2020-7638](https://insights.sbomify.com/CVE-2020-7638/): confinit vulnerable to prototype pollution (medium 5.3)
- [CVE-2020-7637](https://insights.sbomify.com/CVE-2020-7637/): Prototype pollution in class-transformer (medium 5.3)
- [CVE-2020-7636](https://insights.sbomify.com/CVE-2020-7636/): OS Command Injection in adb-driver (critical 9.8)
- [CVE-2020-7635](https://insights.sbomify.com/CVE-2020-7635/): Command Injection in compass-compile (critical 9.8)
- [CVE-2020-7634](https://insights.sbomify.com/CVE-2020-7634/): OS Command Injection in heroku-addonpool (critical 9.8)
- [CVE-2020-7633](https://insights.sbomify.com/CVE-2020-7633/): apiconnect-cli-plugins vulnerable to OS Command Injection (critical 9.8)
- [CVE-2020-7632](https://insights.sbomify.com/CVE-2020-7632/): OS Command Injection in node-mpv (critical 9.8)
- [CVE-2020-7631](https://insights.sbomify.com/CVE-2020-7631/): OS Command Injection in diskusage-ng (critical 9.8)
- [CVE-2020-7630](https://insights.sbomify.com/CVE-2020-7630/): OS Command Injection in git-add-remote (critical 9.8)
- [CVE-2020-7629](https://insights.sbomify.com/CVE-2020-7629/): OS Command Injection in install-package (critical 9.8)
- [CVE-2020-7628](https://insights.sbomify.com/CVE-2020-7628/): Command Injection in umount (critical 9.8)
- [CVE-2020-7627](https://insights.sbomify.com/CVE-2020-7627/): OS Command Injection in node-key-sender (critical 9.8)
- [CVE-2020-7626](https://insights.sbomify.com/CVE-2020-7626/): karma-mojo enables OS Command Injection (critical 9.8)
- [CVE-2020-7625](https://insights.sbomify.com/CVE-2020-7625/): Injection in op-browser (critical 9.8)
- [CVE-2020-7624](https://insights.sbomify.com/CVE-2020-7624/): Command injection in effect (critical 9.8)
- [CVE-2020-7623](https://insights.sbomify.com/CVE-2020-7623/): OS Command Injection in jscover (critical 9.8)
- [CVE-2020-7622](https://insights.sbomify.com/CVE-2020-7622/): HTTP Response Splitting (medium 6.5)
- [CVE-2020-7621](https://insights.sbomify.com/CVE-2020-7621/): OS Command Injection in strong-nginx-controller (critical 9.8)
- [CVE-2020-7620](https://insights.sbomify.com/CVE-2020-7620/): OS Command Injection in pomelo-monitor (critical 9.8)
- [CVE-2020-7619](https://insights.sbomify.com/CVE-2020-7619/): Command injection in get-git-data (critical 9.8)
- [CVE-2020-7618](https://insights.sbomify.com/CVE-2020-7618/): Prototype Pollution in sds (medium 5.3)
- [CVE-2020-7617](https://insights.sbomify.com/CVE-2020-7617/): Prototype Pollution (medium 4.4)
- [CVE-2020-7616](https://insights.sbomify.com/CVE-2020-7616/): Improperly Controlled Modification of Dynamically-Determined Object Attributes in express-mock-middleware (medium 5.3)
- [CVE-2020-7615](https://insights.sbomify.com/CVE-2020-7615/): OS Command Injection in fsa (high 7.8)
- [CVE-2020-7614](https://insights.sbomify.com/CVE-2020-7614/): Command Injection in npm-programmatic (critical 9.8)
- [CVE-2020-7613](https://insights.sbomify.com/CVE-2020-7613/): Clamscan vulnerable to command injection (high 8.1)
- [CVE-2020-7611](https://insights.sbomify.com/CVE-2020-7611/): Micronaut's HTTP client is vulnerable to HTTP Request Header Injection (critical 9.8)
- [CVE-2020-7610](https://insights.sbomify.com/CVE-2020-7610/): Deserialization of Untrusted Data in bson (critical 9.8)
- [CVE-2020-7609](https://insights.sbomify.com/CVE-2020-7609/): Code Injection in node-rules (critical 9.8)
- [CVE-2020-7608](https://insights.sbomify.com/CVE-2020-7608/): yargs-parser Vulnerable to Prototype Pollution (medium 5.3)
- [CVE-2020-7607](https://insights.sbomify.com/CVE-2020-7607/): OS Command Injection in gulkp-styledocco (critical 9.8)
- [CVE-2020-7606](https://insights.sbomify.com/CVE-2020-7606/): OS Command Injection in docker-compose-remote-api (critical 9.8)
- [CVE-2020-7605](https://insights.sbomify.com/CVE-2020-7605/): OS Command Injection in gulp-tape (critical 9.8)
- [CVE-2020-7604](https://insights.sbomify.com/CVE-2020-7604/): OS Command Injection in pulverizr (critical 9.8)
- [CVE-2020-7603](https://insights.sbomify.com/CVE-2020-7603/): OS Command Injection in closure-compiler-stream (critical 9.8)
- [CVE-2020-7602](https://insights.sbomify.com/CVE-2020-7602/): OS Command Injection in node-prompt-here (critical 9.8)
- [CVE-2020-7601](https://insights.sbomify.com/CVE-2020-7601/): OS Command Injection in gulp-scss-lint (critical 9.8)
- [CVE-2020-7600](https://insights.sbomify.com/CVE-2020-7600/): Improperly Controlled Modification of Dynamically-Determined Object Attributes in querymen (medium 5.3)
- [CVE-2020-7599](https://insights.sbomify.com/CVE-2020-7599/): Exposure of Sensitive Information in Gradle publish plugin (medium 6.5)
- [CVE-2020-7598](https://insights.sbomify.com/CVE-2020-7598/): Prototype Pollution in minimist (medium 5.6)
- [CVE-2020-7597](https://insights.sbomify.com/CVE-2020-7597/): codecov NPM module allows remote attackers to execute arbitrary commands (high 8.8)
- [CVE-2020-7596](https://insights.sbomify.com/CVE-2020-7596/): Improper Neutralization of Special Elements in Output Used by a Downstream Component in Codecov (high 8.8)
- [CVE-2020-7595](https://insights.sbomify.com/CVE-2020-7595/): libxml as used in Nokogiri has an infinite loop in a certain end-of-file situation (high 7.5)
- [CVE-2020-7594](https://insights.sbomify.com/CVE-2020-7594/): Command injection in multitech:conduit mtcdt-lvw2-246a firmware (high 7.2)
- [CVE-2020-7593](https://insights.sbomify.com/CVE-2020-7593/): Memory corruption in LOGO! 8 BM (incl. SIPLUS variants) (critical 9.8)
- [CVE-2020-7592](https://insights.sbomify.com/CVE-2020-7592/): Information disclosure in SIMATIC HMI Basic Panels 1st Generation (incl. SIPLUS variants) (medium 6.5)
- [CVE-2020-7591](https://insights.sbomify.com/CVE-2020-7591/): Auth bypass in SIPORT MP (high 8.8)
- [CVE-2020-7590](https://insights.sbomify.com/CVE-2020-7590/): Hardcoded credentials in DCA Vantage Analyzer (medium 6.8)
- [CVE-2020-7589](https://insights.sbomify.com/CVE-2020-7589/): Missing authorization in LOGO! 8 BM (incl. SIPLUS variants) (critical 9.1)
- [CVE-2020-7588](https://insights.sbomify.com/CVE-2020-7588/): Denial of service in Opcenter Execution Discrete (medium 5.3)
- [CVE-2020-7587](https://insights.sbomify.com/CVE-2020-7587/): Denial of service in Opcenter Execution Discrete (high 8.2)
- [CVE-2020-7586](https://insights.sbomify.com/CVE-2020-7586/): Memory corruption in SIMATIC PCS 7 V8.2 and earlier (high 7.8)
- [CVE-2020-7585](https://insights.sbomify.com/CVE-2020-7585/): Privilege escalation in SIMATIC PCS 7 V8.2 and earlier (high 7.8)
- [CVE-2020-7584](https://insights.sbomify.com/CVE-2020-7584/): Denial of service in SIMATIC S7-200 SMART CPU family (high 7.5)
- [CVE-2020-7583](https://insights.sbomify.com/CVE-2020-7583/): Missing authorization in Automation License Manager 5 (high 7.8)
- [CVE-2020-7581](https://insights.sbomify.com/CVE-2020-7581/): Privilege escalation in Opcenter Execution Discrete (medium 6.7)
- [CVE-2020-7580](https://insights.sbomify.com/CVE-2020-7580/): Privilege escalation in SIMATIC Automation Tool (medium 6.7)
- [CVE-2020-7579](https://insights.sbomify.com/CVE-2020-7579/): Cross-site scripting in Spectrum Power™ 5 (medium 6.1)
- [CVE-2020-7578](https://insights.sbomify.com/CVE-2020-7578/): Privilege escalation in Camstar Enterprise Platform (high 8.1)
- [CVE-2020-7577](https://insights.sbomify.com/CVE-2020-7577/): SQL injection in Camstar Enterprise Platform (high 8.1)
- [CVE-2020-7576](https://insights.sbomify.com/CVE-2020-7576/): Cross-site scripting in Camstar Enterprise Platform (medium 5.4)
- [CVE-2020-7575](https://insights.sbomify.com/CVE-2020-7575/): Cross-site scripting in Climatix POL908 (BACnet/IP module) (medium 6.1)
- [CVE-2020-7574](https://insights.sbomify.com/CVE-2020-7574/): Cross-site scripting in Climatix POL908 (BACnet/IP module) (medium 6.1)
- [CVE-2020-7573](https://insights.sbomify.com/CVE-2020-7573/): Missing authorization in EcoStruxure Building Operation WebReports V1.9 - V3.1 (medium 6.5)
- [CVE-2020-7572](https://insights.sbomify.com/CVE-2020-7572/): XML external entity in EcoStruxure Building Operation WebReports V1.9 - V3.1 (high 8.8)
- [CVE-2020-7571](https://insights.sbomify.com/CVE-2020-7571/): Cross-site scripting in EcoStruxure Building Operation WebReports V1.9 - V3.1 (medium 5.4)
- [CVE-2020-7570](https://insights.sbomify.com/CVE-2020-7570/): Cross-site scripting in EcoStruxure Building Operation WebReports V1.9 - V3.1 (medium 5.4)
- [CVE-2020-7569](https://insights.sbomify.com/CVE-2020-7569/): File upload in EcoStruxure Building Operation WebReports V1.9 - V3.1 (high 8.8)
- [CVE-2020-7568](https://insights.sbomify.com/CVE-2020-7568/): Information disclosure in Modicon M221, all references, all versions (low 3.1)
- [CVE-2020-7567](https://insights.sbomify.com/CVE-2020-7567/): Weak cryptography in Modicon M221, all references, all versions (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/38/