# Vulnerabilities published in 2020


- [CVE-2020-7284](https://insights.sbomify.com/CVE-2020-7284/): Network Security Management (NSM) - Exposure of Sensitive Information (high 8.6)
- [CVE-2020-7283](https://insights.sbomify.com/CVE-2020-7283/): Privilege Escalation vulnerability in McAfee Total Protection (MTP) (high 7.5)
- [CVE-2020-7282](https://insights.sbomify.com/CVE-2020-7282/): Privilege Escalation vulnerability in McAfee Total Protection (MTP) (high 7.5)
- [CVE-2020-7281](https://insights.sbomify.com/CVE-2020-7281/): Privilege Escalation vulnerability in McAfee Total Protection (MTP) (high 7.5)
- [CVE-2020-7280](https://insights.sbomify.com/CVE-2020-7280/): Symbolic Link vulnerability during DAT update (high 7.8)
- [CVE-2020-7279](https://insights.sbomify.com/CVE-2020-7279/): DLL search order hijacking in Host IPS (medium 4.6)
- [CVE-2020-7278](https://insights.sbomify.com/CVE-2020-7278/): McAfee firewall rules not enforced correctly (high 7.4)
- [CVE-2020-7277](https://insights.sbomify.com/CVE-2020-7277/): McAfee processes not protected (medium 6.8)
- [CVE-2020-7276](https://insights.sbomify.com/CVE-2020-7276/): Unrestricted Policy Management using MfeUpgradeTool.exe (medium 6.4)
- [CVE-2020-7275](https://insights.sbomify.com/CVE-2020-7275/): Unquoted service paths for some McAfee ENS files (medium 4.8)
- [CVE-2020-7274](https://insights.sbomify.com/CVE-2020-7274/): ENS elevated permissions vulnerability (medium 6.6)
- [CVE-2020-7273](https://insights.sbomify.com/CVE-2020-7273/): Autorun registry bypass (medium 6.7)
- [CVE-2020-7270](https://insights.sbomify.com/CVE-2020-7270/): Sensitive Information Exposure in McAfee ATD (medium 4.9)
- [CVE-2020-7269](https://insights.sbomify.com/CVE-2020-7269/): Sensitive Information Exposure in McAfee ATD (medium 4.9)
- [CVE-2020-7268](https://insights.sbomify.com/CVE-2020-7268/): McAfee Email Gateway (MEG) - Path Traversal vulnerability (medium 4.3)
- [CVE-2020-7267](https://insights.sbomify.com/CVE-2020-7267/): Privilege Escalation vulnerability through symbolic links in VSEL (high 8.8)
- [CVE-2020-7266](https://insights.sbomify.com/CVE-2020-7266/): Privilege Escalation vulnerability through symbolic links in VSE for Windows (high 8.8)
- [CVE-2020-7265](https://insights.sbomify.com/CVE-2020-7265/): Privilege Escalation vulnerability through symbolic links in ENSM (high 8.8)
- [CVE-2020-7264](https://insights.sbomify.com/CVE-2020-7264/): Privilege Escalation vulnerability through symbolic links in ENS for Windows (high 8.8)
- [CVE-2020-7263](https://insights.sbomify.com/CVE-2020-7263/): ENS configuration can be edited by attacker with local administrator permissions (medium 6.5)
- [CVE-2020-7262](https://insights.sbomify.com/CVE-2020-7262/): Improper Access Control vulnerability in ATD (medium 5.3)
- [CVE-2020-7261](https://insights.sbomify.com/CVE-2020-7261/): Buffer overwrite in ENS allowed to bypass AMSI protection (medium 6.1)
- [CVE-2020-7260](https://insights.sbomify.com/CVE-2020-7260/): MACC installer DLL side loading (high 7.3)
- [CVE-2020-7259](https://insights.sbomify.com/CVE-2020-7259/): Unsigned executable vulnerability in ENS can be used to bypass intended self-protection rules (medium 6.6)
- [CVE-2020-7258](https://insights.sbomify.com/CVE-2020-7258/): Network Security Management (NSM) - Cross site scripting vulnerability (medium 4.8)
- [CVE-2020-7257](https://insights.sbomify.com/CVE-2020-7257/): Privilege Escalation vulnerability through Symbolic links in ENS (high 8.4)
- [CVE-2020-7256](https://insights.sbomify.com/CVE-2020-7256/): Network Security Management (NSM) - Cross site scripting vulnerability (medium 4.8)
- [CVE-2020-7255](https://insights.sbomify.com/CVE-2020-7255/): Privilege Escalation vulnerability in ENS (low 3.9)
- [CVE-2020-7254](https://insights.sbomify.com/CVE-2020-7254/): Privilege escalation in Advanced Threat Defense (high 7.7)
- [CVE-2020-7253](https://insights.sbomify.com/CVE-2020-7253/): Improper access control vulnerability in McAfee Agent (medium 5.7)
- [CVE-2020-7252](https://insights.sbomify.com/CVE-2020-7252/): Unquoted service executable path (medium 4.2)
- [CVE-2020-7251](https://insights.sbomify.com/CVE-2020-7251/): ESConfig Tool able to edit configuration for newer version (medium 5.0)
- [CVE-2020-7250](https://insights.sbomify.com/CVE-2020-7250/): ENS symbolic link log file manipulation vulnerability (high 8.2)
- [CVE-2020-7249](https://insights.sbomify.com/CVE-2020-7249/): Cross-site scripting in smc:d3g0804 firmware (medium 4.8)
- [CVE-2020-7248](https://insights.sbomify.com/CVE-2020-7248/): Memory corruption in openwrt:openwrt (high 7.5)
- [CVE-2020-7247](https://insights.sbomify.com/CVE-2020-7247/): OpenSMTPD Remote Code Execution (critical 9.8, exploited in the wild)
- [CVE-2020-7246](https://insights.sbomify.com/CVE-2020-7246/): File upload in qdpm:qdpm (high 8.8)
- [CVE-2020-7245](https://insights.sbomify.com/CVE-2020-7245/): Business logic in ctfd:ctfd (critical 9.8)
- [CVE-2020-7244](https://insights.sbomify.com/CVE-2020-7244/): Command injection in comtech:stampede fx-1010 firmware (high 7.2)
- [CVE-2020-7243](https://insights.sbomify.com/CVE-2020-7243/): Command injection in comtech:stampede fx-1010 firmware (high 7.2)
- [CVE-2020-7242](https://insights.sbomify.com/CVE-2020-7242/): Command injection in comtech:stampede fx-1010 firmware (high 7.2)
- [CVE-2020-7241](https://insights.sbomify.com/CVE-2020-7241/): Information disclosure in wpseeds:wp database backup (high 7.5)
- [CVE-2020-7240](https://insights.sbomify.com/CVE-2020-7240/): Command injection in meinbergglobal:lantime m1000 firmware (high 8.8)
- [CVE-2020-7239](https://insights.sbomify.com/CVE-2020-7239/): Cross-site scripting in ibm:chatbot with ibm watson (medium 6.1)
- [CVE-2020-7238](https://insights.sbomify.com/CVE-2020-7238/): HTTP Request Smuggling in Netty (high 7.5)
- [CVE-2020-7237](https://insights.sbomify.com/CVE-2020-7237/): Command injection in cacti:cacti (high 8.8)
- [CVE-2020-7236](https://insights.sbomify.com/CVE-2020-7236/): Cross-site scripting in uhp:uhp-100 firmware (medium 6.1)
- [CVE-2020-7235](https://insights.sbomify.com/CVE-2020-7235/): Cross-site scripting in uhp:uhp-100 firmware (medium 6.1)
- [CVE-2020-7234](https://insights.sbomify.com/CVE-2020-7234/): Cross-site scripting in ruckuswireless:r310 firmware (medium 4.8)
- [CVE-2020-7233](https://insights.sbomify.com/CVE-2020-7233/): Hardcoded credentials in kmccontrols:bac-a1616bc firmware (critical 9.8)
- [CVE-2020-7232](https://insights.sbomify.com/CVE-2020-7232/): Information disclosure in evoko:home (high 7.5)
- [CVE-2020-7231](https://insights.sbomify.com/CVE-2020-7231/): Information disclosure in evoko:home (medium 5.3)
- [CVE-2020-7229](https://insights.sbomify.com/CVE-2020-7229/): SQL injection in simplejobscript:simplejobscript (critical 9.8)
- [CVE-2020-7228](https://insights.sbomify.com/CVE-2020-7228/): Cross-site scripting in codepeople:calculated fields form (medium 5.4)
- [CVE-2020-7227](https://insights.sbomify.com/CVE-2020-7227/): Information disclosure in westermo:mrd-315 firmware (medium 6.5)
- [CVE-2020-7226](https://insights.sbomify.com/CVE-2020-7226/): Denial of Service in Cryptacular (high 7.5)
- [CVE-2020-7224](https://insights.sbomify.com/CVE-2020-7224/): Security feature bypass in aviatrix:openvpn (critical 9.8)
- [CVE-2020-7222](https://insights.sbomify.com/CVE-2020-7222/): Auth bypass in amcrest:web server (medium 5.3)
- [CVE-2020-7221](https://insights.sbomify.com/CVE-2020-7221/): Privilege escalation in mariadb:mariadb (high 7.8)
- [CVE-2020-7220](https://insights.sbomify.com/CVE-2020-7220/): Improper Resource Shutdown or Release in HashiCorp Vault (high 7.5)
- [CVE-2020-7219](https://insights.sbomify.com/CVE-2020-7219/): Denial of Service (DoS) in HashiCorp Consul (high 7.5)
- [CVE-2020-7218](https://insights.sbomify.com/CVE-2020-7218/): Allocation of Resources Without Limits or Throttling in HashiCorp Nomad (high 7.5)
- [CVE-2020-7217](https://insights.sbomify.com/CVE-2020-7217/): Denial of service in opensuse:wicked (high 7.5)
- [CVE-2020-7216](https://insights.sbomify.com/CVE-2020-7216/): Denial of service in opensuse:leap (high 7.5)
- [CVE-2020-7215](https://insights.sbomify.com/CVE-2020-7215/): Information disclosure in gallagher:command centre (medium 5.5)
- [CVE-2020-7213](https://insights.sbomify.com/CVE-2020-7213/): Weak cryptography in parallels:parallels (high 7.5)
- [CVE-2020-7212](https://insights.sbomify.com/CVE-2020-7212/): Uncontrolled Resource Consumption in urllib3 (high 7.5)
- [CVE-2020-7211](https://insights.sbomify.com/CVE-2020-7211/): Path traversal in libslirp project:libslirp (high 7.5)
- [CVE-2020-7210](https://insights.sbomify.com/CVE-2020-7210/): Umbraco CMS vulnerable to CSRF (medium 4.3)
- [CVE-2020-7209](https://insights.sbomify.com/CVE-2020-7209/): Other in LinuxKI (critical 9.8)
- [CVE-2020-7208](https://insights.sbomify.com/CVE-2020-7208/): Cross-site scripting in LinuxKI (medium 6.1)
- [CVE-2020-7207](https://insights.sbomify.com/CVE-2020-7207/): Privilege escalation in HPE ProLiant BL460c Gen10 Server Blade; HPE ProLiant DL360 Gen10 Server; HPE ProLiant DL380 Gen10 Server; HPE ProLiant DL560 Gen10 Server; HPE ProLiant DL580 Gen10 Server; HPE ProLiant ML110 Gen10 Server; HPE ProLiant XL230k Gen10 Server; HPE Synergy 480 Gen10 Compute Module; HPE Synergy 660 Gen10 Compute Module; HPE ProLiant DL180 Gen10 Server; HPE ProLiant DL160 Gen10 Server; HPE ProLiant DL120 Gen10 Server; HPE ProLiant XL190r Gen10 Server; HPE ProLiant ML350 Gen10 Server; HPE ProLiant XL170r Gen10 Server; HPE Apollo 2000 System; HPE Apollo 4500 System; HPE ProLiant XL270d Gen10 Server; HPE Apollo 4200 Gen10 Server; HPE ProLiant e910 Server Blade; HPE ProLiant XL450 Gen10 Server; HPE ProLiant XL230k Gen10 Server - bad oid (medium 6.8)
- [CVE-2020-7206](https://insights.sbomify.com/CVE-2020-7206/): Code injection in nagios-plugins-ilo (critical 9.8)
- [CVE-2020-7205](https://insights.sbomify.com/CVE-2020-7205/): Security feature bypass in HP Intelligent Provisioning (medium 6.7)
- [CVE-2020-7203](https://insights.sbomify.com/CVE-2020-7203/): Other in iLO Amplifier Pack (critical 9.8)
- [CVE-2020-7202](https://insights.sbomify.com/CVE-2020-7202/): Information disclosure in HPE ProLiant Servers, Apollo Products, Converged Systems, and Synergy Compute Modules with Integrated Lights-Out 5 (iLO 5), or Integrated Lights-Out 4 (iLO 4) (medium 5.3)
- [CVE-2020-7201](https://insights.sbomify.com/CVE-2020-7201/): Cross-site request forgery in HPE StoreEver MSL Tape Libraries; HPE StoreEver 1/8 G2 Tape Autoloaders (high 8.8)
- [CVE-2020-7200](https://insights.sbomify.com/CVE-2020-7200/): Other in HPE Systems Insight Manager (SIM) (critical 9.8)
- [CVE-2020-7199](https://insights.sbomify.com/CVE-2020-7199/): Auth bypass in HPE Edgeline Infrastructure Management Software (critical 9.8)
- [CVE-2020-7198](https://insights.sbomify.com/CVE-2020-7198/): Privilege escalation in HP OneView; HPE Synergy Composer; HPE Synergy Composer 2 (high 8.8)
- [CVE-2020-7197](https://insights.sbomify.com/CVE-2020-7197/): Auth bypass in HPE 3PAR StoreServ Management and Core Software Media (critical 9.8)
- [CVE-2020-7196](https://insights.sbomify.com/CVE-2020-7196/): Information disclosure in BlueData EPIC Software; HPE Ezmeral Container Platform (medium 6.5)
- [CVE-2020-7195](https://insights.sbomify.com/CVE-2020-7195/): Code injection in HPE Intelligent Management Center (iMC) (high 8.8)
- [CVE-2020-7194](https://insights.sbomify.com/CVE-2020-7194/): Code injection in HPE Intelligent Management Center (iMC) (high 8.8)
- [CVE-2020-7193](https://insights.sbomify.com/CVE-2020-7193/): Code injection in HPE Intelligent Management Center (iMC) (high 8.8)
- [CVE-2020-7192](https://insights.sbomify.com/CVE-2020-7192/): Code injection in HPE Intelligent Management Center (iMC) (high 8.8)
- [CVE-2020-7191](https://insights.sbomify.com/CVE-2020-7191/): Code injection in HPE Intelligent Management Center (iMC) (high 8.8)
- [CVE-2020-7190](https://insights.sbomify.com/CVE-2020-7190/): Code injection in HPE Intelligent Management Center (iMC) (high 8.8)
- [CVE-2020-7189](https://insights.sbomify.com/CVE-2020-7189/): Code injection in HPE Intelligent Management Center (iMC) (high 8.8)
- [CVE-2020-7188](https://insights.sbomify.com/CVE-2020-7188/): Code injection in HPE Intelligent Management Center (iMC) (high 8.8)
- [CVE-2020-7187](https://insights.sbomify.com/CVE-2020-7187/): Code injection in HPE Intelligent Management Center (iMC) (high 8.8)
- [CVE-2020-7186](https://insights.sbomify.com/CVE-2020-7186/): Code injection in HPE Intelligent Management Center (iMC) (high 8.8)
- [CVE-2020-7185](https://insights.sbomify.com/CVE-2020-7185/): Code injection in HPE Intelligent Management Center (iMC) (high 8.8)
- [CVE-2020-7184](https://insights.sbomify.com/CVE-2020-7184/): Code injection in HPE Intelligent Management Center (iMC) (high 8.8)
- [CVE-2020-7183](https://insights.sbomify.com/CVE-2020-7183/): Code injection in HPE Intelligent Management Center (iMC) (high 8.8)
- [CVE-2020-7182](https://insights.sbomify.com/CVE-2020-7182/): Code injection in HPE Intelligent Management Center (iMC) (high 8.8)
- [CVE-2020-7181](https://insights.sbomify.com/CVE-2020-7181/): Code injection in HPE Intelligent Management Center (iMC) (high 8.8)
- [CVE-2020-7180](https://insights.sbomify.com/CVE-2020-7180/): Code injection in HPE Intelligent Management Center (iMC) (high 8.8)
- [CVE-2020-7179](https://insights.sbomify.com/CVE-2020-7179/): Code injection in HPE Intelligent Management Center (iMC) (high 8.8)
- [CVE-2020-7178](https://insights.sbomify.com/CVE-2020-7178/): Code injection in HPE Intelligent Management Center (iMC) (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/41/