# Vulnerabilities published in 2020


- [CVE-2020-7049](https://insights.sbomify.com/CVE-2020-7049/): Code injection in nozominetworks:guardian (high 7.3)
- [CVE-2020-7048](https://insights.sbomify.com/CVE-2020-7048/): Missing authorization in webfactoryltd:wp database reset (critical 9.1)
- [CVE-2020-7047](https://insights.sbomify.com/CVE-2020-7047/): Privilege escalation in webfactoryltd:wp database reset (critical 9.9)
- [CVE-2020-7046](https://insights.sbomify.com/CVE-2020-7046/): Denial of service in dovecot:dovecot (high 7.5)
- [CVE-2020-7045](https://insights.sbomify.com/CVE-2020-7045/): Null dereference in debian:debian linux (medium 6.5)
- [CVE-2020-7044](https://insights.sbomify.com/CVE-2020-7044/): Memory corruption in fedoraproject:fedora (high 7.5)
- [CVE-2020-7043](https://insights.sbomify.com/CVE-2020-7043/): Security feature bypass in fedoraproject:fedora (critical 9.1)
- [CVE-2020-7042](https://insights.sbomify.com/CVE-2020-7042/): Security feature bypass in fedoraproject:fedora (medium 5.3)
- [CVE-2020-7041](https://insights.sbomify.com/CVE-2020-7041/): Security feature bypass in fedoraproject:fedora (medium 5.3)
- [CVE-2020-7040](https://insights.sbomify.com/CVE-2020-7040/): Race condition in canonical:ubuntu linux (high 8.1)
- [CVE-2020-7039](https://insights.sbomify.com/CVE-2020-7039/): Memory corruption in debian:debian linux (medium 5.6)
- [CVE-2020-7038](https://insights.sbomify.com/CVE-2020-7038/): Avaya Meetings Server Information Disclosure vulnerability (high 7.5)
- [CVE-2020-7037](https://insights.sbomify.com/CVE-2020-7037/): Avaya Equinox Conferencing XXE vulnerability (high 8.1)
- [CVE-2020-7036](https://insights.sbomify.com/CVE-2020-7036/): XXE in Avaya Callback Assist Administration (high 8.1)
- [CVE-2020-7035](https://insights.sbomify.com/CVE-2020-7035/): XXE in Avaya Aura Orchestration Designer (high 8.1)
- [CVE-2020-7034](https://insights.sbomify.com/CVE-2020-7034/): Command injection in Avaya Session Border Controller for Enterprise (high 7.2)
- [CVE-2020-7033](https://insights.sbomify.com/CVE-2020-7033/): Avaya Equinox Conferencing XSS (medium 6.3)
- [CVE-2020-7032](https://insights.sbomify.com/CVE-2020-7032/): Avaya WebLM Improper Restriction of XML External Entity Reference (medium 6.5)
- [CVE-2020-7030](https://insights.sbomify.com/CVE-2020-7030/): IPO Information Disclosure (medium 5.5)
- [CVE-2020-7029](https://insights.sbomify.com/CVE-2020-7029/): Avaya Product System Management Interface Cross-Site Request Forgery Vulnerability (medium 6.4)
- [CVE-2020-7021](https://insights.sbomify.com/CVE-2020-7021/): Insertion of Sensitive Information into Log File in Elasticsearch (medium 4.9)
- [CVE-2020-7020](https://insights.sbomify.com/CVE-2020-7020/): Privilege Context Switching Error in Elasticsearch (low 3.1)
- [CVE-2020-7019](https://insights.sbomify.com/CVE-2020-7019/): Improper privilege management in elasticsearch (medium 6.5)
- [CVE-2020-7018](https://insights.sbomify.com/CVE-2020-7018/): Privilege escalation in Elastic Enterprise Search (high 8.8)
- [CVE-2020-7017](https://insights.sbomify.com/CVE-2020-7017/): Cross-site scripting in Kibana (medium 6.7)
- [CVE-2020-7016](https://insights.sbomify.com/CVE-2020-7016/): Denial of service in Kibana (medium 4.8)
- [CVE-2020-7015](https://insights.sbomify.com/CVE-2020-7015/): Cross-site scripting in Kibana (medium 5.4)
- [CVE-2020-7014](https://insights.sbomify.com/CVE-2020-7014/): Privilege Escalation Flaw in Elasticsearch (high 8.8)
- [CVE-2020-7013](https://insights.sbomify.com/CVE-2020-7013/): Code injection in Kibana (high 7.2)
- [CVE-2020-7012](https://insights.sbomify.com/CVE-2020-7012/): Code injection in Kibana (high 8.8)
- [CVE-2020-7011](https://insights.sbomify.com/CVE-2020-7011/): Cross-site scripting in Elastic App Search (medium 6.1)
- [CVE-2020-7010](https://insights.sbomify.com/CVE-2020-7010/): Cryptographic Issues in ECK (high 7.5)
- [CVE-2020-7009](https://insights.sbomify.com/CVE-2020-7009/): Improper Privilege Management in Elasticsearch (high 8.8)
- [CVE-2020-7008](https://insights.sbomify.com/CVE-2020-7008/): Path traversal in VBASE Editor (high 7.5)
- [CVE-2020-7007](https://insights.sbomify.com/CVE-2020-7007/): Memory corruption in Moxa EDS-G516E Series firmware, Version 5.2 or lower (critical 9.8)
- [CVE-2020-7006](https://insights.sbomify.com/CVE-2020-7006/): Cross-site scripting in Systech Corporation NDS-5000 Terminal Server (high 8.4)
- [CVE-2020-7005](https://insights.sbomify.com/CVE-2020-7005/): Cross-site request forgery in Honeywell WIN-PAK 4.7.2, Web and prior versions (high 8.8)
- [CVE-2020-7004](https://insights.sbomify.com/CVE-2020-7004/): Misconfiguration in VBASE Editor (high 8.8)
- [CVE-2020-7003](https://insights.sbomify.com/CVE-2020-7003/): Information disclosure in Moxa ioLogik 2500 series firmware, Version 3.0 or lower, IOxpress configuration utility, Version 2.3.0 or lower (high 7.5)
- [CVE-2020-7002](https://insights.sbomify.com/CVE-2020-7002/): Memory corruption in Delta Industrial Automation CNCSoft ScreenEditor (high 7.8)
- [CVE-2020-7001](https://insights.sbomify.com/CVE-2020-7001/): Weak cryptography in Moxa EDS-G516E Series firmware, Version 5.2 or lower (high 7.5)
- [CVE-2020-7000](https://insights.sbomify.com/CVE-2020-7000/): Information disclosure in VBASE Editor (high 7.5)
- [CVE-2020-6999](https://insights.sbomify.com/CVE-2020-6999/): Memory corruption in Moxa EDS-G516E Series firmware, Version 5.2 or lower (medium 6.5)
- [CVE-2020-6998](https://insights.sbomify.com/CVE-2020-6998/): Rockwell Automation CompactLogix 5370 and ControlLogix 5570 Controllers Improper Input Validation (medium 5.8)
- [CVE-2020-6997](https://insights.sbomify.com/CVE-2020-6997/): Information disclosure in Moxa EDS-G516E Series firmware, Version 5.2 or lower (high 7.5)
- [CVE-2020-6996](https://insights.sbomify.com/CVE-2020-6996/): Memory corruption in Triangle MicroWorks DNP3 Outstation LibrariesDNP3 Outstation .NET Protocol components and DNP3 Outstation ANSI C source code libraries are affected:3.16.00 through 3.25.01 (critical 9.8)
- [CVE-2020-6995](https://insights.sbomify.com/CVE-2020-6995/): Weak cryptography in Moxa PT-7528 series firmware, Version 4.0 or lower, PT-7828 series firmware, Version 3.9 or lower (critical 9.8)
- [CVE-2020-6994](https://insights.sbomify.com/CVE-2020-6994/): Memory corruption in HiOS for the following devices RSP, RSPE, RSPS, RSPL, MSP, EES, EES, EESX, GRS, OS, RED (critical 9.8)
- [CVE-2020-6993](https://insights.sbomify.com/CVE-2020-6993/): Information disclosure in Moxa PT-7528 series firmware, Version 4.0 or lower, PT-7828 series firmware, Version 3.9 or lower (high 7.5)
- [CVE-2020-6992](https://insights.sbomify.com/CVE-2020-6992/): Privilege escalation in GE Digital CIMPLICITY (medium 6.7)
- [CVE-2020-6991](https://insights.sbomify.com/CVE-2020-6991/): Weak cryptography in Moxa EDS-G516E Series firmware, Version 5.2 or lower (critical 9.8)
- [CVE-2020-6990](https://insights.sbomify.com/CVE-2020-6990/): Hardcoded credentials in Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001 and prior (critical 9.8)
- [CVE-2020-6989](https://insights.sbomify.com/CVE-2020-6989/): Memory corruption in Moxa PT-7528 series firmware, Version 4.0 or lower, PT-7828 series firmware, Version 3.9 or lower (critical 9.8)
- [CVE-2020-6988](https://insights.sbomify.com/CVE-2020-6988/): Auth bypass in Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001 and prior (high 7.5)
- [CVE-2020-6987](https://insights.sbomify.com/CVE-2020-6987/): Weak cryptography in Moxa PT-7528 series firmware, Version 4.0 or lower, PT-7828 series firmware, Version 3.9 or lower (high 7.5)
- [CVE-2020-6986](https://insights.sbomify.com/CVE-2020-6986/): Denial of service in Omron PLC CJ Series (high 7.5)
- [CVE-2020-6985](https://insights.sbomify.com/CVE-2020-6985/): Hardcoded credentials in Moxa PT-7528 series firmware, Version 4.0 or lower, PT-7828 series firmware, Version 3.9 or lower (critical 9.8)
- [CVE-2020-6984](https://insights.sbomify.com/CVE-2020-6984/): Weak cryptography in Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001 and prior (critical 9.8)
- [CVE-2020-6983](https://insights.sbomify.com/CVE-2020-6983/): Hardcoded credentials in Moxa PT-7528 series firmware, Version 4.0 or lower, PT-7828 series firmware, Version 3.9 or lower (high 7.5)
- [CVE-2020-6982](https://insights.sbomify.com/CVE-2020-6982/): Code injection in Honeywell WIN-PAK 4.7.2, Web and prior versions (high 8.8)
- [CVE-2020-6981](https://insights.sbomify.com/CVE-2020-6981/): Hardcoded credentials in Moxa EDS-G516E Series firmware, Version 5.2 or lower (critical 9.8)
- [CVE-2020-6980](https://insights.sbomify.com/CVE-2020-6980/): Information disclosure in Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001 and prior (low 3.3)
- [CVE-2020-6979](https://insights.sbomify.com/CVE-2020-6979/): Hardcoded credentials in Moxa EDS-G516E Series firmware, Version 5.2 or lower (high 7.5)
- [CVE-2020-6978](https://insights.sbomify.com/CVE-2020-6978/): Supply chain in Honeywell WIN-PAK 4.7.2, Web and prior versions (high 7.2)
- [CVE-2020-6977](https://insights.sbomify.com/CVE-2020-6977/): Security feature bypass in GE Ultrasound Products (medium 6.8)
- [CVE-2020-6976](https://insights.sbomify.com/CVE-2020-6976/): Memory corruption in Delta Industrial Automation CNCSoft ScreenEditor (medium 5.5)
- [CVE-2020-6975](https://insights.sbomify.com/CVE-2020-6975/): File upload in Digi International ConnectPort LTS 32 MEI (medium 4.9)
- [CVE-2020-6974](https://insights.sbomify.com/CVE-2020-6974/): Path traversal in Honeywell Notifier Web Server (NWS) (critical 9.8)
- [CVE-2020-6973](https://insights.sbomify.com/CVE-2020-6973/): Cross-site scripting in Digi International ConnectPort LTS 32 MEI (medium 6.2)
- [CVE-2020-6972](https://insights.sbomify.com/CVE-2020-6972/): Auth bypass in Notifier Web Server (NWS) Version 3.50 and earlier (critical 9.1)
- [CVE-2020-6971](https://insights.sbomify.com/CVE-2020-6971/): Privilege escalation in Emerson ValveLink (high 7.8)
- [CVE-2020-6970](https://insights.sbomify.com/CVE-2020-6970/): Memory corruption in OpenEnterprise (critical 9.8)
- [CVE-2020-6969](https://insights.sbomify.com/CVE-2020-6969/): Information disclosure in C-More Touch Panels EA9 series (critical 9.8)
- [CVE-2020-6968](https://insights.sbomify.com/CVE-2020-6968/): Privilege escalation in INNCOM INNControl 3 (high 7.8)
- [CVE-2020-6967](https://insights.sbomify.com/CVE-2020-6967/): Deserialization in Rockwell Automation All versions of FactoryTalk Diagnostics software, a subsystem of the FactoryTalk Services Platform (critical 9.8)
- [CVE-2020-6966](https://insights.sbomify.com/CVE-2020-6966/): Weak cryptography in GE CARESCAPE Telemetry Server,ApexPro Telemetry Server,CARESCAPE Central Station,Clinical Information Center systems,CARESCAPE B450,B650,B850 Monitors (critical 10.0)
- [CVE-2020-6965](https://insights.sbomify.com/CVE-2020-6965/): File upload in GE CARESCAPE Telemetry Server,ApexPro Telemetry Server,CARESCAPE Central Station,Clinical Information Center systems,CARESCAPE B450,B650,B850 Monitors (critical 9.9)
- [CVE-2020-6964](https://insights.sbomify.com/CVE-2020-6964/): Auth bypass in GE CARESCAPE Telemetry Server,ApexPro Telemetry Server,CARESCAPE Central Station,Clinical Information Center systems,CARESCAPE B450,B650,B850 Monitors (high 8.6)
- [CVE-2020-6963](https://insights.sbomify.com/CVE-2020-6963/): Hardcoded credentials in GE CARESCAPE Telemetry Server,ApexPro Telemetry Server,CARESCAPE Central Station,Clinical Information Center systems,CARESCAPE B450,B650,B850 Monitors (critical 10.0)
- [CVE-2020-6962](https://insights.sbomify.com/CVE-2020-6962/): Code injection in GE CARESCAPE Telemetry Server,ApexPro Telemetry Server,CARESCAPE Central Station,Clinical Information Center,CARESCAPE B450,B650,B850 Monitors (critical 10.0)
- [CVE-2020-6961](https://insights.sbomify.com/CVE-2020-6961/): Information disclosure in GE CARESCAPE Telemetry Server,ApexPro Telemetry Server,CARESCAPE Central Station,Clinical Information Center,CARESCAPE B450,B650,B850 Monitors (critical 10.0)
- [CVE-2020-6960](https://insights.sbomify.com/CVE-2020-6960/): SQL injection in Honeywell Maxpro VMS & NVR (critical 9.8)
- [CVE-2020-6959](https://insights.sbomify.com/CVE-2020-6959/): Deserialization in Honeywell Maxpro VMS & NVR (critical 9.8)
- [CVE-2020-6958](https://insights.sbomify.com/CVE-2020-6958/): XML external entity in yet another java service wrapper project:yet another java service wrapper (critical 9.1)
- [CVE-2020-6956](https://insights.sbomify.com/CVE-2020-6956/): Cross-site scripting in pcs:dexicon enterprise (medium 6.1)
- [CVE-2020-6955](https://insights.sbomify.com/CVE-2020-6955/): Cross-site scripting in cayintech:smp-pro4 firmware (medium 6.1)
- [CVE-2020-6954](https://insights.sbomify.com/CVE-2020-6954/): Information disclosure in cayintech:smp-pro4 firmware (medium 6.5)
- [CVE-2020-6950](https://insights.sbomify.com/CVE-2020-6950/): Directory traversal in Eclipse Mojarra (medium 6.5)
- [CVE-2020-6949](https://insights.sbomify.com/CVE-2020-6949/): Privilege escalation in hashbrowncms:hashbrown cms (high 8.8)
- [CVE-2020-6948](https://insights.sbomify.com/CVE-2020-6948/): HashBrown CMS RCE (critical 9.8)
- [CVE-2020-6939](https://insights.sbomify.com/CVE-2020-6939/): Missing authorization in Tableau Server (critical 9.8)
- [CVE-2020-6938](https://insights.sbomify.com/CVE-2020-6938/): Information disclosure in Tableau (high 7.5)
- [CVE-2020-6937](https://insights.sbomify.com/CVE-2020-6937/): Denial of service in MuleSoft Mule CE/EE (high 7.5)
- [CVE-2020-6933](https://insights.sbomify.com/CVE-2020-6933/): Denial of service in BlackBerry UEM (medium 5.5)
- [CVE-2020-6932](https://insights.sbomify.com/CVE-2020-6932/): Code injection in QNX Software Development Platform (SDP) (critical 10.0)
- [CVE-2020-6931](https://insights.sbomify.com/CVE-2020-6931/): Privilege escalation in HP Print and Scan Doctor (high 7.8)
- [CVE-2020-6923](https://insights.sbomify.com/CVE-2020-6923/): HP Linux Imaging and Printing Software - Potential Memory Buffer Overflow (medium 5.7)
- [CVE-2020-6922](https://insights.sbomify.com/CVE-2020-6922/): Other in HP Support Assistant (high 7.8)
- [CVE-2020-6921](https://insights.sbomify.com/CVE-2020-6921/): Other in HP Support Assistant (high 7.8)
- [CVE-2020-6920](https://insights.sbomify.com/CVE-2020-6920/): Other in HP Support Assistant (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/43/