# Vulnerabilities published in 2020


- [CVE-2020-6233](https://insights.sbomify.com/CVE-2020-6233/): Missing authorization in SAP S/4 HANA (Financial Products Subledger and Banking Services) (FSAPPL) (medium 4.3)
- [CVE-2020-6232](https://insights.sbomify.com/CVE-2020-6232/): Missing authorization in SAP Commerce (medium 5.3)
- [CVE-2020-6231](https://insights.sbomify.com/CVE-2020-6231/): Cross-site scripting in SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface) (medium 5.4)
- [CVE-2020-6230](https://insights.sbomify.com/CVE-2020-6230/): Code injection in SAP OrientDB (critical 9.1)
- [CVE-2020-6229](https://insights.sbomify.com/CVE-2020-6229/): Cross-site scripting in SAP NetWeaver AS ABAP (Business Server Pages application CRM BSP FRAME) (medium 6.1)
- [CVE-2020-6228](https://insights.sbomify.com/CVE-2020-6228/): Security feature bypass in SAP Business Client (medium 5.3)
- [CVE-2020-6227](https://insights.sbomify.com/CVE-2020-6227/): Other in SAP Business Objects Business Intelligence Platform (CMS / Auditing issues) (medium 5.3)
- [CVE-2020-6226](https://insights.sbomify.com/CVE-2020-6226/): Cross-site scripting in SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface) (medium 5.4)
- [CVE-2020-6225](https://insights.sbomify.com/CVE-2020-6225/): Path traversal in SAP NetWeaver (Knowledge Management) (KMC-CM) (critical 9.1)
- [CVE-2020-6224](https://insights.sbomify.com/CVE-2020-6224/): Information disclosure in SAP NetWeaver AS Java (HTTP Service) (medium 4.5)
- [CVE-2020-6223](https://insights.sbomify.com/CVE-2020-6223/): Open redirect in SAP Business Objects Business Intelligence Platform (medium 6.1)
- [CVE-2020-6222](https://insights.sbomify.com/CVE-2020-6222/): Cross-site scripting in SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface) (medium 5.4)
- [CVE-2020-6221](https://insights.sbomify.com/CVE-2020-6221/): Cross-site scripting in SAP BusinessObjects Business Intelligence Platform (medium 5.4)
- [CVE-2020-6220](https://insights.sbomify.com/CVE-2020-6220/): Cross-site scripting in SAP Business Objects Business Intelligence Platform (medium 4.4)
- [CVE-2020-6219](https://insights.sbomify.com/CVE-2020-6219/): Deserialization in Crystal Reports for VS (critical 9.1)
- [CVE-2020-6218](https://insights.sbomify.com/CVE-2020-6218/): Information disclosure in SAP Business Objects Business Intelligence Platform (medium 5.0)
- [CVE-2020-6217](https://insights.sbomify.com/CVE-2020-6217/): Cross-site scripting in SAP NetWeaver AS ABAP (Business Server Pages Test Application IT05) (medium 6.1)
- [CVE-2020-6216](https://insights.sbomify.com/CVE-2020-6216/): Cross-site scripting in SAP Business Objects Business Intelligence Platform (BI Launchpad) (medium 6.1)
- [CVE-2020-6215](https://insights.sbomify.com/CVE-2020-6215/): Open redirect in SAP NetWeaver AS ABAP (Business Server Pages Test Application IT00) (medium 6.1)
- [CVE-2020-6214](https://insights.sbomify.com/CVE-2020-6214/): Missing authorization in SAP S/4HANA (Financial Products Subledger) (medium 4.7)
- [CVE-2020-6213](https://insights.sbomify.com/CVE-2020-6213/): Cross-site scripting in SAP NetWeaver AS ABAP (Business Server Pages Test Application SBSPEXT PHTMLB) (medium 6.1)
- [CVE-2020-6212](https://insights.sbomify.com/CVE-2020-6212/): Missing authorization in SAP ERP (medium 5.4)
- [CVE-2020-6211](https://insights.sbomify.com/CVE-2020-6211/): Open redirect in SAP Business Objects Business Intelligence Platform (medium 6.1)
- [CVE-2020-6210](https://insights.sbomify.com/CVE-2020-6210/): Cross-site scripting in SAP Fiori Launchpad (medium 4.7)
- [CVE-2020-6209](https://insights.sbomify.com/CVE-2020-6209/): Missing authorization in SAP Disclosure Management (high 7.2)
- [CVE-2020-6208](https://insights.sbomify.com/CVE-2020-6208/): Use after free in SAP Business Objects Business Intelligence Platform (Crystal Reports) (high 7.5)
- [CVE-2020-6207](https://insights.sbomify.com/CVE-2020-6207/): SAP Solution Manager Missing Authentication for Critical Function (critical 10.0, exploited in the wild)
- [CVE-2020-6206](https://insights.sbomify.com/CVE-2020-6206/): Cross-site request forgery in SAP Cloud Platform Integration for Data Services (medium 4.7)
- [CVE-2020-6205](https://insights.sbomify.com/CVE-2020-6205/): Cross-site scripting in SAP NetWeaver Application Server ABAP (Smart Forms) - SAP BASIS (medium 6.1)
- [CVE-2020-6204](https://insights.sbomify.com/CVE-2020-6204/): Missing authorization in SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV) (medium 4.3)
- [CVE-2020-6203](https://insights.sbomify.com/CVE-2020-6203/): Path traversal in SAP NetWeaver UDDI Server (Services Registry) (critical 9.1)
- [CVE-2020-6202](https://insights.sbomify.com/CVE-2020-6202/): Other in SAP NetWeaver Application Server Java (User Management Engine) (medium 5.5)
- [CVE-2020-6201](https://insights.sbomify.com/CVE-2020-6201/): Cross-site scripting in SAP Commerce Cloud (Testweb Extension) (medium 6.1)
- [CVE-2020-6200](https://insights.sbomify.com/CVE-2020-6200/): Cross-site scripting in SAP Commerce Cloud (SmartEdit Extension) (medium 5.4)
- [CVE-2020-6199](https://insights.sbomify.com/CVE-2020-6199/): Missing authorization in SAP ERP (EAPPGLO) (medium 5.4)
- [CVE-2020-6198](https://insights.sbomify.com/CVE-2020-6198/): Auth bypass in SAP Solution Manager (Diagnostics Agent) (critical 9.8)
- [CVE-2020-6197](https://insights.sbomify.com/CVE-2020-6197/): Auth bypass in SAP Enable Now (low 3.8)
- [CVE-2020-6196](https://insights.sbomify.com/CVE-2020-6196/): Denial of service in SAP BusinessObjects Mobile (MobileBIService) (high 7.5)
- [CVE-2020-6195](https://insights.sbomify.com/CVE-2020-6195/): Information disclosure in SAP Business Objects Business Intelligence Platform (medium 6.4)
- [CVE-2020-6193](https://insights.sbomify.com/CVE-2020-6193/): Cross-site scripting in SAP NetWeaver (Knowledge Management ICE Service) (medium 6.1)
- [CVE-2020-6192](https://insights.sbomify.com/CVE-2020-6192/): Command injection in SAP Landscape Management (high 7.2)
- [CVE-2020-6191](https://insights.sbomify.com/CVE-2020-6191/): Privilege escalation in SAP Landscape Management (high 7.2)
- [CVE-2020-6190](https://insights.sbomify.com/CVE-2020-6190/): Information disclosure in SAP NetWeaver AS Java (Heap Dump Application) (medium 5.8)
- [CVE-2020-6189](https://insights.sbomify.com/CVE-2020-6189/): Information disclosure in SAP Business Objects Business Intelligence Platform (CMC) (medium 5.3)
- [CVE-2020-6188](https://insights.sbomify.com/CVE-2020-6188/): Missing authorization in SAP ERP (SAP APPL) (medium 6.3)
- [CVE-2020-6187](https://insights.sbomify.com/CVE-2020-6187/): XML external entity in SAP NetWeaver (Guided Procedures) (medium 4.9)
- [CVE-2020-6186](https://insights.sbomify.com/CVE-2020-6186/): Denial of service in SAP Host Agent (high 7.5)
- [CVE-2020-6185](https://insights.sbomify.com/CVE-2020-6185/): Cross-site scripting in SAP NetWeaver (SAP Basis) (medium 5.4)
- [CVE-2020-6184](https://insights.sbomify.com/CVE-2020-6184/): Cross-site scripting in Automated Note Search Tool (SAP Basis) (medium 6.1)
- [CVE-2020-6183](https://insights.sbomify.com/CVE-2020-6183/): Missing authorization in SAP Host Agent (medium 5.3)
- [CVE-2020-6181](https://insights.sbomify.com/CVE-2020-6181/): Other in SAP ABAP Platform (SAP Basis) (medium 5.8)
- [CVE-2020-6178](https://insights.sbomify.com/CVE-2020-6178/): Information disclosure in SAP Enable Now (medium 5.4)
- [CVE-2020-6177](https://insights.sbomify.com/CVE-2020-6177/): Denial of service in SAP Mobile Platform (medium 4.3)
- [CVE-2020-6175](https://insights.sbomify.com/CVE-2020-6175/): Security feature bypass in citrix:citrix sd-wan center (medium 5.9)
- [CVE-2020-6174](https://insights.sbomify.com/CVE-2020-6174/): Incorrect threshold signature computation in TUF (critical 9.8)
- [CVE-2020-6173](https://insights.sbomify.com/CVE-2020-6173/): Client Denial of Service on TUF (medium 5.3)
- [CVE-2020-6171](https://insights.sbomify.com/CVE-2020-6171/): Cross-site scripting in communilink:clink office (medium 6.1)
- [CVE-2020-6170](https://insights.sbomify.com/CVE-2020-6170/): Auth bypass in genexis:platinum-4410 firmware (critical 9.8)
- [CVE-2020-6168](https://insights.sbomify.com/CVE-2020-6168/): Missing authorization in webfactoryltd:minimal coming soon \& maintenance mode (high 7.6)
- [CVE-2020-6167](https://insights.sbomify.com/CVE-2020-6167/): Cross-site request forgery in webfactoryltd:minimal coming soon \& maintenance mode (critical 9.6)
- [CVE-2020-6166](https://insights.sbomify.com/CVE-2020-6166/): Missing authorization in webfactoryltd:minimal coming soon \& maintenance mode (medium 5.4)
- [CVE-2020-6165](https://insights.sbomify.com/CVE-2020-6165/): Silverstripe has Incorrect Default Permissions (medium 5.3)
- [CVE-2020-6164](https://insights.sbomify.com/CVE-2020-6164/): Silverstripe CMS information disclosure (high 7.5)
- [CVE-2020-6163](https://insights.sbomify.com/CVE-2020-6163/): Cross-site scripting in mediawiki:mediawiki (medium 6.1)
- [CVE-2020-6162](https://insights.sbomify.com/CVE-2020-6162/): Memory corruption in bftpd project:bftpd (critical 9.1)
- [CVE-2020-6159](https://insights.sbomify.com/CVE-2020-6159/): Cross-site scripting in Opera for Android (medium 6.1)
- [CVE-2020-6158](https://insights.sbomify.com/CVE-2020-6158/): Other in Opera Mini for Android (medium 4.7)
- [CVE-2020-6157](https://insights.sbomify.com/CVE-2020-6157/): Other in Opera Touch for iOS (medium 4.3)
- [CVE-2020-6156](https://insights.sbomify.com/CVE-2020-6156/): Memory corruption in Pixar (high 8.8)
- [CVE-2020-6155](https://insights.sbomify.com/CVE-2020-6155/): Memory corruption in Pixar (high 8.8)
- [CVE-2020-6152](https://insights.sbomify.com/CVE-2020-6152/): Memory corruption in Accusoft (critical 9.8)
- [CVE-2020-6151](https://insights.sbomify.com/CVE-2020-6151/): Memory corruption in Accusoft (high 8.1)
- [CVE-2020-6150](https://insights.sbomify.com/CVE-2020-6150/): Memory corruption in Pixar (high 8.8)
- [CVE-2020-6149](https://insights.sbomify.com/CVE-2020-6149/): Memory corruption in Pixar (high 8.8)
- [CVE-2020-6148](https://insights.sbomify.com/CVE-2020-6148/): Memory corruption in Pixar (high 8.8)
- [CVE-2020-6147](https://insights.sbomify.com/CVE-2020-6147/): Memory corruption in Pixar (high 8.8)
- [CVE-2020-6146](https://insights.sbomify.com/CVE-2020-6146/): Memory corruption in Nitro Pro (high 8.8)
- [CVE-2020-6145](https://insights.sbomify.com/CVE-2020-6145/): SQL injection in ERPNext (medium 6.4)
- [CVE-2020-6144](https://insights.sbomify.com/CVE-2020-6144/): Code injection in OS4Ed (critical 10.0)
- [CVE-2020-6143](https://insights.sbomify.com/CVE-2020-6143/): Code injection in OS4Ed (critical 10.0)
- [CVE-2020-6142](https://insights.sbomify.com/CVE-2020-6142/): Path traversal in OS4Ed (critical 9.9)
- [CVE-2020-6141](https://insights.sbomify.com/CVE-2020-6141/): SQL injection in OS4Ed (critical 9.8)
- [CVE-2020-6140](https://insights.sbomify.com/CVE-2020-6140/): SQL injection in OS4Ed (critical 9.8)
- [CVE-2020-6139](https://insights.sbomify.com/CVE-2020-6139/): SQL injection in OS4Ed (critical 9.8)
- [CVE-2020-6138](https://insights.sbomify.com/CVE-2020-6138/): SQL injection in OS4Ed (critical 9.8)
- [CVE-2020-6137](https://insights.sbomify.com/CVE-2020-6137/): SQL injection in OS4Ed (critical 9.8)
- [CVE-2020-6136](https://insights.sbomify.com/CVE-2020-6136/): SQL injection in OS4Ed (medium 6.4)
- [CVE-2020-6135](https://insights.sbomify.com/CVE-2020-6135/): SQL injection in OS4Ed (medium 6.4)
- [CVE-2020-6134](https://insights.sbomify.com/CVE-2020-6134/): SQL injection in OS4Ed (medium 6.4)
- [CVE-2020-6133](https://insights.sbomify.com/CVE-2020-6133/): SQL injection in OS4Ed (medium 6.4)
- [CVE-2020-6132](https://insights.sbomify.com/CVE-2020-6132/): SQL injection in OS4Ed (medium 6.4)
- [CVE-2020-6131](https://insights.sbomify.com/CVE-2020-6131/): SQL injection in OS4ED (medium 6.4)
- [CVE-2020-6130](https://insights.sbomify.com/CVE-2020-6130/): SQL injection in OS4ED (medium 6.4)
- [CVE-2020-6129](https://insights.sbomify.com/CVE-2020-6129/): SQL injection in OS4ED (medium 6.4)
- [CVE-2020-6128](https://insights.sbomify.com/CVE-2020-6128/): SQL injection in OS4Ed (medium 6.4)
- [CVE-2020-6127](https://insights.sbomify.com/CVE-2020-6127/): SQL injection in OS4Ed (medium 6.4)
- [CVE-2020-6126](https://insights.sbomify.com/CVE-2020-6126/): SQL injection in OS4Ed (medium 6.4)
- [CVE-2020-6125](https://insights.sbomify.com/CVE-2020-6125/): SQL injection in OS4Ed (medium 6.4)
- [CVE-2020-6124](https://insights.sbomify.com/CVE-2020-6124/): SQL injection in OS4Ed (medium 6.4)
- [CVE-2020-6123](https://insights.sbomify.com/CVE-2020-6123/): SQL injection in OS4Ed (medium 6.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/49/