# Vulnerabilities published in 2020 - [CVE-2020-5519](https://insights.sbomify.com/CVE-2020-5519/): Other in litespeedtech:openlitespeed (critical 9.8) - [CVE-2020-5517](https://insights.sbomify.com/CVE-2020-5517/): Cross-site request forgery in blueonyx:5209r firmware (medium 6.5) - [CVE-2020-5515](https://insights.sbomify.com/CVE-2020-5515/): SQL injection in gilacms:gila cms (high 7.2) - [CVE-2020-5514](https://insights.sbomify.com/CVE-2020-5514/): File upload in gilacms:gila cms (critical 9.1) - [CVE-2020-5513](https://insights.sbomify.com/CVE-2020-5513/): Path traversal in gilacms:gila cms (medium 6.8) - [CVE-2020-5512](https://insights.sbomify.com/CVE-2020-5512/): Path traversal in gilacms:gila cms (medium 6.8) - [CVE-2020-5511](https://insights.sbomify.com/CVE-2020-5511/): SQL injection in small crm project:small crm (high 8.8) - [CVE-2020-5510](https://insights.sbomify.com/CVE-2020-5510/): SQL injection in phpgurukul:hostel management system (critical 9.8) - [CVE-2020-5509](https://insights.sbomify.com/CVE-2020-5509/): File upload in phpgurukul:car rental portal (high 7.2) - [CVE-2020-5505](https://insights.sbomify.com/CVE-2020-5505/): File upload in vaaip:freelancy (critical 9.8) - [CVE-2020-5504](https://insights.sbomify.com/CVE-2020-5504/): phpMyAdmin SQL injection in user accounts page (high 8.8) - [CVE-2020-5502](https://insights.sbomify.com/CVE-2020-5502/): phpBB allows CSRF (medium 6.5) - [CVE-2020-5501](https://insights.sbomify.com/CVE-2020-5501/): phpBB Cross-Site Request Forgery (CSRF) (medium 4.3) - [CVE-2020-5499](https://insights.sbomify.com/CVE-2020-5499/): Race condition in apache:rust sgx sdk (critical 9.8) - [CVE-2020-5497](https://insights.sbomify.com/CVE-2020-5497/): XSS in MITREid Connect (medium 6.1) - [CVE-2020-5496](https://insights.sbomify.com/CVE-2020-5496/): Memory corruption in fontforge:fontforge (high 8.8) - [CVE-2020-5428](https://insights.sbomify.com/CVE-2020-5428/): Possibility of SQL Injection in Spring Cloud Task Execution Sorting Query (medium 5.1) - [CVE-2020-5427](https://insights.sbomify.com/CVE-2020-5427/): Possibility of SQL Injection in Spring Cloud Data Flow Task Execution Sorting Query (medium 5.7) - [CVE-2020-5426](https://insights.sbomify.com/CVE-2020-5426/): Scheduler for TAS can transmit privileged UAA token in plaintext (high 8.6) - [CVE-2020-5425](https://insights.sbomify.com/CVE-2020-5425/): User Impersonation possible in Tanzu SSO (high 7.5) - [CVE-2020-5423](https://insights.sbomify.com/CVE-2020-5423/): Cloud Controller is vulnerable to denial of service via YAML parsing (high 7.5) - [CVE-2020-5422](https://insights.sbomify.com/CVE-2020-5422/): UAA password may appear in BOSH System Metrics Server process arguments (medium 6.5) - [CVE-2020-5421](https://insights.sbomify.com/CVE-2020-5421/): RFD Protection Bypass via jsessionid (high 8.7) - [CVE-2020-5420](https://insights.sbomify.com/CVE-2020-5420/): Gorouter is vulnerable to DoS attack via invalid HTTP responses (high 7.7) - [CVE-2020-5419](https://insights.sbomify.com/CVE-2020-5419/): RabbitMQ arbitrary code execution using local binary planting (medium 6.7) - [CVE-2020-5418](https://insights.sbomify.com/CVE-2020-5418/): Cloud Controller allows users with no roles to list droplets (low 3.1) - [CVE-2020-5417](https://insights.sbomify.com/CVE-2020-5417/): Cloud Controller may allow developers to claim sensitive routes (high 8.5) - [CVE-2020-5416](https://insights.sbomify.com/CVE-2020-5416/): CF clusters with NGINX in front of them may be vulnerable to DoS (high 7.7) - [CVE-2020-5415](https://insights.sbomify.com/CVE-2020-5415/): Concourse's GitLab auth allows impersonation (critical 10.0) - [CVE-2020-5414](https://insights.sbomify.com/CVE-2020-5414/): App Autoscaler logs credentials (medium 5.7) - [CVE-2020-5413](https://insights.sbomify.com/CVE-2020-5413/): Kryo Configuration Allows Code Execution with Unknown "Serialization Gadgets" (critical 9.8) - [CVE-2020-5412](https://insights.sbomify.com/CVE-2020-5412/): Hystrix Dashboard Proxy In spring-cloud-netflix-hystrix-dashboard (medium 6.5) - [CVE-2020-5411](https://insights.sbomify.com/CVE-2020-5411/): Jackson Configuration Allows Code Execution with Unknown "Serialization Gadgets" (high 8.1) - [CVE-2020-5410](https://insights.sbomify.com/CVE-2020-5410/): VMware Tanzu Spring Cloud Config Directory Traversal (high 7.5, exploited in the wild) - [CVE-2020-5409](https://insights.sbomify.com/CVE-2020-5409/): Concourse Open Redirect in the /sky/login endpoint (high 7.6) - [CVE-2020-5408](https://insights.sbomify.com/CVE-2020-5408/): Dictionary attack with Spring Security queryable text encryptor (medium 6.5) - [CVE-2020-5407](https://insights.sbomify.com/CVE-2020-5407/): Signature Wrapping Vulnerability with spring-security-saml2-service-provider (high 8.8) - [CVE-2020-5406](https://insights.sbomify.com/CVE-2020-5406/): PCF Autoscaling logs its database credentials (medium 6.5) - [CVE-2020-5405](https://insights.sbomify.com/CVE-2020-5405/): Directory Traversal with spring-cloud-config-server (medium 6.5) - [CVE-2020-5404](https://insights.sbomify.com/CVE-2020-5404/): Authentication Leak On Redirect With Reactor Netty HttpClient (medium 6.5) - [CVE-2020-5403](https://insights.sbomify.com/CVE-2020-5403/): DoS Via Malformed URL with Reactor Netty HTTP Server (medium 6.5) - [CVE-2020-5402](https://insights.sbomify.com/CVE-2020-5402/): UAA fails to check the state parameter when authenticating with external IDPs (high 8.8) - [CVE-2020-5401](https://insights.sbomify.com/CVE-2020-5401/): Cloud Foundry GoRouter is vulnerable to cache poisoning (medium 5.3) - [CVE-2020-5400](https://insights.sbomify.com/CVE-2020-5400/): Cloud Controller logs environment variables from app manifests (high 8.0) - [CVE-2020-5399](https://insights.sbomify.com/CVE-2020-5399/): CredHub does not properly enable TLS for MySQL database connections (high 7.6) - [CVE-2020-5398](https://insights.sbomify.com/CVE-2020-5398/): RFD Attack via "Content-Disposition" Header Sourced from Request Input by Spring MVC or Spring WebFlux Application (high 8.0) - [CVE-2020-5397](https://insights.sbomify.com/CVE-2020-5397/): CSRF Attack via CORS Preflight Requests with Spring MVC or Spring WebFlux (medium 5.3) - [CVE-2020-5396](https://insights.sbomify.com/CVE-2020-5396/): JMX Insecure Default Configuration in GemFire (high 8.8) - [CVE-2020-5395](https://insights.sbomify.com/CVE-2020-5395/): Use after free in fedoraproject:fedora (high 8.8) - [CVE-2020-5393](https://insights.sbomify.com/CVE-2020-5393/): Cross-site scripting in appspace:on-prem (medium 6.1) - [CVE-2020-5392](https://insights.sbomify.com/CVE-2020-5392/): Cross-site scripting in auth0:wp-auth0 (medium 6.1) - [CVE-2020-5391](https://insights.sbomify.com/CVE-2020-5391/): Cross-site request forgery in auth0:wp-auth0 (high 8.8) - [CVE-2020-5390](https://insights.sbomify.com/CVE-2020-5390/): Improper Verification of Cryptographic Signature in PySAML2 (high 7.5) - [CVE-2020-5389](https://insights.sbomify.com/CVE-2020-5389/): Information disclosure in OMIMSSC (OpenManage Integration for Microsoft System Center) (critical 9.0) - [CVE-2020-5388](https://insights.sbomify.com/CVE-2020-5388/): Memory corruption in CPG BIOS (medium 6.9) - [CVE-2020-5387](https://insights.sbomify.com/CVE-2020-5387/): Denial of service in CPG BIOS (low 2.3) - [CVE-2020-5386](https://insights.sbomify.com/CVE-2020-5386/): Information disclosure in Elastic Cloud Storage (high 8.1) - [CVE-2020-5385](https://insights.sbomify.com/CVE-2020-5385/): Privilege escalation in Dell Encryption Enterprise (medium 6.7) - [CVE-2020-5384](https://insights.sbomify.com/CVE-2020-5384/): Auth bypass in RSA Authentication Agent for Microsoft Windows (high 8.4) - [CVE-2020-5383](https://insights.sbomify.com/CVE-2020-5383/): Memory corruption in Isilon OneFS (medium 5.3) - [CVE-2020-5379](https://insights.sbomify.com/CVE-2020-5379/): Memory corruption in CPG BIOS (medium 6.8) - [CVE-2020-5378](https://insights.sbomify.com/CVE-2020-5378/): Use after free in CPG BIOS (medium 6.8) - [CVE-2020-5377](https://insights.sbomify.com/CVE-2020-5377/): Path traversal in Dell Open Manage Server Administrator (critical 9.1) - [CVE-2020-5376](https://insights.sbomify.com/CVE-2020-5376/): Use after free in CPG BIOS (medium 6.8) - [CVE-2020-5374](https://insights.sbomify.com/CVE-2020-5374/): Hardcoded credentials in OMIMSSC (OpenManage Integration for Microsoft System Center) (high 8.8) - [CVE-2020-5373](https://insights.sbomify.com/CVE-2020-5373/): Auth bypass in OMIMSSC (OpenManage Integration for Microsoft System Center) (medium 6.5) - [CVE-2020-5372](https://insights.sbomify.com/CVE-2020-5372/): Misconfiguration in PowerStore (high 8.6) - [CVE-2020-5371](https://insights.sbomify.com/CVE-2020-5371/): Misconfiguration in Isilon OneFS (high 8.0) - [CVE-2020-5370](https://insights.sbomify.com/CVE-2020-5370/): Path traversal in OpenManage Enterprise (high 7.9) - [CVE-2020-5369](https://insights.sbomify.com/CVE-2020-5369/): Privilege escalation in Isilon OneFS (high 8.8) - [CVE-2020-5368](https://insights.sbomify.com/CVE-2020-5368/): Missing authorization in VxRail (critical 9.8) - [CVE-2020-5367](https://insights.sbomify.com/CVE-2020-5367/): Security feature bypass in Unisphere for PowerMax, Unisphere for PowerMax Virtual Appliance, PowerMax OS (high 7.4) - [CVE-2020-5366](https://insights.sbomify.com/CVE-2020-5366/): Path traversal in Integrated Dell Remote Access Controller (iDRAC) (high 7.1) - [CVE-2020-5365](https://insights.sbomify.com/CVE-2020-5365/): Hardcoded credentials in Isilon OneFS (medium 5.3) - [CVE-2020-5364](https://insights.sbomify.com/CVE-2020-5364/): Hardcoded credentials in Isilon OneFS (medium 5.3) - [CVE-2020-5363](https://insights.sbomify.com/CVE-2020-5363/): Auth bypass in Dell Client Consumer and Commercial platforms (high 8.6) - [CVE-2020-5362](https://insights.sbomify.com/CVE-2020-5362/): Missing authorization in Dell Client Consumer and Commercial platforms (high 7.1) - [CVE-2020-5361](https://insights.sbomify.com/CVE-2020-5361/): Auth bypass in CPG BIOS (medium 5.1) - [CVE-2020-5360](https://insights.sbomify.com/CVE-2020-5360/): Memory corruption in Dell BSAFE Micro Edition Suite (high 7.5) - [CVE-2020-5359](https://insights.sbomify.com/CVE-2020-5359/): Weak cryptography in Dell BSAFE Micro Edition Suite (medium 5.8) - [CVE-2020-5358](https://insights.sbomify.com/CVE-2020-5358/): Privilege escalation in Dell Encryption Enterprise (medium 6.7) - [CVE-2020-5357](https://insights.sbomify.com/CVE-2020-5357/): Race condition in CPG BIOS (high 7.1) - [CVE-2020-5356](https://insights.sbomify.com/CVE-2020-5356/): Missing authorization in Power Protect Data Manager (high 7.7) - [CVE-2020-5355](https://insights.sbomify.com/CVE-2020-5355/): Misconfiguration in Isilon OneFS (medium 4.3) - [CVE-2020-5353](https://insights.sbomify.com/CVE-2020-5353/): Misconfiguration in Isilon OneFS (high 8.8) - [CVE-2020-5352](https://insights.sbomify.com/CVE-2020-5352/): Command injection in Data Protection Advisor (high 8.8) - [CVE-2020-5351](https://insights.sbomify.com/CVE-2020-5351/): Hardcoded credentials in Data Protection Advisor (high 7.5) - [CVE-2020-5350](https://insights.sbomify.com/CVE-2020-5350/): Command injection in Integrated Data Protection Appliance (high 7.9) - [CVE-2020-5349](https://insights.sbomify.com/CVE-2020-5349/): Hardcoded credentials in Networking (critical 9.8) - [CVE-2020-5348](https://insights.sbomify.com/CVE-2020-5348/): Use after free in CPG BIOS (medium 6.8) - [CVE-2020-5347](https://insights.sbomify.com/CVE-2020-5347/): Denial of service in Isilon OneFS (medium 5.3) - [CVE-2020-5346](https://insights.sbomify.com/CVE-2020-5346/): Cross-site scripting in RSA Authentication Manager (medium 4.8) - [CVE-2020-5345](https://insights.sbomify.com/CVE-2020-5345/): Missing authorization in Unisphere for PowerMax (medium 6.4) - [CVE-2020-5344](https://insights.sbomify.com/CVE-2020-5344/): Memory corruption in Integrated Dell Remote Access Controller (iDRAC) (high 7.0) - [CVE-2020-5343](https://insights.sbomify.com/CVE-2020-5343/): Misconfiguration in CPG SW (high 7.3) - [CVE-2020-5342](https://insights.sbomify.com/CVE-2020-5342/): Misconfiguration in Dell Digital Delivery (Cirrus) (high 7.8) - [CVE-2020-5341](https://insights.sbomify.com/CVE-2020-5341/): Deserialization in Avamar Virtual Edition (critical 9.8) - [CVE-2020-5340](https://insights.sbomify.com/CVE-2020-5340/): Cross-site scripting in RSA Authentication Manager (medium 4.8) - [CVE-2020-5339](https://insights.sbomify.com/CVE-2020-5339/): Cross-site scripting in RSA Authentication Manager (medium 4.8) - [CVE-2020-5337](https://insights.sbomify.com/CVE-2020-5337/): Open redirect in RSA Archer (medium 4.6) --- From sbomify Insights: https://insights.sbomify.com/years/2020/page/55/