# Vulnerabilities published in 2020


- [CVE-2020-5336](https://insights.sbomify.com/CVE-2020-5336/): Cross-site scripting in RSA Archer (medium 4.6)
- [CVE-2020-5335](https://insights.sbomify.com/CVE-2020-5335/): Cross-site request forgery in RSA Archer (medium 5.0)
- [CVE-2020-5334](https://insights.sbomify.com/CVE-2020-5334/): Cross-site scripting in RSA Archer (high 8.2)
- [CVE-2020-5333](https://insights.sbomify.com/CVE-2020-5333/): Missing authorization in RSA Archer (medium 4.3)
- [CVE-2020-5332](https://insights.sbomify.com/CVE-2020-5332/): Command injection in RSA Archer (high 7.2)
- [CVE-2020-5331](https://insights.sbomify.com/CVE-2020-5331/): Information disclosure in RSA Archer (high 8.8)
- [CVE-2020-5330](https://insights.sbomify.com/CVE-2020-5330/): Information disclosure in Dell PowerConnect (high 8.1)
- [CVE-2020-5329](https://insights.sbomify.com/CVE-2020-5329/): Open redirect in Avamar (medium 6.1)
- [CVE-2020-5328](https://insights.sbomify.com/CVE-2020-5328/): Missing authorization in Isilon OneFS (critical 9.8)
- [CVE-2020-5327](https://insights.sbomify.com/CVE-2020-5327/): Deserialization in Dell Encryption Enterprise (high 8.1)
- [CVE-2020-5326](https://insights.sbomify.com/CVE-2020-5326/): Auth bypass in Dell Client Consumer and Commercial Platforms (medium 6.1)
- [CVE-2020-5324](https://insights.sbomify.com/CVE-2020-5324/): Race condition in Dell Client Consumer and Commercial Platforms (high 7.1)
- [CVE-2020-5323](https://insights.sbomify.com/CVE-2020-5323/): Code injection in Dell OpenManage Enterprise (medium 5.4)
- [CVE-2020-5322](https://insights.sbomify.com/CVE-2020-5322/): Command injection in Dell OpenManage Enterprise Modular (critical 9.1)
- [CVE-2020-5321](https://insights.sbomify.com/CVE-2020-5321/): Privilege escalation in Dell OpenManage Enterprise (high 7.6)
- [CVE-2020-5320](https://insights.sbomify.com/CVE-2020-5320/): SQL injection in Dell OpenManage Enterprise (critical 9.0)
- [CVE-2020-5319](https://insights.sbomify.com/CVE-2020-5319/): Denial of service in Unity (high 7.5)
- [CVE-2020-5318](https://insights.sbomify.com/CVE-2020-5318/): Auth bypass in Isilon OneFS (high 7.5)
- [CVE-2020-5317](https://insights.sbomify.com/CVE-2020-5317/): Cross-site scripting in Elastic Cloud Storage (medium 6.2)
- [CVE-2020-5316](https://insights.sbomify.com/CVE-2020-5316/): Privilege escalation in Dell SupportAssist Client (high 7.8)
- [CVE-2020-5315](https://insights.sbomify.com/CVE-2020-5315/): Information disclosure in Dell EMC Repository Manager (DRM) (high 8.8)
- [CVE-2020-5313](https://insights.sbomify.com/CVE-2020-5313/): Out-of-bounds Read in Pillow (high 7.1)
- [CVE-2020-5312](https://insights.sbomify.com/CVE-2020-5312/): PCX P mode buffer overflow in Pillow (critical 9.8)
- [CVE-2020-5311](https://insights.sbomify.com/CVE-2020-5311/): Buffer Copy without Checking Size of Input in Pillow (critical 9.8)
- [CVE-2020-5310](https://insights.sbomify.com/CVE-2020-5310/): Integer overflow in Pillow (high 8.8)
- [CVE-2020-5308](https://insights.sbomify.com/CVE-2020-5308/): Cross-site scripting in phpgurukul:dairy farm shop management system (medium 6.1)
- [CVE-2020-5307](https://insights.sbomify.com/CVE-2020-5307/): SQL injection in phpgurukul:dairy farm shop management system (critical 9.8)
- [CVE-2020-5306](https://insights.sbomify.com/CVE-2020-5306/): Cross-site scripting in codologic:codoforum (medium 4.8)
- [CVE-2020-5305](https://insights.sbomify.com/CVE-2020-5305/): Cross-site scripting in codologic:codoforum (medium 4.8)
- [CVE-2020-5304](https://insights.sbomify.com/CVE-2020-5304/): Other in whitesourcesoftware:whitesource (high 7.5)
- [CVE-2020-5303](https://insights.sbomify.com/CVE-2020-5303/): Denial of service in Tendermint (low 3.1)
- [CVE-2020-5302](https://insights.sbomify.com/CVE-2020-5302/): unprivileged user can access priviledged action in MH-WikiBot (high 8.2)
- [CVE-2020-5301](https://insights.sbomify.com/CVE-2020-5301/): Information disclosure of source code in SimpleSAMLphp (low 3.0)
- [CVE-2020-5300](https://insights.sbomify.com/CVE-2020-5300/): Disallow replay of `private_key_jwt` by blacklisting JTIs in Hydra (medium 5.8)
- [CVE-2020-5299](https://insights.sbomify.com/CVE-2020-5299/): Potential CSV Injection vector in OctoberCMS (medium 4.0)
- [CVE-2020-5298](https://insights.sbomify.com/CVE-2020-5298/): Reflected XSS when importing CSV in OctoberCMS (medium 4.0)
- [CVE-2020-5297](https://insights.sbomify.com/CVE-2020-5297/): Upload whitelisted files to any directory in OctoberCMS (low 3.4)
- [CVE-2020-5296](https://insights.sbomify.com/CVE-2020-5296/): Arbitrary File Deletion vulnerability in OctoberCMS (medium 6.2)
- [CVE-2020-5295](https://insights.sbomify.com/CVE-2020-5295/): Local File read vulnerability in OctoberCMS (medium 4.8)
- [CVE-2020-5294](https://insights.sbomify.com/CVE-2020-5294/): Reflected XSS with social networks fields (medium 4.1)
- [CVE-2020-5293](https://insights.sbomify.com/CVE-2020-5293/): Improper access control on product page with combinations, attachments and specific prices in PrestaShop (medium 6.5)
- [CVE-2020-5292](https://insights.sbomify.com/CVE-2020-5292/): Time-based blind injection in Leantime (high 8.7)
- [CVE-2020-5291](https://insights.sbomify.com/CVE-2020-5291/): Privilege escalation in setuid mode via user namespaces in Bubblewrap (high 7.2)
- [CVE-2020-5290](https://insights.sbomify.com/CVE-2020-5290/): session fixation in rCTF (medium 6.5)
- [CVE-2020-5289](https://insights.sbomify.com/CVE-2020-5289/): Read permissions not enforced for client provided filter expressions in Elide http client (medium 6.8)
- [CVE-2020-5288](https://insights.sbomify.com/CVE-2020-5288/): Improper access control on product attributes page in PrestaShop (medium 4.1)
- [CVE-2020-5287](https://insights.sbomify.com/CVE-2020-5287/): Improper access control on customers search in PrestaShop (medium 4.1)
- [CVE-2020-5286](https://insights.sbomify.com/CVE-2020-5286/): Reflected XSS related in import page in PrestaShop (medium 4.1)
- [CVE-2020-5285](https://insights.sbomify.com/CVE-2020-5285/): Reflected XSS with back parameter in PrestaShop (medium 4.1)
- [CVE-2020-5284](https://insights.sbomify.com/CVE-2020-5284/): Directory Traversal in Next.js versions below 9.3.2 (medium 4.4)
- [CVE-2020-5283](https://insights.sbomify.com/CVE-2020-5283/): XSS vulnerability in CVS show_subdir_lastmod support (low 3.1)
- [CVE-2020-5282](https://insights.sbomify.com/CVE-2020-5282/): arbitrary shell execution in Nick Chan Bot (high 7.2)
- [CVE-2020-5281](https://insights.sbomify.com/CVE-2020-5281/): LDAP connector injection in Perun (medium 6.2)
- [CVE-2020-5280](https://insights.sbomify.com/CVE-2020-5280/): Local file inclusion vulnerability in http4s (high 7.6)
- [CVE-2020-5279](https://insights.sbomify.com/CVE-2020-5279/): Improper Access Control for certain legacy controller in PrestaShop (medium 4.1)
- [CVE-2020-5278](https://insights.sbomify.com/CVE-2020-5278/): Reflected XSS on Exception page of PrestaShop (medium 4.1)
- [CVE-2020-5277](https://insights.sbomify.com/CVE-2020-5277/): Reflected XSS with url_name parameter of PrestaShop module ps_facetedsearch (medium 4.1)
- [CVE-2020-5276](https://insights.sbomify.com/CVE-2020-5276/): Reflected XSS on AdminCarts page of PrestaShop (medium 4.1)
- [CVE-2020-5275](https://insights.sbomify.com/CVE-2020-5275/): Firewall configured with unanimous strategy was not actually unanimous in symfony/security-http (high 7.6)
- [CVE-2020-5274](https://insights.sbomify.com/CVE-2020-5274/): Exceptions displayed in non-debug configurations in Symfony (medium 4.6)
- [CVE-2020-5273](https://insights.sbomify.com/CVE-2020-5273/): Stored XSS with custom URLs in PrestaShop module ps_linklist (medium 4.1)
- [CVE-2020-5272](https://insights.sbomify.com/CVE-2020-5272/): Reflected XSS on Search page of PrestaShop (medium 4.1)
- [CVE-2020-5271](https://insights.sbomify.com/CVE-2020-5271/): Reflected XSS with dashboard calendar of PrestaShop (medium 4.1)
- [CVE-2020-5270](https://insights.sbomify.com/CVE-2020-5270/): Open redirection when using back parameter of PrestaShop (medium 4.1)
- [CVE-2020-5269](https://insights.sbomify.com/CVE-2020-5269/): Reflected XSS on AdminFeatures page of PrestaShop (medium 4.1)
- [CVE-2020-5268](https://insights.sbomify.com/CVE-2020-5268/): Subject Confirmation Method not validated in Saml2 Authentication Services for ASP.NET (medium 6.5)
- [CVE-2020-5267](https://insights.sbomify.com/CVE-2020-5267/): Possible XSS vulnerability in ActionView (medium 4.0)
- [CVE-2020-5266](https://insights.sbomify.com/CVE-2020-5266/): Stored XSS on back office edit page (medium 4.4)
- [CVE-2020-5265](https://insights.sbomify.com/CVE-2020-5265/): Reflected XSS on AdminAttributesGroups page of PrestaShop (medium 4.4)
- [CVE-2020-5264](https://insights.sbomify.com/CVE-2020-5264/): Reflected XSS in security compromised page of PrestaShop (medium 4.4)
- [CVE-2020-5263](https://insights.sbomify.com/CVE-2020-5263/): Information disclosure through error object (medium 5.5)
- [CVE-2020-5262](https://insights.sbomify.com/CVE-2020-5262/): GitHub personal access token leaking into temporary EasyBuild (debug) logs (high 7.7)
- [CVE-2020-5261](https://insights.sbomify.com/CVE-2020-5261/): Missing Token Replay Detection (high 8.2)
- [CVE-2020-5260](https://insights.sbomify.com/CVE-2020-5260/): malicious URLs may cause Git to present stored credentials to the wrong server (critical 9.3)
- [CVE-2020-5259](https://insights.sbomify.com/CVE-2020-5259/): Prototype Pollution in Dojox (high 7.7)
- [CVE-2020-5258](https://insights.sbomify.com/CVE-2020-5258/): Prototype pollution in dojo (high 7.7)
- [CVE-2020-5257](https://insights.sbomify.com/CVE-2020-5257/): Sort order SQL injection in Administrate (high 7.7)
- [CVE-2020-5256](https://insights.sbomify.com/CVE-2020-5256/): Remote Code Execution Through Image Uploads in BookStack (high 7.9)
- [CVE-2020-5255](https://insights.sbomify.com/CVE-2020-5255/): Prevent cache poisoning via a Response Content-Type header (low 2.6)
- [CVE-2020-5254](https://insights.sbomify.com/CVE-2020-5254/): NetHack hilite_status parsing privilege escalation (low 3.9)
- [CVE-2020-5253](https://insights.sbomify.com/CVE-2020-5253/): Privilege escalation in NetHack (low 3.9)
- [CVE-2020-5252](https://insights.sbomify.com/CVE-2020-5252/): Malicious package may avoid detection in python auditing (medium 5.0)
- [CVE-2020-5251](https://insights.sbomify.com/CVE-2020-5251/): Information disclosure in parse-server (high 7.7)
- [CVE-2020-5250](https://insights.sbomify.com/CVE-2020-5250/): Possible information disclosure in PrestaShop (high 7.6)
- [CVE-2020-5249](https://insights.sbomify.com/CVE-2020-5249/): HTTP Response Splitting (Early Hints) in Puma (medium 6.5)
- [CVE-2020-5248](https://insights.sbomify.com/CVE-2020-5248/): Public GLPIKEY can be used to decrypt any data in GLPI (high 7.2)
- [CVE-2020-5247](https://insights.sbomify.com/CVE-2020-5247/): HTTP Response Splitting in Puma (medium 6.5)
- [CVE-2020-5246](https://insights.sbomify.com/CVE-2020-5246/): LDAP injection vulnerability in Traccar GPS Tracking System (high 7.7)
- [CVE-2020-5245](https://insights.sbomify.com/CVE-2020-5245/): Remote Code Execution (RCE) vulnerability in dropwizard-validation (high 7.9)
- [CVE-2020-5244](https://insights.sbomify.com/CVE-2020-5244/): Private data exposure via REST API in BuddyPress (high 8.0)
- [CVE-2020-5243](https://insights.sbomify.com/CVE-2020-5243/): Denial of Service in uap-core when processing crafted User-Agent strings (medium 5.7)
- [CVE-2020-5242](https://insights.sbomify.com/CVE-2020-5242/): openHAB exec add-ons allow remote arbitrary command execution (high 7.7)
- [CVE-2020-5241](https://insights.sbomify.com/CVE-2020-5241/): XSS/Script injection vulnerability in matestack (high 7.7)
- [CVE-2020-5240](https://insights.sbomify.com/CVE-2020-5240/): 2FA bypass through deleting devices in wagtail-2fa (high 7.6)
- [CVE-2020-5239](https://insights.sbomify.com/CVE-2020-5239/): Unspecified vulnerability in the fetchmail script in Mailu (high 8.7)
- [CVE-2020-5238](https://insights.sbomify.com/CVE-2020-5238/): Denial of service in table parsing in cmark-gfm (medium 6.5)
- [CVE-2020-5237](https://insights.sbomify.com/CVE-2020-5237/): Relative Path Traversal in oneup/uploader-bundle (high 8.8)
- [CVE-2020-5236](https://insights.sbomify.com/CVE-2020-5236/): Catastrophic backtracking in regex allows Denial of Service in Waitress (medium 5.7)
- [CVE-2020-5235](https://insights.sbomify.com/CVE-2020-5235/): Out-of-memory condition in Nanopb is potentially exploitable (medium 6.5)
- [CVE-2020-5234](https://insights.sbomify.com/CVE-2020-5234/): Untrusted data can lead to DoS attack in MessagePack for C# and Unity (medium 4.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/56/