# Vulnerabilities published in 2020


- [CVE-2020-5233](https://insights.sbomify.com/CVE-2020-5233/): Open Redirect in OAuth2 Proxy (medium 5.9)
- [CVE-2020-5232](https://insights.sbomify.com/CVE-2020-5232/): Ethereum Name Service - Malicious takeover of previously owned ENS names (high 8.7)
- [CVE-2020-5231](https://insights.sbomify.com/CVE-2020-5231/): Opencast users with ROLE_COURSE_ADMIN can create new users (medium 4.8)
- [CVE-2020-5230](https://insights.sbomify.com/CVE-2020-5230/): Opencast uses unsafe identifiers (high 7.7)
- [CVE-2020-5229](https://insights.sbomify.com/CVE-2020-5229/): Opencast stores passwords using outdated MD5 hash algorithm (high 7.7)
- [CVE-2020-5228](https://insights.sbomify.com/CVE-2020-5228/): Opencast allows unauthorized public access via OAI-PMH (high 7.6)
- [CVE-2020-5227](https://insights.sbomify.com/CVE-2020-5227/): Feedgen Vulnerable to XML Denial of Service Attacks (medium 4.4)
- [CVE-2020-5226](https://insights.sbomify.com/CVE-2020-5226/): Cross-site scripting in SimpleSAMLphp (medium 4.4)
- [CVE-2020-5225](https://insights.sbomify.com/CVE-2020-5225/): Log injection in SimpleSAMLphp (medium 4.4)
- [CVE-2020-5224](https://insights.sbomify.com/CVE-2020-5224/): Session key exposure through session list in Django User Sessions (medium 6.5)
- [CVE-2020-5223](https://insights.sbomify.com/CVE-2020-5223/): Persistent XSS vulnerability in filename of attached file in PrivateBin (medium 6.1)
- [CVE-2020-5222](https://insights.sbomify.com/CVE-2020-5222/): Hard-Coded Key Used For Remember-me Token in OpenCast (medium 6.8)
- [CVE-2020-5221](https://insights.sbomify.com/CVE-2020-5221/): Directory Traversal (Chroot Escape) vulnerability in uftpd (medium 6.5)
- [CVE-2020-5220](https://insights.sbomify.com/CVE-2020-5220/): Ability to expose data in Sylius by using an unintended serialisation group (medium 4.4)
- [CVE-2020-5219](https://insights.sbomify.com/CVE-2020-5219/): Remote Code Execution in Angular Expressions (high 8.7)
- [CVE-2020-5218](https://insights.sbomify.com/CVE-2020-5218/): Ability in Sylius to switch channels via GET parameter enabled in production environments (medium 4.4)
- [CVE-2020-5217](https://insights.sbomify.com/CVE-2020-5217/): Directive injection when using dynamic overrides with user input in RubyGems secure_headers (medium 4.4)
- [CVE-2020-5216](https://insights.sbomify.com/CVE-2020-5216/): Limited header injection when using dynamic overrides with user input in RubyGems secure_headers (medium 4.4)
- [CVE-2020-5215](https://insights.sbomify.com/CVE-2020-5215/): Segmentation faultin TensorFlow when converting a Python string to tf.float16 (medium 5.0)
- [CVE-2020-5214](https://insights.sbomify.com/CVE-2020-5214/): NetHack error recovery after syntax error in configuration file is subject to a buffer overflow (medium 5.0)
- [CVE-2020-5213](https://insights.sbomify.com/CVE-2020-5213/): NetHack SYMBOL configuration file option is subject to a buffer overflow (medium 5.0)
- [CVE-2020-5212](https://insights.sbomify.com/CVE-2020-5212/): NetHack MENUCOLOR configuration file option is subject to a buffer overflow (medium 5.0)
- [CVE-2020-5211](https://insights.sbomify.com/CVE-2020-5211/): NetHack AUTOCOMPLETE configuration file option is subject to a buffer overflow (medium 5.0)
- [CVE-2020-5210](https://insights.sbomify.com/CVE-2020-5210/): NetHack command line -w option parsing is subject to a buffer overflow (medium 5.0)
- [CVE-2020-5209](https://insights.sbomify.com/CVE-2020-5209/): NetHack command line parsing of options starting with -de and -i is subject to a buffer overflow (medium 5.0)
- [CVE-2020-5208](https://insights.sbomify.com/CVE-2020-5208/): remote code execution vulnerability in ipmitool (high 7.7)
- [CVE-2020-5207](https://insights.sbomify.com/CVE-2020-5207/): Request smuggling is possible in Ktor when both chunked TE and content length specified (medium 5.4)
- [CVE-2020-5206](https://insights.sbomify.com/CVE-2020-5206/): Authentication Bypass For Endpoints With Anonymous Access in OpenCast (high 8.7)
- [CVE-2020-5205](https://insights.sbomify.com/CVE-2020-5205/): Session fixation attack in Pow (Hex package) (medium 6.5)
- [CVE-2020-5204](https://insights.sbomify.com/CVE-2020-5204/): Buffer overflow vulnerability in uftpd (medium 6.5)
- [CVE-2020-5203](https://insights.sbomify.com/CVE-2020-5203/): Fat-Free Framework arbitrary code execution (critical 9.8)
- [CVE-2020-5202](https://insights.sbomify.com/CVE-2020-5202/): Information disclosure in apt-cacher-ng project:apt-cacher-ng (medium 5.5)
- [CVE-2020-5200](https://insights.sbomify.com/CVE-2020-5200/): Minerbabe through V4.16 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identif (medium 5.9)
- [CVE-2020-5197](https://insights.sbomify.com/CVE-2020-5197/): Missing authorization in gitlab:gitlab (medium 4.3)
- [CVE-2020-5196](https://insights.sbomify.com/CVE-2020-5196/): Missing authorization in cerberusftp:ftp server (high 8.1)
- [CVE-2020-5195](https://insights.sbomify.com/CVE-2020-5195/): Cross-site scripting in cerberusftp:ftp server (medium 6.1)
- [CVE-2020-5194](https://insights.sbomify.com/CVE-2020-5194/): Missing authorization in cerberusftp:ftp server (medium 5.4)
- [CVE-2020-5193](https://insights.sbomify.com/CVE-2020-5193/): Cross-site scripting in phpgurukul:hospital management system (medium 6.1)
- [CVE-2020-5192](https://insights.sbomify.com/CVE-2020-5192/): SQL injection in phpgurukul:hospital management system (high 8.8)
- [CVE-2020-5191](https://insights.sbomify.com/CVE-2020-5191/): Cross-site scripting in phpgurukul:hospital management system (medium 6.1)
- [CVE-2020-5188](https://insights.sbomify.com/CVE-2020-5188/): DNN File Upload Vulnerability (medium 6.5)
- [CVE-2020-5187](https://insights.sbomify.com/CVE-2020-5187/): DNN Path Traversal via Zip Slip (high 8.8)
- [CVE-2020-5186](https://insights.sbomify.com/CVE-2020-5186/): DNN XSS Vulnerability (medium 5.4)
- [CVE-2020-5183](https://insights.sbomify.com/CVE-2020-5183/): Memory corruption in ftpgetter:ftpgetter (high 7.5)
- [CVE-2020-5182](https://insights.sbomify.com/CVE-2020-5182/): Other in cmsjunkie:j-businessdirectory (medium 6.5)
- [CVE-2020-5180](https://insights.sbomify.com/CVE-2020-5180/): Privilege escalation in sparklabs:viscosity (high 7.8)
- [CVE-2020-5179](https://insights.sbomify.com/CVE-2020-5179/): Command injection in comtech:stampede fx-1010 firmware (high 7.2)
- [CVE-2020-5148](https://insights.sbomify.com/CVE-2020-5148/): Auth bypass in Directory Services Connector (high 8.2)
- [CVE-2020-5147](https://insights.sbomify.com/CVE-2020-5147/): Privilege escalation in SonicWall NetExtender (medium 5.3)
- [CVE-2020-5146](https://insights.sbomify.com/CVE-2020-5146/): Command injection in SMA100 (high 7.2)
- [CVE-2020-5145](https://insights.sbomify.com/CVE-2020-5145/): Other in SonicWall Global VPN Client (high 8.6)
- [CVE-2020-5144](https://insights.sbomify.com/CVE-2020-5144/): Privilege escalation in SonicWall Global VPN Client (high 7.8)
- [CVE-2020-5143](https://insights.sbomify.com/CVE-2020-5143/): Information disclosure in SonicOS (medium 5.3)
- [CVE-2020-5142](https://insights.sbomify.com/CVE-2020-5142/): Cross-site scripting in SonicOS (medium 6.1)
- [CVE-2020-5141](https://insights.sbomify.com/CVE-2020-5141/): Auth bypass in SonicOS (medium 6.5)
- [CVE-2020-5140](https://insights.sbomify.com/CVE-2020-5140/): Denial of service in SonicOS (high 7.5)
- [CVE-2020-5139](https://insights.sbomify.com/CVE-2020-5139/): Memory corruption in SonicOS (high 7.5)
- [CVE-2020-5138](https://insights.sbomify.com/CVE-2020-5138/): Memory corruption in SonicOS (high 7.5)
- [CVE-2020-5137](https://insights.sbomify.com/CVE-2020-5137/): Memory corruption in SonicOS (high 7.5)
- [CVE-2020-5136](https://insights.sbomify.com/CVE-2020-5136/): Memory corruption in SonicOS (medium 6.5)
- [CVE-2020-5135](https://insights.sbomify.com/CVE-2020-5135/): SonicWall SonicOS Buffer Overflow (critical 9.8, exploited in the wild)
- [CVE-2020-5134](https://insights.sbomify.com/CVE-2020-5134/): Memory corruption in SonicOS (medium 6.5)
- [CVE-2020-5133](https://insights.sbomify.com/CVE-2020-5133/): Memory corruption in SonicOS (high 7.5)
- [CVE-2020-5132](https://insights.sbomify.com/CVE-2020-5132/): Misconfiguration in SMA100 (medium 5.3)
- [CVE-2020-5131](https://insights.sbomify.com/CVE-2020-5131/): Other in SonicWall NetExtender (high 7.8)
- [CVE-2020-5130](https://insights.sbomify.com/CVE-2020-5130/): Other in SonicOS (medium 5.3)
- [CVE-2020-5129](https://insights.sbomify.com/CVE-2020-5129/): Denial of service in SMA1000 (high 7.5)
- [CVE-2020-5032](https://insights.sbomify.com/CVE-2020-5032/): Denial of service in QRadar SIEM (low 3.1)
- [CVE-2020-5031](https://insights.sbomify.com/CVE-2020-5031/): Cross-site scripting in Engineering Lifecycle Optimization (medium 5.4)
- [CVE-2020-5030](https://insights.sbomify.com/CVE-2020-5030/): Cross-site scripting in Engineering Lifecycle Optimization (medium 5.4)
- [CVE-2020-5026](https://insights.sbomify.com/CVE-2020-5026/): Information disclosure in Financial Transaction Manager (medium 4.3)
- [CVE-2020-5025](https://insights.sbomify.com/CVE-2020-5025/): Memory corruption in DB2 for Linux, UNIX and Windows (high 8.4)
- [CVE-2020-5024](https://insights.sbomify.com/CVE-2020-5024/): Denial of service in DB2 for Linux, UNIX and Windows (high 7.5)
- [CVE-2020-5023](https://insights.sbomify.com/CVE-2020-5023/): Denial of service in Spectrum Protect Plus (high 7.5)
- [CVE-2020-5022](https://insights.sbomify.com/CVE-2020-5022/): Missing authorization in Spectrum Protect Plus (medium 5.3)
- [CVE-2020-5021](https://insights.sbomify.com/CVE-2020-5021/): Auth bypass in Spectrum Protect Plus (medium 4.0)
- [CVE-2020-5020](https://insights.sbomify.com/CVE-2020-5020/): Other in Spectrum Protect Plus (medium 6.1)
- [CVE-2020-5019](https://insights.sbomify.com/CVE-2020-5019/): Other in Spectrum Protect Plus (medium 6.5)
- [CVE-2020-5018](https://insights.sbomify.com/CVE-2020-5018/): Information disclosure in Spectrum Protect Plus (low 3.7)
- [CVE-2020-5017](https://insights.sbomify.com/CVE-2020-5017/): Information disclosure in Spectrum Protect Plus (low 2.9)
- [CVE-2020-5016](https://insights.sbomify.com/CVE-2020-5016/): Path traversal in WebSphere Application Server (medium 5.3)
- [CVE-2020-5015](https://insights.sbomify.com/CVE-2020-5015/): Denial of service in Elastic Storage Server (high 7.5)
- [CVE-2020-5014](https://insights.sbomify.com/CVE-2020-5014/): Server-side request forgery in DataPower Gateway (medium 6.7)
- [CVE-2020-5013](https://insights.sbomify.com/CVE-2020-5013/): XML external entity in QRadar SIEM (high 7.1)
- [CVE-2020-5008](https://insights.sbomify.com/CVE-2020-5008/): Information disclosure in DataPower Gateway (low 3.7)
- [CVE-2020-5004](https://insights.sbomify.com/CVE-2020-5004/): Cross-site scripting in Engineering Lifecycle Optimization (medium 5.4)
- [CVE-2020-5003](https://insights.sbomify.com/CVE-2020-5003/): XML external entity in Financial Transaction Manager (medium 6.5)
- [CVE-2020-5002](https://insights.sbomify.com/CVE-2020-5002/): IBM Financial Transaction Manager security bypass (medium 4.3)
- [CVE-2020-5001](https://insights.sbomify.com/CVE-2020-5001/): IBM Financial Transaction Manager path traversal (medium 4.3)
- [CVE-2020-5000](https://insights.sbomify.com/CVE-2020-5000/): Cross-site scripting in Financial Transaction Manager (medium 5.4)
- [CVE-2020-4997](https://insights.sbomify.com/CVE-2020-4997/): Cross-site scripting in InfoSphere Information Server (medium 5.4)
- [CVE-2020-4996](https://insights.sbomify.com/CVE-2020-4996/): Information disclosure in Security Identity Governance and Intelligence (medium 6.5)
- [CVE-2020-4995](https://insights.sbomify.com/CVE-2020-4995/): Auth bypass in Security Identity Governance and Intelligence (medium 4.0)
- [CVE-2020-4994](https://insights.sbomify.com/CVE-2020-4994/): Denial of service in DataPower Gateway (medium 5.3)
- [CVE-2020-4993](https://insights.sbomify.com/CVE-2020-4993/): Path traversal in QRadar SIEM (medium 4.9)
- [CVE-2020-4992](https://insights.sbomify.com/CVE-2020-4992/): Cross-site request forgery in DataPower Gateway (medium 4.3)
- [CVE-2020-4990](https://insights.sbomify.com/CVE-2020-4990/): SQL injection in Security Guardium (high 7.6)
- [CVE-2020-4989](https://insights.sbomify.com/CVE-2020-4989/): Information disclosure in Engineering Workflow Management (medium 4.3)
- [CVE-2020-4988](https://insights.sbomify.com/CVE-2020-4988/): Cross-site scripting in Loopback (high 7.3)
- [CVE-2020-4987](https://insights.sbomify.com/CVE-2020-4987/): Cross-site scripting in FlashSystem 900 (medium 6.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/57/