# Vulnerabilities published in 2020


- [CVE-2020-4159](https://insights.sbomify.com/CVE-2020-4159/): Information disclosure in QRadar Network Security (medium 5.3)
- [CVE-2020-4157](https://insights.sbomify.com/CVE-2020-4157/): Hardcoded credentials in QRadar Network Security (medium 6.8)
- [CVE-2020-4153](https://insights.sbomify.com/CVE-2020-4153/): Cross-site scripting in QRadar Network Security (medium 5.4)
- [CVE-2020-4152](https://insights.sbomify.com/CVE-2020-4152/): Information disclosure in QRadar Network Security (medium 6.8)
- [CVE-2020-4151](https://insights.sbomify.com/CVE-2020-4151/): Other in QRadar SIEM (medium 6.5)
- [CVE-2020-4150](https://insights.sbomify.com/CVE-2020-4150/): Hardcoded credentials in Security SiteProtector System (medium 6.8)
- [CVE-2020-4146](https://insights.sbomify.com/CVE-2020-4146/): Misconfiguration in Security SiteProtector System (medium 4.0)
- [CVE-2020-4140](https://insights.sbomify.com/CVE-2020-4140/): Cross-site scripting in Security SiteProtector System (medium 5.4)
- [CVE-2020-4138](https://insights.sbomify.com/CVE-2020-4138/): Information disclosure in Security SiteProtector System (medium 4.0)
- [CVE-2020-4135](https://insights.sbomify.com/CVE-2020-4135/): Denial of service in DB2 for Linux- UNIX and Windows (high 7.5)
- [CVE-2020-4129](https://insights.sbomify.com/CVE-2020-4129/): Security feature bypass in HCL Domino (medium 5.3)
- [CVE-2020-4128](https://insights.sbomify.com/CVE-2020-4128/): Security feature bypass in HCL Domino (medium 5.3)
- [CVE-2020-4127](https://insights.sbomify.com/CVE-2020-4127/): Cross-site request forgery in HCL Domino (medium 6.5)
- [CVE-2020-4126](https://insights.sbomify.com/CVE-2020-4126/): Information disclosure in HCL iNotes (medium 5.9)
- [CVE-2020-4125](https://insights.sbomify.com/CVE-2020-4125/): Information disclosure in "HCL Marketing Operations" (high 8.1)
- [CVE-2020-4107](https://insights.sbomify.com/CVE-2020-4107/): HCL Domino is affected by an Insufficient Access Control vulnerability (high 8.8)
- [CVE-2020-4104](https://insights.sbomify.com/CVE-2020-4104/): Cross-site scripting in HCL BigFix WebUI (medium 5.4)
- [CVE-2020-4102](https://insights.sbomify.com/CVE-2020-4102/): Memory corruption in HCL Notes (medium 6.7)
- [CVE-2020-4101](https://insights.sbomify.com/CVE-2020-4101/): Server-side request forgery in "HCL Digital Experience" (critical 9.8)
- [CVE-2020-4100](https://insights.sbomify.com/CVE-2020-4100/): Code injection in "HCL Verse for Android" (medium 4.4)
- [CVE-2020-4099](https://insights.sbomify.com/CVE-2020-4099/): HCL Verse for Android is susceptible to an APK signing key check vulnerability (medium 5.9)
- [CVE-2020-4097](https://insights.sbomify.com/CVE-2020-4097/): Memory corruption in HCL Notes (medium 6.8)
- [CVE-2020-4095](https://insights.sbomify.com/CVE-2020-4095/): Information disclosure in "HCL BigFix Platform" (medium 6.0)
- [CVE-2020-4092](https://insights.sbomify.com/CVE-2020-4092/): Information disclosure in "HCL Nomad" (medium 5.3)
- [CVE-2020-4089](https://insights.sbomify.com/CVE-2020-4089/): Information disclosure in HCL Notes (medium 6.5)
- [CVE-2020-4085](https://insights.sbomify.com/CVE-2020-4085/): Information disclosure in "HCL Connections" (medium 6.5)
- [CVE-2020-4084](https://insights.sbomify.com/CVE-2020-4084/): Cross-site scripting in HCL Connections (medium 5.4)
- [CVE-2020-4083](https://insights.sbomify.com/CVE-2020-4083/): Information disclosure in "HCL Connections" (medium 5.5)
- [CVE-2020-4082](https://insights.sbomify.com/CVE-2020-4082/): Cross-site scripting in "HCL Connections" (medium 5.4)
- [CVE-2020-4081](https://insights.sbomify.com/CVE-2020-4081/): Cross-site scripting in HCL Digital Experience (medium 6.1)
- [CVE-2020-4080](https://insights.sbomify.com/CVE-2020-4080/): Cross-site scripting in HCL Verse (medium 6.1)
- [CVE-2020-4079](https://insights.sbomify.com/CVE-2020-4079/): Information disclosure vulnerability in iTop (high 7.7)
- [CVE-2020-4077](https://insights.sbomify.com/CVE-2020-4077/): Context isolation bypass via contextBridge in Electron (high 7.7)
- [CVE-2020-4076](https://insights.sbomify.com/CVE-2020-4076/): Context isolation bypass via leaked cross-context objects in Electron (high 7.8)
- [CVE-2020-4075](https://insights.sbomify.com/CVE-2020-4075/): Arbitrary file read via window-open IPC in Electron (medium 6.8)
- [CVE-2020-4074](https://insights.sbomify.com/CVE-2020-4074/): Improper Authentication (high 8.9)
- [CVE-2020-4072](https://insights.sbomify.com/CVE-2020-4072/): Log Forging in generator-jhipster-kotlin (medium 5.3)
- [CVE-2020-4071](https://insights.sbomify.com/CVE-2020-4071/): Timing attack on django-basic-auth-ip-whitelist (low 2.2)
- [CVE-2020-4070](https://insights.sbomify.com/CVE-2020-4070/): Cross-site Scripting in CSS Validator (medium 4.6)
- [CVE-2020-4068](https://insights.sbomify.com/CVE-2020-4068/): Heap-based Buffer Overflow in APNSwift (medium 6.3)
- [CVE-2020-4067](https://insights.sbomify.com/CVE-2020-4067/): Improper Initialization in coturn (high 7.0)
- [CVE-2020-4066](https://insights.sbomify.com/CVE-2020-4066/): Command Injection in Limdu trainBatch function (low 3.8)
- [CVE-2020-4062](https://insights.sbomify.com/CVE-2020-4062/): Improper Access Control in Conjur OSS Helm Chart (high 8.7)
- [CVE-2020-4061](https://insights.sbomify.com/CVE-2020-4061/): Cross-site Scripting in OctoberPotential self-XSS when pasting content from malicious websites (low 3.7)
- [CVE-2020-4060](https://insights.sbomify.com/CVE-2020-4060/): Use After Free in in cups_update_info in LoRa Basics Station (medium 4.1)
- [CVE-2020-4059](https://insights.sbomify.com/CVE-2020-4059/): Command Injection in mversion (high 7.3)
- [CVE-2020-4054](https://insights.sbomify.com/CVE-2020-4054/): Cross-site Scripting in Sanitize (high 7.3)
- [CVE-2020-4053](https://insights.sbomify.com/CVE-2020-4053/): Path Traversal in Helm Plugin Archive (low 3.7)
- [CVE-2020-4052](https://insights.sbomify.com/CVE-2020-4052/): Stored XSS through template injection in Wiki.js (medium 6.3)
- [CVE-2020-4051](https://insights.sbomify.com/CVE-2020-4051/): XSS in Dijit Editor's LinkDialog plugin (low 3.7)
- [CVE-2020-4050](https://insights.sbomify.com/CVE-2020-4050/): set-screen-option filter misuse by plugins leading to privilege escalation in WordPress (low 3.5)
- [CVE-2020-4049](https://insights.sbomify.com/CVE-2020-4049/): Authenticated self-XSS via theme uploads in WordPress (low 2.4)
- [CVE-2020-4048](https://insights.sbomify.com/CVE-2020-4048/): Open redirect in wp_validate_redirect() in WordPress (medium 5.7)
- [CVE-2020-4047](https://insights.sbomify.com/CVE-2020-4047/): Authenticated XSS via media attachment page in WordPress (medium 6.8)
- [CVE-2020-4046](https://insights.sbomify.com/CVE-2020-4046/): Authenticated XSS through embed block in WordPress (medium 5.4)
- [CVE-2020-4045](https://insights.sbomify.com/CVE-2020-4045/): Information disclosure in SSB-DB (high 7.5)
- [CVE-2020-4044](https://insights.sbomify.com/CVE-2020-4044/): Local users can perform a buffer overflow attack against the xrdp-sesman service and then impersonate it (high 7.5)
- [CVE-2020-4043](https://insights.sbomify.com/CVE-2020-4043/): Phar unserialization vulnerability in phpMussel (high 7.7)
- [CVE-2020-4042](https://insights.sbomify.com/CVE-2020-4042/): Authentication bypass in Bareos (medium 6.8)
- [CVE-2020-4041](https://insights.sbomify.com/CVE-2020-4041/): The filename of uploaded files vulnerable to stored XSS in Bolt CMS (high 7.4)
- [CVE-2020-4040](https://insights.sbomify.com/CVE-2020-4040/): CSRF issue on preview pages in Bolt CMS (high 8.6)
- [CVE-2020-4039](https://insights.sbomify.com/CVE-2020-4039/): Directory Traversal Vulnerability in SUSI.AI Server (high 8.6)
- [CVE-2020-4038](https://insights.sbomify.com/CVE-2020-4038/): Reflected XSS in GraphQL Playground (high 7.4)
- [CVE-2020-4037](https://insights.sbomify.com/CVE-2020-4037/): Open Redirect in OAuth2 Proxy (medium 4.3)
- [CVE-2020-4035](https://insights.sbomify.com/CVE-2020-4035/): DoS or local data modification via malicious record IDs in WatermelonDB (medium 5.9)
- [CVE-2020-4033](https://insights.sbomify.com/CVE-2020-4033/): OOB Read in RLEDECOMPRESS in FreeRDP (low 3.1)
- [CVE-2020-4032](https://insights.sbomify.com/CVE-2020-4032/): Integer casting vulnerability in `update_recv_secondary_order` in FreeRDP (low 3.1)
- [CVE-2020-4031](https://insights.sbomify.com/CVE-2020-4031/): Use-After-Free in gdi_SelectObject in FreeRDP (low 3.5)
- [CVE-2020-4030](https://insights.sbomify.com/CVE-2020-4030/): OOB read in `TrioParse` in FreeRDP (low 3.5)
- [CVE-2020-4029](https://insights.sbomify.com/CVE-2020-4029/): Missing authorization in Jira Server and Data Center (medium 4.3)
- [CVE-2020-4028](https://insights.sbomify.com/CVE-2020-4028/): Information disclosure in Jira Server and Data Center (medium 5.3)
- [CVE-2020-4027](https://insights.sbomify.com/CVE-2020-4027/): Code injection in Confluence Data Center (medium 4.7)
- [CVE-2020-4026](https://insights.sbomify.com/CVE-2020-4026/): Missing authorization in Crucible (medium 4.3)
- [CVE-2020-4025](https://insights.sbomify.com/CVE-2020-4025/): Cross-site scripting in Jira Server and Data Center (medium 4.8)
- [CVE-2020-4024](https://insights.sbomify.com/CVE-2020-4024/): Cross-site scripting in Jira Server and Data Center (medium 5.4)
- [CVE-2020-4023](https://insights.sbomify.com/CVE-2020-4023/): Cross-site scripting in Crucible (medium 5.4)
- [CVE-2020-4022](https://insights.sbomify.com/CVE-2020-4022/): Cross-site scripting in Jira Server and Data Center (medium 6.1)
- [CVE-2020-4021](https://insights.sbomify.com/CVE-2020-4021/): Cross-site scripting in Jira Server and Data Center (medium 5.4)
- [CVE-2020-4020](https://insights.sbomify.com/CVE-2020-4020/): Security feature bypass in Companion App (high 7.2)
- [CVE-2020-4019](https://insights.sbomify.com/CVE-2020-4019/): Other in Companion App (high 7.8)
- [CVE-2020-4018](https://insights.sbomify.com/CVE-2020-4018/): Cross-site request forgery in Crucible (high 8.8)
- [CVE-2020-4017](https://insights.sbomify.com/CVE-2020-4017/): Information disclosure in Crucible (medium 5.3)
- [CVE-2020-4016](https://insights.sbomify.com/CVE-2020-4016/): Information disclosure in Crucible (medium 5.3)
- [CVE-2020-4015](https://insights.sbomify.com/CVE-2020-4015/): Information disclosure in Crucible (medium 4.3)
- [CVE-2020-4014](https://insights.sbomify.com/CVE-2020-4014/): Missing authorization in Crucible (medium 4.3)
- [CVE-2020-4013](https://insights.sbomify.com/CVE-2020-4013/): Cross-site scripting in Crucible (medium 5.4)
- [CVE-2020-4008](https://insights.sbomify.com/CVE-2020-4008/): Other in VMware Carbon Black Cloud macOS Sensor (low 3.6)
- [CVE-2020-4006](https://insights.sbomify.com/CVE-2020-4006/): Multiple VMware Products Command Injection (critical 9.1, exploited in the wild)
- [CVE-2020-4005](https://insights.sbomify.com/CVE-2020-4005/): Privilege escalation in VMware ESXi (high 7.8)
- [CVE-2020-4004](https://insights.sbomify.com/CVE-2020-4004/): Use after free in Fusion (high 8.2)
- [CVE-2020-4003](https://insights.sbomify.com/CVE-2020-4003/): SQL injection in VMware SD-WAN Orchestrator (medium 6.5)
- [CVE-2020-4002](https://insights.sbomify.com/CVE-2020-4002/): Code injection in VMware SD-WAN Orchestrator (high 7.2)
- [CVE-2020-4001](https://insights.sbomify.com/CVE-2020-4001/): Hardcoded credentials in VMware SD-WAN Orchestrator (critical 9.8)
- [CVE-2020-4000](https://insights.sbomify.com/CVE-2020-4000/): Path traversal in VMware SD-WAN Orchestrator (high 8.8)
- [CVE-2020-3999](https://insights.sbomify.com/CVE-2020-3999/): Denial of service in VMware ESXi, VMware Workstation,VMware Fusion and VMware Cloud Foundation (medium 6.5)
- [CVE-2020-3998](https://insights.sbomify.com/CVE-2020-3998/): Information disclosure in VMware Horizon Client for Windows (medium 6.5)
- [CVE-2020-3997](https://insights.sbomify.com/CVE-2020-3997/): Cross-site scripting in VMware Horizon Server (medium 5.4)
- [CVE-2020-3996](https://insights.sbomify.com/CVE-2020-3996/): Information disclosure in Velero (medium 5.5)
- [CVE-2020-3995](https://insights.sbomify.com/CVE-2020-3995/): Denial of service in VMware ESXi, Workstation, Fusion (medium 5.3)
- [CVE-2020-3994](https://insights.sbomify.com/CVE-2020-3994/): Security feature bypass in vCenter Server (high 7.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/64/