# Vulnerabilities published in 2020


- [CVE-2020-37034](https://insights.sbomify.com/CVE-2020-37034/): HelloWeb 2.0 - Arbitrary File Download (high 8.7)
- [CVE-2020-37033](https://insights.sbomify.com/CVE-2020-37033/): Infor Storefront B2B 1.0 - 'usr_name' SQL Injection (high 8.8)
- [CVE-2020-37032](https://insights.sbomify.com/CVE-2020-37032/): Wing FTP Server 6.3.8 - Remote Code Execution (high 8.6)
- [CVE-2020-37031](https://insights.sbomify.com/CVE-2020-37031/): Simple Startup Manager 1.17 - 'File' Local Buffer Overflow (high 8.6)
- [CVE-2020-37030](https://insights.sbomify.com/CVE-2020-37030/): Outline Service 1.3.3 - 'Outline Service ' Unquoted Service Path (high 8.5)
- [CVE-2020-3703](https://insights.sbomify.com/CVE-2020-3703/): Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music (critical 9.8)
- [CVE-2020-37029](https://insights.sbomify.com/CVE-2020-37029/): FTPDummy 4.80 - Local Buffer Overflow (high 8.4)
- [CVE-2020-37028](https://insights.sbomify.com/CVE-2020-37028/): Socusoft Photo to Video Converter Professional 8.07 - 'Output Folder' Buffer Overflow (high 8.4)
- [CVE-2020-37027](https://insights.sbomify.com/CVE-2020-37027/): Sickbeard 0.1 - Remote Command Injection (critical 9.3)
- [CVE-2020-37026](https://insights.sbomify.com/CVE-2020-37026/): Sickbeard 0.1 - Cross-Site Request Forgery (medium 5.1)
- [CVE-2020-37025](https://insights.sbomify.com/CVE-2020-37025/): Port Forwarding Wizard 4.8.0 - Buffer Overflow (high 8.4)
- [CVE-2020-37024](https://insights.sbomify.com/CVE-2020-37024/): Nidesoft DVD Ripper 5.2.18 - Local Buffer Overflow (high 8.4)
- [CVE-2020-37023](https://insights.sbomify.com/CVE-2020-37023/): Koken CMS 0.22.24 - Arbitrary File Upload (high 8.7)
- [CVE-2020-37022](https://insights.sbomify.com/CVE-2020-37022/): OpenZ ERP 3.6.60 - Persistent Cross-Site Scripting (medium 5.1)
- [CVE-2020-37021](https://insights.sbomify.com/CVE-2020-37021/): Bandwidth Monitor 3.9 - 'Svc10StrikeBandMontitor' Unquoted Service Path (high 8.5)
- [CVE-2020-37020](https://insights.sbomify.com/CVE-2020-37020/): SonarQube 8.3.1 - Unquoted Service Path (high 8.5)
- [CVE-2020-3702](https://insights.sbomify.com/CVE-2020-3702/): Weak cryptography in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking (medium 6.5)
- [CVE-2020-37019](https://insights.sbomify.com/CVE-2020-37019/): Orchard Core RC1 - Persistent Cross-Site Scripting (medium 5.1)
- [CVE-2020-37018](https://insights.sbomify.com/CVE-2020-37018/): GOautodial 4.0 - Persistent Cross-Site Scripting (medium 5.1)
- [CVE-2020-37017](https://insights.sbomify.com/CVE-2020-37017/): CodeMeter 6.60 - 'CodeMeter.exe' Unquoted Service Path (high 8.5)
- [CVE-2020-37016](https://insights.sbomify.com/CVE-2020-37016/): BarcodeOCR 19.3.6 - 'BarcodeOCR' Unquoted Service Path (high 8.5)
- [CVE-2020-37015](https://insights.sbomify.com/CVE-2020-37015/): Ruijie Networks Switch eWeb S29_RGOS 11.4 - Directory Traversal (high 7.1)
- [CVE-2020-37014](https://insights.sbomify.com/CVE-2020-37014/): Tryton 5.4 - Persistent Cross-Site Scripting (medium 5.1)
- [CVE-2020-37013](https://insights.sbomify.com/CVE-2020-37013/): Audio Playback Recorder 3.2.2 - Local Buffer Overflow (SEH) (high 8.4)
- [CVE-2020-37012](https://insights.sbomify.com/CVE-2020-37012/): Tea LaTex 1.0 - Remote Code Execution (critical 9.3)
- [CVE-2020-37011](https://insights.sbomify.com/CVE-2020-37011/): Gnome Fonts Viewer 3.34.0 Heap Corruption (high 8.4)
- [CVE-2020-37010](https://insights.sbomify.com/CVE-2020-37010/): BearShare Lite 5.2.5 - 'Advanced Search'Buffer Overflow in (PoC) (high 8.4)
- [CVE-2020-3701](https://insights.sbomify.com/CVE-2020-3701/): Use after free in Snapdragon Mobile (high 7.8)
- [CVE-2020-37009](https://insights.sbomify.com/CVE-2020-37009/): MedDream PACS Server 6.8.3.751 - Remote Code Execution (high 8.7)
- [CVE-2020-37008](https://insights.sbomify.com/CVE-2020-37008/): EasyPMS 1.0.0 - Authentication Bypass (high 8.7)
- [CVE-2020-37007](https://insights.sbomify.com/CVE-2020-37007/): Liman 0.7 - Cross-Site Request Forgery (Change Password) (medium 5.1)
- [CVE-2020-37006](https://insights.sbomify.com/CVE-2020-37006/): berliCRM 1.0.24 - 'src_record' SQL Injection (high 7.1)
- [CVE-2020-37005](https://insights.sbomify.com/CVE-2020-37005/): TimeClock Software 1.01 Authenticated Time-Based SQL Injection (high 7.1)
- [CVE-2020-37004](https://insights.sbomify.com/CVE-2020-37004/): Ultimate Project Manager CRM PRO 2.0.5 - SQLi Credentials Leakage (high 7.1)
- [CVE-2020-37003](https://insights.sbomify.com/CVE-2020-37003/): Sellacious eCommerce 4.6 - Persistent Cross-Site Scripting (medium 5.1)
- [CVE-2020-37002](https://insights.sbomify.com/CVE-2020-37002/): Ajenti 2.1.36 Authenticated Remote Code Execution (high 8.7)
- [CVE-2020-37001](https://insights.sbomify.com/CVE-2020-37001/): Frigate Professional 3.36.0.9 - 'Pack File' Buffer Overflow (SEH Egghunter) (high 8.4)
- [CVE-2020-37000](https://insights.sbomify.com/CVE-2020-37000/): Free MP3 CD Ripper 2.8 - Stack Buffer Overflow (SEH + Egghunter) (high 8.4)
- [CVE-2020-3700](https://insights.sbomify.com/CVE-2020-3700/): Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking (high 7.5)
- [CVE-2020-36999](https://insights.sbomify.com/CVE-2020-36999/): elaniin CMS 1.0 - Authentication Bypass (high 8.8)
- [CVE-2020-36998](https://insights.sbomify.com/CVE-2020-36998/): forma.lms The E-Learning Suite 2.3.0.2 - Persistent Cross-Site Scripting (medium 5.1)
- [CVE-2020-36997](https://insights.sbomify.com/CVE-2020-36997/): BacklinkSpeed 2.4 - Buffer Overflow PoC (SEH) (high 8.4)
- [CVE-2020-36996](https://insights.sbomify.com/CVE-2020-36996/): PHPFusion 9.03.50 - Persistent Cross-Site Scripting (medium 5.1)
- [CVE-2020-36995](https://insights.sbomify.com/CVE-2020-36995/): Mocha Telnet Lite for iOS 4.2 - 'User' Denial of Service (medium 4.6)
- [CVE-2020-36994](https://insights.sbomify.com/CVE-2020-36994/): QlikView 12.50.20000.0 - 'FTP Server Address' Denial of Service (medium 4.6)
- [CVE-2020-36993](https://insights.sbomify.com/CVE-2020-36993/): LimeSurvey <= 4.3.10 - 'Survey Menu' Persistent Cross-Site Scripting (medium 5.1)
- [CVE-2020-36992](https://insights.sbomify.com/CVE-2020-36992/): Nord VPN-6.31.13.0 - 'nordvpn-service' Unquoted Service Path (high 8.5)
- [CVE-2020-36991](https://insights.sbomify.com/CVE-2020-36991/): ShareMouse 5.0.43 - 'ShareMouse Service' Unquoted Service Path (high 8.5)
- [CVE-2020-36990](https://insights.sbomify.com/CVE-2020-36990/): Input Director 1.4.3 - 'Input Director' Unquoted Service Path (high 8.5)
- [CVE-2020-3699](https://insights.sbomify.com/CVE-2020-3699/): Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables (critical 9.8)
- [CVE-2020-36989](https://insights.sbomify.com/CVE-2020-36989/): ForensiTAppxService 2.2.0.4 - 'ForensiTAppxService.exe' Unquoted Service Path (high 8.5)
- [CVE-2020-36988](https://insights.sbomify.com/CVE-2020-36988/): PDW File Browser <= v1.3 - Cross-Site Scripting (XSS) (medium 4.8)
- [CVE-2020-36987](https://insights.sbomify.com/CVE-2020-36987/): Program Access Controller v1.2.0.0 - 'PACService.exe' Unquoted Service Path (high 8.5)
- [CVE-2020-36986](https://insights.sbomify.com/CVE-2020-36986/): Prey 1.9.6 - "CronService" Unquoted Service Path (high 8.5)
- [CVE-2020-36985](https://insights.sbomify.com/CVE-2020-36985/): IP Watcher v3.0.0.30 - 'PACService.exe' Unquoted Service Path (high 8.5)
- [CVE-2020-36984](https://insights.sbomify.com/CVE-2020-36984/): EPSON 1.124 - 'seksmdb.exe' Unquoted Service Path (high 8.5)
- [CVE-2020-36983](https://insights.sbomify.com/CVE-2020-36983/): Quick 'n Easy FTP Service 3.2 - Unquoted Service Path (high 8.5)
- [CVE-2020-36982](https://insights.sbomify.com/CVE-2020-36982/): Motorola Device Manager 2.5.4 - 'MotoHelperService.exe' Unquoted Service Path (high 8.5)
- [CVE-2020-36981](https://insights.sbomify.com/CVE-2020-36981/): Motorola Device Manager 2.4.5 - 'ForwardDaemon.exe ' Unquoted Service Path (high 8.5)
- [CVE-2020-36980](https://insights.sbomify.com/CVE-2020-36980/): SAntivirus IC 10.0.21.61 - 'SAntivirusIC' Unquoted Service Path (high 8.5)
- [CVE-2020-3698](https://insights.sbomify.com/CVE-2020-3698/): Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables (critical 9.8)
- [CVE-2020-36979](https://insights.sbomify.com/CVE-2020-36979/): Atheros Coex Service Application 8.0.0.255 -'ZAtheros Bt&Wlan Coex Agent' Unquoted Service Path (high 8.5)
- [CVE-2020-36978](https://insights.sbomify.com/CVE-2020-36978/): Froxlor Froxlor Server Management Panel 0.10.16 - Persistent Cross-Site Scripting (medium 5.1)
- [CVE-2020-36977](https://insights.sbomify.com/CVE-2020-36977/): Wondershare Driver Install Service help 10.7.1.321 - 'ElevationService' Unquote Service Path (high 8.5)
- [CVE-2020-36976](https://insights.sbomify.com/CVE-2020-36976/): Global Registration Service 1.0.0.3 - 'GREGsvc.exe' Unquoted Service Path (high 8.5)
- [CVE-2020-36975](https://insights.sbomify.com/CVE-2020-36975/): EPSON Status Monitor 3 'EPSON_PM_RPCV4_06' - Unquoted Service Path (high 8.5)
- [CVE-2020-36974](https://insights.sbomify.com/CVE-2020-36974/): Realtek Andrea RT Filters 1.0.64.7 - 'AERTSr64.EXE' Unquoted Service Path (high 8.5)
- [CVE-2020-36973](https://insights.sbomify.com/CVE-2020-36973/): PDW File Browser 1.3 - Remote Code Execution (high 8.7)
- [CVE-2020-36972](https://insights.sbomify.com/CVE-2020-36972/): SmartBlog 2.0.1 - 'id_post' Blind SQL injection (high 8.8)
- [CVE-2020-36971](https://insights.sbomify.com/CVE-2020-36971/): Nidesoft 3GP Video Converter 2.6.18 - Local Stack Buffer Overflow (high 8.4)
- [CVE-2020-36970](https://insights.sbomify.com/CVE-2020-36970/): PMB 5.6 - 'chemin' Local File Disclosure (medium 6.9)
- [CVE-2020-36969](https://insights.sbomify.com/CVE-2020-36969/): M/Monit 3.7.4 - Privilege Escalation (high 8.7)
- [CVE-2020-36968](https://insights.sbomify.com/CVE-2020-36968/): M/Monit 3.7.4 - Password Disclosure (high 7.1)
- [CVE-2020-36967](https://insights.sbomify.com/CVE-2020-36967/): Zortam Mp3 Media Studio 27.60 - Remote Code Execution (SEH) (high 8.4)
- [CVE-2020-36966](https://insights.sbomify.com/CVE-2020-36966/): Dolibarr 11.0.3 - 'ldap.php' - Persistent Cross-Site Scripting (medium 5.1)
- [CVE-2020-36965](https://insights.sbomify.com/CVE-2020-36965/): docPrint Pro 8.0 - 'Add URL' Buffer Overflow (SEH Egghunter) (high 8.4)
- [CVE-2020-36964](https://insights.sbomify.com/CVE-2020-36964/): YATinyWinFTP - Denial of Service (high 8.7)
- [CVE-2020-36963](https://insights.sbomify.com/CVE-2020-36963/): Intelbras Router RF 301K 1.1.2 - Authentication Bypass (high 8.7)
- [CVE-2020-36962](https://insights.sbomify.com/CVE-2020-36962/): Tendenci 12.3.1 - CSV/ Formula Injection (medium 5.3)
- [CVE-2020-36961](https://insights.sbomify.com/CVE-2020-36961/): 10-Strike Network Inventory Explorer 8.65 - Buffer Overflow (SEH) (high 8.4)
- [CVE-2020-36960](https://insights.sbomify.com/CVE-2020-36960/): Forma LMS 2.3 - 'First & Last Name' Stored Cross-Site Scripting (medium 5.1)
- [CVE-2020-3696](https://insights.sbomify.com/CVE-2020-3696/): Use after free in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking (high 7.8)
- [CVE-2020-36959](https://insights.sbomify.com/CVE-2020-36959/): IDT PC Audio 1.0.6499.0 - 'STacSV' Unquoted Service Path (high 8.5)
- [CVE-2020-36958](https://insights.sbomify.com/CVE-2020-36958/): Kite 1.2020.1119.0 - 'KiteService' Unquoted Service Path (high 8.5)
- [CVE-2020-36957](https://insights.sbomify.com/CVE-2020-36957/): PDF Complete 3.5.310.2002 - 'pdfsvc.exe' Unquoted Service Path (high 8.5)
- [CVE-2020-36956](https://insights.sbomify.com/CVE-2020-36956/): Openfire 4.6.0 - 'path' Stored XSS (medium 5.1)
- [CVE-2020-36955](https://insights.sbomify.com/CVE-2020-36955/): Grav CMS 1.6.30 Admin Plugin 1.9.18 - 'Page Title' Persistent Cross-Site Scripting (medium 5.1)
- [CVE-2020-36954](https://insights.sbomify.com/CVE-2020-36954/): Xeroneit Library Management System 3.1 - "Add Book Category " Stored XSS (medium 5.1)
- [CVE-2020-36953](https://insights.sbomify.com/CVE-2020-36953/): MiniTool ShadowMaker 3.2 - 'MTAgentService' Unquoted Service Path (high 8.5)
- [CVE-2020-36952](https://insights.sbomify.com/CVE-2020-36952/): IObit Uninstaller 10 Pro - Unquoted Service Path (high 8.5)
- [CVE-2020-36951](https://insights.sbomify.com/CVE-2020-36951/): Phpscript-sgh 0.1.0 - Time Based Blind SQL Injection (high 8.8)
- [CVE-2020-36950](https://insights.sbomify.com/CVE-2020-36950/): Laravel Nova 3.7.0 - 'range' DoS (high 8.7)
- [CVE-2020-36949](https://insights.sbomify.com/CVE-2020-36949/): TapinRadio 2.13.7 - Denial of Service (medium 6.7)
- [CVE-2020-36948](https://insights.sbomify.com/CVE-2020-36948/): VestaCP 0.9.8-26 - 'LoginAs' Insufficient Session Validation (high 8.7)
- [CVE-2020-36947](https://insights.sbomify.com/CVE-2020-36947/): LibreNMS 1.46 - MAC Accounting Graph Authenticated SQL Injection (high 7.1)
- [CVE-2020-36946](https://insights.sbomify.com/CVE-2020-36946/): SyncBreeze 10.0.28 - 'login' Denial of Service (high 8.7)
- [CVE-2020-36945](https://insights.sbomify.com/CVE-2020-36945/): WebDamn User Registration & Login System with User Panel - SQLi Auth Bypass (high 8.8)
- [CVE-2020-36944](https://insights.sbomify.com/CVE-2020-36944/): ILIAS Learning Management System 4.3 - SSRF (medium 6.9)
- [CVE-2020-36943](https://insights.sbomify.com/CVE-2020-36943/): aSc TimeTables 2021.6.2 - Denial of Service (medium 6.7)
- [CVE-2020-36942](https://insights.sbomify.com/CVE-2020-36942/): Victor CMS 1.0 - File Upload To RCE (high 8.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/70/