# Vulnerabilities published in 2020


- [CVE-2020-36941](https://insights.sbomify.com/CVE-2020-36941/): Knockpy 4.1.1 - CSV Injection (medium 5.3)
- [CVE-2020-36940](https://insights.sbomify.com/CVE-2020-36940/): Easy CD & DVD Cover Creator 4.13 - Denial of Service (medium 5.1)
- [CVE-2020-3694](https://insights.sbomify.com/CVE-2020-3694/): Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Mobile, Snapdragon Voice & Music (high 7.8)
- [CVE-2020-36939](https://insights.sbomify.com/CVE-2020-36939/): Cassandra Web 0.5.0 - Remote File Read (high 8.7)
- [CVE-2020-36938](https://insights.sbomify.com/CVE-2020-36938/): WinAVR Version 20100110 - Insecure Folder Permissions (high 7.0)
- [CVE-2020-36937](https://insights.sbomify.com/CVE-2020-36937/): MEMU PLAY 3.7.0 - 'MEmusvc' Unquoted Service Path (high 8.5)
- [CVE-2020-36936](https://insights.sbomify.com/CVE-2020-36936/): Magic Mouse 2 utilities 2.20 - 'magicmouse2service' Unquoted Service Path (high 8.5)
- [CVE-2020-36935](https://insights.sbomify.com/CVE-2020-36935/): KMSpico 17.1.0.0 - 'Service KMSELDI' Unquoted Service Path (high 8.5)
- [CVE-2020-36934](https://insights.sbomify.com/CVE-2020-36934/): Deep Instinct Windows Agent 1.2.24.0 - 'DeepNetworkService' Unquoted Service Path (high 8.5)
- [CVE-2020-36933](https://insights.sbomify.com/CVE-2020-36933/): IPTInstaller 4.0.9 - 'PassThru Service' Unquoted Service Path (high 8.5)
- [CVE-2020-36932](https://insights.sbomify.com/CVE-2020-36932/): Seacms 11.1 - 'checkuser' Stored XSS (medium 5.1)
- [CVE-2020-36931](https://insights.sbomify.com/CVE-2020-36931/): Click2Magic 1.1.5 - Stored Cross-Site Scripting (medium 5.1)
- [CVE-2020-36930](https://insights.sbomify.com/CVE-2020-36930/): SysGauge 7.9.18 - ' SysGauge Server' Unquoted Service Path (high 8.5)
- [CVE-2020-3693](https://insights.sbomify.com/CVE-2020-3693/): Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables (high 7.8)
- [CVE-2020-36929](https://insights.sbomify.com/CVE-2020-36929/): Brother BRPrint Auditor 3.0.7 - 'Multiple' Unquoted Service Path (high 8.5)
- [CVE-2020-36928](https://insights.sbomify.com/CVE-2020-36928/): Brother BRAgent 1.38 - 'WBA_Agent_Client' Unquoted Service Path (high 8.5)
- [CVE-2020-36927](https://insights.sbomify.com/CVE-2020-36927/): DiskPulse 13.6.14 - Unquoted Service Path (high 8.5)
- [CVE-2020-36926](https://insights.sbomify.com/CVE-2020-36926/): SmarterTools SmarterTrack 7922 -Information Disclosure (medium 6.9)
- [CVE-2020-36925](https://insights.sbomify.com/CVE-2020-36925/): Arteco Web Client DVR/NVR Session ID Brute Force Authentication Bypass (high 8.7)
- [CVE-2020-36924](https://insights.sbomify.com/CVE-2020-36924/): Sony BRAVIA Digital Signage 1.7.8 Unauthenticated Remote File Inclusion (medium 5.3)
- [CVE-2020-36923](https://insights.sbomify.com/CVE-2020-36923/): Sony BRAVIA Digital Signage 1.7.8 Client-Side Protection Bypass via IDOR (medium 6.9)
- [CVE-2020-36922](https://insights.sbomify.com/CVE-2020-36922/): Sony BRAVIA Digital Signage 1.7.8 Unauthenticated System API Information Disclosure (medium 6.9)
- [CVE-2020-36921](https://insights.sbomify.com/CVE-2020-36921/): RED-V Super Digital Signage System 5.1.1 Log Information Disclosure Vulnerability (medium 6.9)
- [CVE-2020-36920](https://insights.sbomify.com/CVE-2020-36920/): iDS6 DSSPro Digital Signage System 6.2 Privilege Escalation via Access Control (high 8.7)
- [CVE-2020-3692](https://insights.sbomify.com/CVE-2020-3692/): Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile (critical 9.8)
- [CVE-2020-36919](https://insights.sbomify.com/CVE-2020-36919/): WPForms 1.7.8 - Cross-Site Scripting (XSS) (medium 5.1)
- [CVE-2020-36918](https://insights.sbomify.com/CVE-2020-36918/): iDS6 DSSPro Digital Signage System 6.2 Cross-Site Request Forgery via User Management (medium 5.1)
- [CVE-2020-36917](https://insights.sbomify.com/CVE-2020-36917/): iDS6 DSSPro Digital Signage System 6.2 Cleartext Password Disclosure via Cookie (high 8.6)
- [CVE-2020-36916](https://insights.sbomify.com/CVE-2020-36916/): TDM Digital Signage PC Player 4.1.0.4 Privilege Escalation via Insecure Permissions (high 8.5)
- [CVE-2020-36915](https://insights.sbomify.com/CVE-2020-36915/): Adtec Digital SignEdje Digital Signage Player v2.08.28 Default Credentials (high 8.7)
- [CVE-2020-36914](https://insights.sbomify.com/CVE-2020-36914/): QiHang Media Web Digital Signage 3.0.9 Cookie Authentication Credentials Disclosure (high 8.6)
- [CVE-2020-36913](https://insights.sbomify.com/CVE-2020-36913/): All-Dynamics Software enlogic:show 2.0.2 Session Fixation Authentication Bypass (high 8.5)
- [CVE-2020-36912](https://insights.sbomify.com/CVE-2020-36912/): Plexus anblick Digital Signage Management 3.1.13 Open Redirect via Pagina Parameter (medium 5.1)
- [CVE-2020-36911](https://insights.sbomify.com/CVE-2020-36911/): Covenant 0.5 - Remote Code Execution (RCE) (critical 9.3)
- [CVE-2020-36910](https://insights.sbomify.com/CVE-2020-36910/): Cayin Signage Media Player 3.0 Authenticated Remote Command Injection via NTP Parameter (high 8.7)
- [CVE-2020-3691](https://insights.sbomify.com/CVE-2020-3691/): Integer overflow in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking (critical 9.8)
- [CVE-2020-36909](https://insights.sbomify.com/CVE-2020-36909/): Secure Computing SnapGear Management Console SG560 3.1.5 Arbitrary File Read/Write (high 8.7)
- [CVE-2020-36908](https://insights.sbomify.com/CVE-2020-36908/): Secure Computing SnapGear Management Console SG560 3.1.5 Cross-Site Request Forgery via Admin Users (medium 5.1)
- [CVE-2020-36907](https://insights.sbomify.com/CVE-2020-36907/): Extreme Networks Aerohive HiveOS <=11.x 11.x Unauthenticated Remote Denial of Service (high 8.7)
- [CVE-2020-36906](https://insights.sbomify.com/CVE-2020-36906/): P5 FNIP-8x16A FNIP-4xSH 1.0.20 Cross-Site Request Forgery via User Management (medium 5.3)
- [CVE-2020-36905](https://insights.sbomify.com/CVE-2020-36905/): FIBARO System Home Center 5.021 Remote File Inclusion via Proxy API (medium 5.1)
- [CVE-2020-36904](https://insights.sbomify.com/CVE-2020-36904/): Selea CarPlateServer 4.0.1.6 Remote Program Execution via Configuration Endpoint (critical 9.3)
- [CVE-2020-36903](https://insights.sbomify.com/CVE-2020-36903/): Selea CarPlateServer 4.0.1.6 Local Privilege Escalation via Unquoted Service Path (high 8.5)
- [CVE-2020-36902](https://insights.sbomify.com/CVE-2020-36902/): UBICOD Medivision Digital Signage 1.5.1 Authorization Bypass via User Privileges (critical 9.3)
- [CVE-2020-36901](https://insights.sbomify.com/CVE-2020-36901/): UBICOD Medivision Digital Signage 1.5.1 Cross-Site Request Forgery via User Management (high 8.6)
- [CVE-2020-36900](https://insights.sbomify.com/CVE-2020-36900/): All-Dynamics Digital Signage System 2.0.2 Cross-Site Request Forgery via User Management (high 8.6)
- [CVE-2020-3690](https://insights.sbomify.com/CVE-2020-3690/): Misconfiguration in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking (high 7.8)
- [CVE-2020-36899](https://insights.sbomify.com/CVE-2020-36899/): QiHang Media Web Digital Signage 3.0.9 Unauthenticated Arbitrary File Disclosure (high 8.7)
- [CVE-2020-36898](https://insights.sbomify.com/CVE-2020-36898/): QiHang Media Web Digital Signage 3.0.9 Unauthenticated Arbitrary File Deletion (high 8.8)
- [CVE-2020-36897](https://insights.sbomify.com/CVE-2020-36897/): QiHang Media Web Digital Signage 3.0.9 Unauthenticated Remote Code Execution (critical 9.3)
- [CVE-2020-36896](https://insights.sbomify.com/CVE-2020-36896/): QiHang Media Web Digital Signage 3.0.9 Cleartext Credentials Disclosure (high 8.7)
- [CVE-2020-36895](https://insights.sbomify.com/CVE-2020-36895/): EIBIZ i-Media Server Digital Signage 3.8.0 Unauthenticated Configuration Disclosure (high 8.7)
- [CVE-2020-36894](https://insights.sbomify.com/CVE-2020-36894/): Eibiz i-Media Server Digital Signage 3.8.0 Unauthenticated User Creation Vulnerability (critical 9.3)
- [CVE-2020-36893](https://insights.sbomify.com/CVE-2020-36893/): Eibiz i-Media Server Digital Signage 3.8.0 Directory Traversal Vulnerability (high 8.7)
- [CVE-2020-36892](https://insights.sbomify.com/CVE-2020-36892/): Eibiz i-Media Server Digital Signage 3.8.0 Unauthenticated Privilege Escalation (critical 9.3)
- [CVE-2020-36891](https://insights.sbomify.com/CVE-2020-36891/): Kentico Xperience <= 12.0.49 File Upload Stored XSS (medium 5.1)
- [CVE-2020-36890](https://insights.sbomify.com/CVE-2020-36890/): Kentico Xperience <= 10 Administrator Access Control Bypass (high 8.6)
- [CVE-2020-36889](https://insights.sbomify.com/CVE-2020-36889/): Kentico Xperience <= 12.0.90 Administration Interface Stored XSS (medium 5.1)
- [CVE-2020-36888](https://insights.sbomify.com/CVE-2020-36888/): SpinetiX Fusion Digital Signage 3.4.8 Username Enumeration via Login Script (medium 6.9)
- [CVE-2020-36887](https://insights.sbomify.com/CVE-2020-36887/): SpinetiX Fusion Digital Signage 3.4.8 Unauthenticated Database Backup Disclosure (high 8.7)
- [CVE-2020-36886](https://insights.sbomify.com/CVE-2020-36886/): SpinetiX Fusion Digital Signage 3.4.8 Cross-Site Request Forgery via User Creation (medium 6.9)
- [CVE-2020-36885](https://insights.sbomify.com/CVE-2020-36885/): Sony IPELA Network Camera 1.82.01 Remote Stack Buffer Overflow via ftpclient.cgi (critical 9.3)
- [CVE-2020-36884](https://insights.sbomify.com/CVE-2020-36884/): BrightSign Digital Signage Diagnostic Web Server 8.2.26 Unauthenticated SSRF (medium 6.9)
- [CVE-2020-36883](https://insights.sbomify.com/CVE-2020-36883/): SpinetiX Fusion Digital Signage 3.4.8 Authenticated Path Traversal via File Operations (high 8.8)
- [CVE-2020-36882](https://insights.sbomify.com/CVE-2020-36882/): Flexsense DiskBoss Application Crash Denial of Service (high 8.7)
- [CVE-2020-36881](https://insights.sbomify.com/CVE-2020-36881/): Flexsense DiskBoss 'Add Input Directory' Buffer Overflow (high 8.6)
- [CVE-2020-36880](https://insights.sbomify.com/CVE-2020-36880/): Flexsense DiskBoss 'Reports and Data Directory' Buffer Overflow (high 8.6)
- [CVE-2020-3688](https://insights.sbomify.com/CVE-2020-3688/): Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables (critical 9.8)
- [CVE-2020-36879](https://insights.sbomify.com/CVE-2020-36879/): Flexsense DiskBoss Service Unquoted Service Path Vulnerability (high 8.5)
- [CVE-2020-36878](https://insights.sbomify.com/CVE-2020-36878/): ReQuest Serious Play F3 Media Player <= 3.0.0 Directory Traversal File Disclosure (high 8.7)
- [CVE-2020-36877](https://insights.sbomify.com/CVE-2020-36877/): ReQuest Serious Play F3 Media Server <= 7.0.3 code execution (critical 9.3)
- [CVE-2020-36876](https://insights.sbomify.com/CVE-2020-36876/): ReQuest Serious Play F3 Media Server <= 7.0.3 Debug Log Disclosure2020 (high 8.7)
- [CVE-2020-36875](https://insights.sbomify.com/CVE-2020-36875/): AccessAlly < 3.3.2 Unauthenticated Arbitrary PHP Code Execution (critical 9.3)
- [CVE-2020-36874](https://insights.sbomify.com/CVE-2020-36874/): ACE SECURITY WIP-90113 Unauthenticated Configuration Disclosure (high 8.7)
- [CVE-2020-36873](https://insights.sbomify.com/CVE-2020-36873/): Astak CM-818T3 Unauthenticated Configuration Disclosure (high 8.7)
- [CVE-2020-36872](https://insights.sbomify.com/CVE-2020-36872/): BACnet Test Server 1.01 Malformed BVLC Length DoS (high 8.7)
- [CVE-2020-36871](https://insights.sbomify.com/CVE-2020-36871/): ESCAM QD-900 Unauthenticated Configuration Disclosure (high 8.7)
- [CVE-2020-36870](https://insights.sbomify.com/CVE-2020-36870/): Ruijie Gateway EG & NBR Models v11.1(6)B9P1 - 11.9(4)B12P1 RCE (critical 9.2)
- [CVE-2020-3687](https://insights.sbomify.com/CVE-2020-3687/): Information disclosure in unspecified (medium 5.5)
- [CVE-2020-36869](https://insights.sbomify.com/CVE-2020-36869/): Nagios XI < 5.7.5 SQL injection via SNMP Trap Interface Edit Page (high 8.7)
- [CVE-2020-36868](https://insights.sbomify.com/CVE-2020-36868/): Nagios XI < 5.7.3 Privilege escalation via Insecure getprofile.sh Script (high 8.5)
- [CVE-2020-36867](https://insights.sbomify.com/CVE-2020-36867/): Nagios XI < 5.7.3 Command Injection in Report PDF Download (high 8.7)
- [CVE-2020-36866](https://insights.sbomify.com/CVE-2020-36866/): Nagios XI < 5.7.3 XSS via Manage Users in Admin Interface (medium 5.1)
- [CVE-2020-36865](https://insights.sbomify.com/CVE-2020-36865/): Nagios XI < 5.7.2 XSS via BPI Config Management (medium 5.1)
- [CVE-2020-36864](https://insights.sbomify.com/CVE-2020-36864/): Nagios XI < 5.7.2 XSS via Dashboard Background Color Setting (medium 5.1)
- [CVE-2020-36863](https://insights.sbomify.com/CVE-2020-36863/): Nagios XI < 5.7.2 Unrestricted File Upload via Audio Import Directory (high 8.7)
- [CVE-2020-36862](https://insights.sbomify.com/CVE-2020-36862/): Nagios XI < 5.6.11 Unauthenticated XSS and SSRF via Highcharts (medium 6.9)
- [CVE-2020-36861](https://insights.sbomify.com/CVE-2020-36861/): Nagios XI < 5.7.5 Core Config Manager (CCM) XSS via Overlay Rendering and Notification/Check Period Pages (medium 5.1)
- [CVE-2020-36860](https://insights.sbomify.com/CVE-2020-36860/): Nagios XI < 5.7.4 Core Config Manager (CCM) XSS via Object Edit Pages (medium 5.1)
- [CVE-2020-3686](https://insights.sbomify.com/CVE-2020-3686/): Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking (critical 9.8)
- [CVE-2020-36859](https://insights.sbomify.com/CVE-2020-36859/): Nagios XI < 5.7.4 Core Config Manager (CCM) SQL Injection via Object Edit Pages (high 8.7)
- [CVE-2020-36858](https://insights.sbomify.com/CVE-2020-36858/): Nagios Log Server < 2.1.6 XSS via Create User, Edit User, & Manage Host Lists Pages (medium 5.1)
- [CVE-2020-36857](https://insights.sbomify.com/CVE-2020-36857/): Nagios XI < 5.6.14 Authenticated SQL Injection via SNMP Trap Interface Page (high 8.6)
- [CVE-2020-36856](https://insights.sbomify.com/CVE-2020-36856/): Nagios XI < 5.6.14 Authenticated RCE command_test.php via address (critical 9.4)
- [CVE-2020-36855](https://insights.sbomify.com/CVE-2020-36855/): DCMTK dcmqrscp parseQuota stack-based overflow (medium 4.8)
- [CVE-2020-36854](https://insights.sbomify.com/CVE-2020-36854/): Async JavaScript <= 2.19.07.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2020-36853](https://insights.sbomify.com/CVE-2020-36853/): 10WebMapBuilder <= 1.0.63 - Unauthenticated Stored Cross-Site Scripting via Plugin Settings Change (high 7.2)
- [CVE-2020-36852](https://insights.sbomify.com/CVE-2020-36852/): Custom Searchable Data Entry System <= 1.7.1 - Unauthenticated Database Wiping (critical 9.1)
- [CVE-2020-36851](https://insights.sbomify.com/CVE-2020-36851/): Rob--W cors-anywhere Misconfigured CORS Proxy Allows SSRF (critical 9.5)
- [CVE-2020-36850](https://insights.sbomify.com/CVE-2020-36850/): Sitecore JSS React Sample Application 11.0.0 - 14.0.1 Information Disclosure (high 8.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/71/