# Vulnerabilities published in 2020


- [CVE-2020-3685](https://insights.sbomify.com/CVE-2020-3685/): Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking (high 7.5)
- [CVE-2020-36849](https://insights.sbomify.com/CVE-2020-36849/): AIT CSV import/export <= 3.0.3 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2020-36848](https://insights.sbomify.com/CVE-2020-36848/): Total Upkeep by BoldGrid <= 1.14.9 - Unauthenticated Backup Download (high 7.5)
- [CVE-2020-36847](https://insights.sbomify.com/CVE-2020-36847/): Simple File List < 4.2.3 - Remote Code Execution (critical 9.8)
- [CVE-2020-36846](https://insights.sbomify.com/CVE-2020-36846/): IO::Compress::Brotli versions prior to 0.007 for Perl have an integer overflow in the bundled Brotli C library (critical 9.8)
- [CVE-2020-36845](https://insights.sbomify.com/CVE-2020-36845/): Open redirect in Security Awareness Training (medium 5.3)
- [CVE-2020-36844](https://insights.sbomify.com/CVE-2020-36844/): Cross-site scripting in Security Awareness Training (medium 6.1)
- [CVE-2020-36843](https://insights.sbomify.com/CVE-2020-36843/): Ed25519 Signature Malleability in ed25519-java Due to Missing Scalar Range Check (medium 4.3)
- [CVE-2020-36842](https://insights.sbomify.com/CVE-2020-36842/): Migration, Backup, Staging – WPvivid <= 0.9.35 - Authenticated (Subscriber+) Arbitrary File Upload (high 8.8)
- [CVE-2020-36841](https://insights.sbomify.com/CVE-2020-36841/): WooCommerce Smart Coupons <= 4.6.0 - Unauthenticated Coupon Creation (medium 5.3)
- [CVE-2020-36840](https://insights.sbomify.com/CVE-2020-36840/): Timetable and Event Schedule by MotoPress <= 2.3.8 - Missing Authorization (high 7.3)
- [CVE-2020-3684](https://insights.sbomify.com/CVE-2020-3684/): Security feature bypass in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking (high 7.8)
- [CVE-2020-36839](https://insights.sbomify.com/CVE-2020-36839/): WP Lead Plus X <= 0.99 - Cross-Site Request Forgery (high 8.3)
- [CVE-2020-36838](https://insights.sbomify.com/CVE-2020-36838/): Facebook Chat Plugin <= 1.5 - Missing Capabilities Check (high 7.4)
- [CVE-2020-36837](https://insights.sbomify.com/CVE-2020-36837/): ThemeGrill Demo Importer 1.3.4 - 1.6.1 - Authorization Bypass to Site Reset (critical 9.9)
- [CVE-2020-36836](https://insights.sbomify.com/CVE-2020-36836/): WP Fastest Cache <= 0.9.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion (high 8.0)
- [CVE-2020-36835](https://insights.sbomify.com/CVE-2020-36835/): Migration, Backup, Staging – WPvivid <= 0.9.35 - Sensitive Information Disclosure (medium 4.9)
- [CVE-2020-36834](https://insights.sbomify.com/CVE-2020-36834/): Discount Rules for WooCommerce <= 2.0.2 - Missing Authorization (medium 6.3)
- [CVE-2020-36833](https://insights.sbomify.com/CVE-2020-36833/): Indeed Membership Pro 7.3 - 8.6 - Missing Authorization Checks (medium 6.3)
- [CVE-2020-36832](https://insights.sbomify.com/CVE-2020-36832/): Indeed Membership Pro 7.3 - 8.6 - Authentication Bypass (critical 9.8)
- [CVE-2020-36831](https://insights.sbomify.com/CVE-2020-36831/): NextScripts: Social Networks Auto-Poster <= 4.3.17 - Missing Authorization (medium 5.0)
- [CVE-2020-36830](https://insights.sbomify.com/CVE-2020-36830/): nescalante urlregex Backtracking index.js redos (medium 5.3)
- [CVE-2020-36829](https://insights.sbomify.com/CVE-2020-36829/): The Mojolicious module before 8.65 for Perl is vulnerable to secure_compare timing attacks that allow an attacker to guess the length of a secret string. (high 7.5)
- [CVE-2020-36828](https://insights.sbomify.com/CVE-2020-36828/): DiscuzX install_function.php show_next_step cross site scripting (low 3.5)
- [CVE-2020-36827](https://insights.sbomify.com/CVE-2020-36827/): The XAO::Web module before 1.84 for Perl mishandles < and > characters in JSON output during use of json-embed in Web::Action. (medium 5.4)
- [CVE-2020-36826](https://insights.sbomify.com/CVE-2020-36826/): AwesomestCode LiveBot parseMessage.js parseSend cross site scripting (low 3.5)
- [CVE-2020-36825](https://insights.sbomify.com/CVE-2020-36825/): cyberaz0r WebRAT api.php download_file unrestricted upload (medium 5.3)
- [CVE-2020-3681](https://insights.sbomify.com/CVE-2020-3681/): Weak cryptography in qualcomm:- (critical 9.8)
- [CVE-2020-3680](https://insights.sbomify.com/CVE-2020-3680/): Race condition in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables (high 7.0)
- [CVE-2020-36791](https://insights.sbomify.com/CVE-2020-36791/): net_sched: keep alloc_hash updated after hash allocation (high 7.8)
- [CVE-2020-36790](https://insights.sbomify.com/CVE-2020-36790/): nvmet: fix a memory leak (medium 5.5)
- [CVE-2020-3679](https://insights.sbomify.com/CVE-2020-3679/): Security feature bypass in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking (medium 5.5)
- [CVE-2020-36789](https://insights.sbomify.com/CVE-2020-36789/): can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context (medium 5.5)
- [CVE-2020-36788](https://insights.sbomify.com/CVE-2020-36788/): drm/nouveau: avoid a use-after-free when BO init fails (high 7.8)
- [CVE-2020-36787](https://insights.sbomify.com/CVE-2020-36787/): media: aspeed: fix clock handling logic (high 7.8)
- [CVE-2020-36786](https://insights.sbomify.com/CVE-2020-36786/): media: [next] staging: media: atomisp: fix memory leak of object flash (medium 5.5)
- [CVE-2020-36785](https://insights.sbomify.com/CVE-2020-36785/): media: atomisp: Fix use after free in atomisp_alloc_css_stat_bufs() (high 7.8)
- [CVE-2020-36784](https://insights.sbomify.com/CVE-2020-36784/): i2c: cadence: fix reference leak when pm_runtime_get_sync fails (medium 5.5)
- [CVE-2020-36783](https://insights.sbomify.com/CVE-2020-36783/): i2c: img-scb: fix reference leak when pm_runtime_get_sync fails (medium 5.5)
- [CVE-2020-36782](https://insights.sbomify.com/CVE-2020-36782/): i2c: imx-lpi2c: fix reference leak when pm_runtime_get_sync fails (medium 5.5)
- [CVE-2020-36781](https://insights.sbomify.com/CVE-2020-36781/): i2c: imx: fix reference leak when pm_runtime_get_sync fails (medium 5.5)
- [CVE-2020-36780](https://insights.sbomify.com/CVE-2020-36780/): i2c: sprd: fix reference leak when pm_runtime_get_sync fails (medium 4.7)
- [CVE-2020-3678](https://insights.sbomify.com/CVE-2020-3678/): Memory corruption in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking (high 7.8)
- [CVE-2020-36779](https://insights.sbomify.com/CVE-2020-36779/): i2c: stm32f7: fix reference leak when pm_runtime_get_sync fails (medium 5.5)
- [CVE-2020-36778](https://insights.sbomify.com/CVE-2020-36778/): i2c: xiic: fix reference leak when pm_runtime_get_sync fails (medium 5.5)
- [CVE-2020-36777](https://insights.sbomify.com/CVE-2020-36777/): media: dvbdev: Fix memory leak in dvb_media_device_free() (medium 5.5)
- [CVE-2020-36776](https://insights.sbomify.com/CVE-2020-36776/): thermal/drivers/cpufreq_cooling: Fix slab OOB issue (medium 5.5)
- [CVE-2020-36775](https://insights.sbomify.com/CVE-2020-36775/): f2fs: fix to avoid potential deadlock (medium 5.5)
- [CVE-2020-36774](https://insights.sbomify.com/CVE-2020-36774/): Denial of service in gnome:glade (medium 5.5)
- [CVE-2020-36773](https://insights.sbomify.com/CVE-2020-36773/): Memory corruption in artifex:ghostscript (critical 9.8)
- [CVE-2020-36772](https://insights.sbomify.com/CVE-2020-36772/): Path traversal in cagefs (medium 4.4)
- [CVE-2020-36771](https://insights.sbomify.com/CVE-2020-36771/): Information disclosure in cagefs (high 7.8)
- [CVE-2020-36770](https://insights.sbomify.com/CVE-2020-36770/): Privilege escalation in gentoo:ebuild for slurm (high 7.8)
- [CVE-2020-36769](https://insights.sbomify.com/CVE-2020-36769/): Widget Settings Importer/Exporter Plugin <= 1.5.3 - Unauthorized Widget Import to Stored Cross-Site Scripting (high 7.4)
- [CVE-2020-36768](https://insights.sbomify.com/CVE-2020-36768/): rl-institut NESP2 database.py sql injection (high 7.3)
- [CVE-2020-36767](https://insights.sbomify.com/CVE-2020-36767/): Command injection in vareille:tinyfiledialogs (high 7.5)
- [CVE-2020-36766](https://insights.sbomify.com/CVE-2020-36766/): Information disclosure in linux:linux kernel (low 3.3)
- [CVE-2020-36765](https://insights.sbomify.com/CVE-2020-36765/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2020-36763](https://insights.sbomify.com/CVE-2020-36763/): Cross-site scripting in duxcms project:duxcms (medium 5.4)
- [CVE-2020-36762](https://insights.sbomify.com/CVE-2020-36762/): ONS Digital RAS Collection Instrument comment.yml jobs os command injection (medium 5.5)
- [CVE-2020-36761](https://insights.sbomify.com/CVE-2020-36761/): Top 10 <= 2.9.4 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2020-36760](https://insights.sbomify.com/CVE-2020-36760/): Ocean Extra <=1.6.5 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2020-3676](https://insights.sbomify.com/CVE-2020-3676/): Memory corruption in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile (high 7.8)
- [CVE-2020-36759](https://insights.sbomify.com/CVE-2020-36759/): Woody code snippets <= 2.3.9 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2020-36758](https://insights.sbomify.com/CVE-2020-36758/): RSS Aggregator by Feedzy <= 3.4.2 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2020-36757](https://insights.sbomify.com/CVE-2020-36757/): WP Hotel Booking <= 1.10.1 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2020-36756](https://insights.sbomify.com/CVE-2020-36756/): 10WebAnalytics <= 1.2.8 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2020-36755](https://insights.sbomify.com/CVE-2020-36755/): Customizr <= 4.3.0 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2020-36754](https://insights.sbomify.com/CVE-2020-36754/): Paid Memberships Pro <= 2.4.2 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2020-36753](https://insights.sbomify.com/CVE-2020-36753/): Hueman <= 3.6.3 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2020-36752](https://insights.sbomify.com/CVE-2020-36752/): Coming Soon & Maintenance Mode Page <= 1.57 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2020-36751](https://insights.sbomify.com/CVE-2020-36751/): Coupon Creator <= 3.1 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2020-36750](https://insights.sbomify.com/CVE-2020-36750/): EWWW Image Optimizer <= 5.8.1 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2020-3675](https://insights.sbomify.com/CVE-2020-3675/): Integer overflow in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking (critical 9.8)
- [CVE-2020-36749](https://insights.sbomify.com/CVE-2020-36749/): Easy Testimonials <= 3.6.1 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2020-36748](https://insights.sbomify.com/CVE-2020-36748/): Dokan <= 3.0.8 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2020-36747](https://insights.sbomify.com/CVE-2020-36747/): Lightweight Sidebar Manager <= 1.1.4 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2020-36746](https://insights.sbomify.com/CVE-2020-36746/): Menu Swapper <= 1.1.0.2 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2020-36745](https://insights.sbomify.com/CVE-2020-36745/): WP Project Manager <= 2.4.0 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2020-36744](https://insights.sbomify.com/CVE-2020-36744/): NotificationX <= 1.8.2 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2020-36743](https://insights.sbomify.com/CVE-2020-36743/): Product Catalog Simple <= 1.5.13 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2020-36742](https://insights.sbomify.com/CVE-2020-36742/): Custom Field Template <= 2.5.1 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2020-36741](https://insights.sbomify.com/CVE-2020-36741/): MultiVendorX – MultiVendor Marketplace Solution For WooCommerce <= 3.5.7 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2020-36740](https://insights.sbomify.com/CVE-2020-36740/): Radio Buttons for Taxonomies <= 2.0.5 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2020-3674](https://insights.sbomify.com/CVE-2020-3674/): Information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables (medium 5.5)
- [CVE-2020-36739](https://insights.sbomify.com/CVE-2020-36739/): Feed Them Social – Page, Post, Video, and Photo Galleries <= 2.8.6 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2020-36738](https://insights.sbomify.com/CVE-2020-36738/): Cool Timeline (Horizontal & Vertical Timeline) <= 2.0.2 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2020-36737](https://insights.sbomify.com/CVE-2020-36737/): Import / Export Customizer Settings <= 1.0.3 - Cross-Site Request Forgery Bypass (medium 4.3)
- [CVE-2020-36736](https://insights.sbomify.com/CVE-2020-36736/): Cross-site request forgery in CartFlows – Funnel Builder & Checkout Plugin for WooCommerce (medium 4.3)
- [CVE-2020-36735](https://insights.sbomify.com/CVE-2020-36735/): Cross-site request forgery in ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support (medium 4.3)
- [CVE-2020-36732](https://insights.sbomify.com/CVE-2020-36732/): crypto-js uses insecure random numbers (medium 5.3)
- [CVE-2020-36731](https://insights.sbomify.com/CVE-2020-36731/): Flexible Checkout Fields for WooCommerce <= 2.3.1 - Unauthenticated Arbitrary Plugin Settings Update (high 7.2)
- [CVE-2020-36730](https://insights.sbomify.com/CVE-2020-36730/): CMP <= 3.8.1 - Missing Authorization (high 8.3)
- [CVE-2020-3673](https://insights.sbomify.com/CVE-2020-3673/): Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables (critical 9.8)
- [CVE-2020-36729](https://insights.sbomify.com/CVE-2020-36729/): Slideshow, Image Slider by 2J <= 1.3.31 - Authorization Bypass (medium 5.4)
- [CVE-2020-36728](https://insights.sbomify.com/CVE-2020-36728/): Adning Advertising <= 1.5.5 - Unauthenticated Arbitrary File Deletion via Path Traversal (medium 6.5)
- [CVE-2020-36727](https://insights.sbomify.com/CVE-2020-36727/): Newsletter Manager <= 1.5.1 - Insecure Deserialization (critical 9.8)
- [CVE-2020-36726](https://insights.sbomify.com/CVE-2020-36726/): Ultimate Reviews < 2.1.33 - PHP Object Injection (critical 9.8)
- [CVE-2020-36725](https://insights.sbomify.com/CVE-2020-36725/): TI WooCommerce Wishlist <= 1.21.11 and TI WooCommerce Wishlist Pro <= 1.21.4 - Arbitrary Options Update (high 8.8)
- [CVE-2020-36724](https://insights.sbomify.com/CVE-2020-36724/): Wordable <= 3.1.1 - Authentication Bypass (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/72/