# Vulnerabilities published in 2020


- [CVE-2020-36723](https://insights.sbomify.com/CVE-2020-36723/): ListingPro - WordPress Directory & Listing Theme < 2.6.1 - Sensitive Information Disclosure (medium 5.3)
- [CVE-2020-36722](https://insights.sbomify.com/CVE-2020-36722/): Visual Composer <= 26.0 - Multiple Cross-Site Scripting (medium 5.5)
- [CVE-2020-36721](https://insights.sbomify.com/CVE-2020-36721/): Epsilon Framework Themes (Various Versions) - Unauthenticated Plugin Activation/Deactivation (medium 6.5)
- [CVE-2020-36720](https://insights.sbomify.com/CVE-2020-36720/): Kali Forms <= 2.1.1 - Missing Authorization to Settings Update (high 7.1)
- [CVE-2020-36719](https://insights.sbomify.com/CVE-2020-36719/): ListingPro - WordPress Directory & Listing Theme < 2.6.1 - Arbitrary Plugin Installation, Activation and Deactivation (critical 9.8)
- [CVE-2020-36718](https://insights.sbomify.com/CVE-2020-36718/): GDPR CCPA Compliance Support <= 2.3 - PHP Object Injection (critical 9.8)
- [CVE-2020-36717](https://insights.sbomify.com/CVE-2020-36717/): Kali Forms <= 2.1.1 - Cross-Site Request Forgery (high 8.8)
- [CVE-2020-36716](https://insights.sbomify.com/CVE-2020-36716/): WP Activity Log <= 4.0.1 - Missing Authorization (high 7.3)
- [CVE-2020-36715](https://insights.sbomify.com/CVE-2020-36715/): Login/Signup Popup < 1.5 - Missing Authorization (high 7.4)
- [CVE-2020-36714](https://insights.sbomify.com/CVE-2020-36714/): Brizy < 1.0.126 - Authorization Bypass to Settings Updates (high 7.4)
- [CVE-2020-36713](https://insights.sbomify.com/CVE-2020-36713/): MStore API <= 2.1.5 - Authentication Bypass (critical 9.8)
- [CVE-2020-36712](https://insights.sbomify.com/CVE-2020-36712/): Kali Forms <= 2.1.1 - Unauthenticated Arbitrary Post Deletion (high 8.6)
- [CVE-2020-36711](https://insights.sbomify.com/CVE-2020-36711/): Avada <= 6.2.2 - Authenticated (Contributor+) Cross-Site Scripting (medium 6.4)
- [CVE-2020-36710](https://insights.sbomify.com/CVE-2020-36710/): WPS Hide Login <= 1.5.4.2 - Hidden Login Page Location Disclosure (medium 5.3)
- [CVE-2020-3671](https://insights.sbomify.com/CVE-2020-3671/): Use after free in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music (critical 9.8)
- [CVE-2020-36709](https://insights.sbomify.com/CVE-2020-36709/): Page Builder: KingComposer < 2.9.4 - Stored Cross-Site Scripting (medium 5.5)
- [CVE-2020-36708](https://insights.sbomify.com/CVE-2020-36708/): Epsilon Framework Themes (Various Versions) - Function Injection (critical 9.8)
- [CVE-2020-36707](https://insights.sbomify.com/CVE-2020-36707/): Coming Soon & Maintenance Mode Page <= 1.57 - Cross-Site Request Forgery (high 8.8)
- [CVE-2020-36706](https://insights.sbomify.com/CVE-2020-36706/): Simple:Press – WordPress Forum Plugin <= 6.6.0 - Arbitrary File Upload (critical 9.8)
- [CVE-2020-36705](https://insights.sbomify.com/CVE-2020-36705/): Adning Advertising <= 1.5.5 - Arbitrary File Upload (critical 9.8)
- [CVE-2020-36704](https://insights.sbomify.com/CVE-2020-36704/): Fruitful < 3.8.2 - Stored Cross-Site Scripting (medium 6.4)
- [CVE-2020-36703](https://insights.sbomify.com/CVE-2020-36703/): Elementor Website Builder <= 2.9.7 - Authenticated Stored Cross-Site Scripting (medium 6.4)
- [CVE-2020-36702](https://insights.sbomify.com/CVE-2020-36702/): Spectra – WordPress Gutenberg Blocks <= 1.14.7 - Missing Authorization (medium 5.5)
- [CVE-2020-36701](https://insights.sbomify.com/CVE-2020-36701/): Page Builder: KingComposer < 2.9.4 - Arbitrary File Upload (high 8.8)
- [CVE-2020-36700](https://insights.sbomify.com/CVE-2020-36700/): Page Builder: KingComposer < 2.9.4 - Authorization Bypass due to Improper Access Control (high 8.8)
- [CVE-2020-3670](https://insights.sbomify.com/CVE-2020-3670/): Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables (critical 9.1)
- [CVE-2020-36699](https://insights.sbomify.com/CVE-2020-36699/): Quick Page/Post Redirect Plugin <= 5.1.9 - Redirect Security Bypass (medium 4.3)
- [CVE-2020-36698](https://insights.sbomify.com/CVE-2020-36698/): Security & Malware scan by CleanTalk <= 2.50 - Missing Authorization (high 8.8)
- [CVE-2020-36697](https://insights.sbomify.com/CVE-2020-36697/): WP GDPR <= 2.1.1 - Missing Authorization Checks (high 7.3)
- [CVE-2020-36696](https://insights.sbomify.com/CVE-2020-36696/): Product Input Fields for WooCommerce <= 1.2.6 - Missing Authorization (high 7.5)
- [CVE-2020-36695](https://insights.sbomify.com/CVE-2020-36695/): File and Directory Permission Vulnerability in Hitachi Command Suite (medium 6.6)
- [CVE-2020-36694](https://insights.sbomify.com/CVE-2020-36694/): Use after free in linux:linux kernel (medium 6.7)
- [CVE-2020-36692](https://insights.sbomify.com/CVE-2020-36692/): Cross-site scripting in Sophos Web Appliance (medium 6.5)
- [CVE-2020-36691](https://insights.sbomify.com/CVE-2020-36691/): Denial of service in linux:linux kernel (medium 5.5)
- [CVE-2020-3669](https://insights.sbomify.com/CVE-2020-3669/): Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking (critical 9.8)
- [CVE-2020-3668](https://insights.sbomify.com/CVE-2020-3668/): Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking (critical 9.8)
- [CVE-2020-36670](https://insights.sbomify.com/CVE-2020-36670/): NEX-Forms <= 7.7.1 - Missing Authorization on Various AJAX Actions (medium 6.3)
- [CVE-2020-3667](https://insights.sbomify.com/CVE-2020-3667/): Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking (critical 9.8)
- [CVE-2020-36669](https://insights.sbomify.com/CVE-2020-36669/): JetBackup – WP Backup, Migrate & Restore <= 1.3.9 - Cross-Site Request Forgery to Arbitrary File Upload (high 8.8)
- [CVE-2020-36668](https://insights.sbomify.com/CVE-2020-36668/): JetBackup – WP Backup, Migrate & Restore <= 1.4.0 - Sensitive Information Disclosure (medium 4.3)
- [CVE-2020-36667](https://insights.sbomify.com/CVE-2020-36667/): JetBackup – WP Backup, Migrate & Restore <= 1.4.1 - Missing Authorization to Unauthorized Backup Location Change (medium 5.4)
- [CVE-2020-36666](https://insights.sbomify.com/CVE-2020-36666/): Multiple e-plugins - Subscriber+ Privilege Escalation (high 8.8)
- [CVE-2020-36665](https://insights.sbomify.com/CVE-2020-36665/): Artesãos SEOTools TwitterCards.php eachValue redirect (medium 5.5)
- [CVE-2020-36664](https://insights.sbomify.com/CVE-2020-36664/): Artesãos SEOTools SEOMeta.php setTitle redirect (medium 5.5)
- [CVE-2020-36663](https://insights.sbomify.com/CVE-2020-36663/): Artesãos SEOTools OpenGraph.php makeTag redirect (medium 5.5)
- [CVE-2020-36661](https://insights.sbomify.com/CVE-2020-36661/): Kong lua-multipart multipart.lua is_header redos (low 3.5)
- [CVE-2020-36660](https://insights.sbomify.com/CVE-2020-36660/): paxswill EVE Ship Replacement Program User Information api.py information disclosure (medium 4.3)
- [CVE-2020-3666](https://insights.sbomify.com/CVE-2020-3666/): Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking (high 7.8)
- [CVE-2020-36659](https://insights.sbomify.com/CVE-2020-36659/): Security feature bypass in debian:debian linux (high 8.1)
- [CVE-2020-36658](https://insights.sbomify.com/CVE-2020-36658/): Security feature bypass in debian:debian linux (high 8.1)
- [CVE-2020-36657](https://insights.sbomify.com/CVE-2020-36657/): Privilege escalation in uptimed project:uptimed (high 7.8)
- [CVE-2020-36656](https://insights.sbomify.com/CVE-2020-36656/): Spectra < 1.15.0 - Contributor+ Stored Cross-Side Scripting (medium 5.4)
- [CVE-2020-36655](https://insights.sbomify.com/CVE-2020-36655/): Command injection in yiisoft/yii2-gii (high 8.8)
- [CVE-2020-36654](https://insights.sbomify.com/CVE-2020-36654/): GENI Portal sliceresource.php no_invocation_id_error cross site scripting (low 3.5)
- [CVE-2020-36653](https://insights.sbomify.com/CVE-2020-36653/): GENI Portal error-text.php cross site scripting (low 3.5)
- [CVE-2020-36652](https://insights.sbomify.com/CVE-2020-36652/): Misconfiguration in Hitachi Automation Director (medium 6.6)
- [CVE-2020-36651](https://insights.sbomify.com/CVE-2020-36651/): youngerheart nodeserver nodeserver.js path traversal (medium 5.5)
- [CVE-2020-36650](https://insights.sbomify.com/CVE-2020-36650/): IonicaBizau node-gry command injection (medium 5.5)
- [CVE-2020-3665](https://insights.sbomify.com/CVE-2020-3665/): Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables (high 7.8)
- [CVE-2020-36649](https://insights.sbomify.com/CVE-2020-36649/): mholt PapaParse papaparse.js redos (low 3.5)
- [CVE-2020-36648](https://insights.sbomify.com/CVE-2020-36648/): pouetnet pouet sql injection (medium 5.5)
- [CVE-2020-36647](https://insights.sbomify.com/CVE-2020-36647/): YunoHost-Apps transmission_ynh nginx.conf path traversal (medium 5.5)
- [CVE-2020-36646](https://insights.sbomify.com/CVE-2020-36646/): MediaArea ZenLib Ztring.cpp Date_From_Seconds_1970_Local unknown vulnerability (low 3.5)
- [CVE-2020-36645](https://insights.sbomify.com/CVE-2020-36645/): square squalor sql injection (medium 5.5)
- [CVE-2020-36644](https://insights.sbomify.com/CVE-2020-36644/): jamesmartin Inline SVG URL Parameter helpers.rb cross site scripting (low 3.5)
- [CVE-2020-36642](https://insights.sbomify.com/CVE-2020-36642/): trampgeek jobe LanguageTask.php run_in_sandbox command injection (medium 5.5)
- [CVE-2020-36641](https://insights.sbomify.com/CVE-2020-36641/): gturri aXMLRPC ResponseParser.java ResponseParser xml external entity reference (medium 5.5)
- [CVE-2020-36640](https://insights.sbomify.com/CVE-2020-36640/): bonita-connector-webservice XML External Entity vulnerability (medium 5.5)
- [CVE-2020-3664](https://insights.sbomify.com/CVE-2020-3664/): Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking (medium 6.0)
- [CVE-2020-36639](https://insights.sbomify.com/CVE-2020-36639/): AlliedModders AMX Mod X Console Command adminvote.sma cmdVoteMap path traversal (medium 4.3)
- [CVE-2020-36638](https://insights.sbomify.com/CVE-2020-36638/): Chris92de AdminServ adminserv.php cross site scripting (low 3.5)
- [CVE-2020-36637](https://insights.sbomify.com/CVE-2020-36637/): Chris92de AdminServ adminserv.php cross site scripting (low 3.5)
- [CVE-2020-36636](https://insights.sbomify.com/CVE-2020-36636/): OpenMRS Admin UI Module Account Setup AccountPageController.java sendErrorMessage cross site scripting (low 3.5)
- [CVE-2020-36635](https://insights.sbomify.com/CVE-2020-36635/): OpenMRS Appointment Scheduling Module AppointmentTypeValidator.java validateFieldName cross site scripting (low 3.5)
- [CVE-2020-36634](https://insights.sbomify.com/CVE-2020-36634/): Indeed Engineering util ViewExportedVariablesServlet.java appendTo cross site scripting (low 2.6)
- [CVE-2020-36633](https://insights.sbomify.com/CVE-2020-36633/): moodle-block_sitenews block_sitenews.php get_content cross-site request forgery (medium 4.3)
- [CVE-2020-36632](https://insights.sbomify.com/CVE-2020-36632/): hughsk flat index.js unflatten prototype pollution (medium 6.3)
- [CVE-2020-36631](https://insights.sbomify.com/CVE-2020-36631/): barronwaffles dwc_network_server_emulator gs_database.py update_profile sql injection (medium 6.3)
- [CVE-2020-36630](https://insights.sbomify.com/CVE-2020-36630/): FreePBX cdr Cdr.class.php ajaxHandler sql injection (medium 5.5)
- [CVE-2020-3663](https://insights.sbomify.com/CVE-2020-3663/): Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables (critical 9.8)
- [CVE-2020-36629](https://insights.sbomify.com/CVE-2020-36629/): SimbCo httpster server.coffee fs.realpathSync path traversal (medium 5.5)
- [CVE-2020-36628](https://insights.sbomify.com/CVE-2020-36628/): Calsign APDE ZIP File CopyBuildTask.java handleExtract path traversal (medium 5.5)
- [CVE-2020-36627](https://insights.sbomify.com/CVE-2020-36627/): Macaron i18n i18n.go redirect (medium 5.5)
- [CVE-2020-36626](https://insights.sbomify.com/CVE-2020-36626/): Modern Tribe Panel Builder Plugin SearchFilter.php add_post_content_filtered_to_search_sql sql injection (medium 5.5)
- [CVE-2020-36625](https://insights.sbomify.com/CVE-2020-36625/): destiny.gg chat main.go websocket.Upgrader cross-site request forgery (medium 4.3)
- [CVE-2020-36624](https://insights.sbomify.com/CVE-2020-36624/): ahorner text-helpers translation.rb reverse tabnabbing (medium 6.3)
- [CVE-2020-36623](https://insights.sbomify.com/CVE-2020-36623/): Pengu index.js runApp cross-site request forgery (medium 4.3)
- [CVE-2020-36622](https://insights.sbomify.com/CVE-2020-36622/): sah-comp bienlein cross-site request forgery (medium 4.3)
- [CVE-2020-36621](https://insights.sbomify.com/CVE-2020-36621/): chedabob whatismyudid mobileconfig.js exports.enrollment cross site scripting (low 3.5)
- [CVE-2020-36620](https://insights.sbomify.com/CVE-2020-36620/): Brondahl EnumStringValues EnumExtensions.cs GetStringValuesWithPreferences_Uncache resource consumption (low 3.5)
- [CVE-2020-3662](https://insights.sbomify.com/CVE-2020-3662/): Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables (critical 9.8)
- [CVE-2020-36619](https://insights.sbomify.com/CVE-2020-36619/): multimon-ng demod_flex.c add_ch format string (medium 5.5)
- [CVE-2020-36618](https://insights.sbomify.com/CVE-2020-36618/): Furqan node-whois index.coffee prototype pollution (medium 6.3)
- [CVE-2020-36617](https://insights.sbomify.com/CVE-2020-36617/): ewxrjk sftpserver parse.c sftp_parse_path uninitialized pointer (medium 4.6)
- [CVE-2020-36615](https://insights.sbomify.com/CVE-2020-36615/): Memory corruption in macOS (high 7.8)
- [CVE-2020-36611](https://insights.sbomify.com/CVE-2020-36611/): File and Directory Permission Vulnerability in Hitachi Tuning Manager (medium 6.6)
- [CVE-2020-36610](https://insights.sbomify.com/CVE-2020-36610/): annyshow DuxCMS cross-site request forgery (medium 4.3)
- [CVE-2020-3661](https://insights.sbomify.com/CVE-2020-3661/): Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables (critical 9.8)
- [CVE-2020-36609](https://insights.sbomify.com/CVE-2020-36609/): annyshow DuxCMS Article edit cross site scripting (low 2.4)
- [CVE-2020-36608](https://insights.sbomify.com/CVE-2020-36608/): Tribal Systems Zenario CMS Error Log Module admin_organizer.js cross site scripting (low 3.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/73/