# Vulnerabilities published in 2020


- [CVE-2020-36607](https://insights.sbomify.com/CVE-2020-36607/): FeehiCMS Cross Site Scripting vulnerability (medium 6.1)
- [CVE-2020-36605](https://insights.sbomify.com/CVE-2020-36605/): Misconfiguration in Hitachi Infrastructure Analytics Advisor (medium 6.6)
- [CVE-2020-36604](https://insights.sbomify.com/CVE-2020-36604/): hoek subject to prototype pollution via the clone function. (high 8.1)
- [CVE-2020-36603](https://insights.sbomify.com/CVE-2020-36603/): Privilege escalation in hoyoverse:mhyprot2 (medium 6.5)
- [CVE-2020-36602](https://insights.sbomify.com/CVE-2020-36602/): Memory corruption in 576up005 HOTA-CM-H-Shark-BD;577HOTA-CM-H-Shark-BD;581up-HOTA-CM-H-Shark-BD;586-HOTA-CM-H-Shark-BD;588-HOTA-CM-H-Shark-BD;606-HOTA-CM-H-Shark-BD;BI-ACC-REPORT;CM-H-Shark-BD (medium 6.1)
- [CVE-2020-36601](https://insights.sbomify.com/CVE-2020-36601/): Memory corruption in EMUI (high 7.5)
- [CVE-2020-36600](https://insights.sbomify.com/CVE-2020-36600/): Memory corruption in EMUI (high 7.5)
- [CVE-2020-3660](https://insights.sbomify.com/CVE-2020-3660/): Null dereference in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables (critical 9.8)
- [CVE-2020-36599](https://insights.sbomify.com/CVE-2020-36599/): OmniAuth's `lib/omniauth/failure_endpoint.rb` does not escape `message_key` value (critical 9.8)
- [CVE-2020-3658](https://insights.sbomify.com/CVE-2020-3658/): Null dereference in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables (critical 9.1)
- [CVE-2020-3657](https://insights.sbomify.com/CVE-2020-3657/): Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking (critical 9.8)
- [CVE-2020-36569](https://insights.sbomify.com/CVE-2020-36569/): Authentication bypass in github.com/nanobox-io/golang-nanoauth (critical 9.1)
- [CVE-2020-36568](https://insights.sbomify.com/CVE-2020-36568/): Resource exhaustion in github.com/revel/revel (high 7.5)
- [CVE-2020-36567](https://insights.sbomify.com/CVE-2020-36567/): Arbitrary log line injection in github.com/gin-gonic/gin (high 7.5)
- [CVE-2020-36566](https://insights.sbomify.com/CVE-2020-36566/): Path traversal in github.com/whyrusleeping/tar-utils (critical 9.1)
- [CVE-2020-36565](https://insights.sbomify.com/CVE-2020-36565/): Directory traversal on Windows in github.com/labstack/echo/v4 (medium 5.3)
- [CVE-2020-36564](https://insights.sbomify.com/CVE-2020-36564/): Improper input validation in github.com/justinas/nosurf (high 7.5)
- [CVE-2020-36563](https://insights.sbomify.com/CVE-2020-36563/): Weak hash (SHA-1) in github.com/RobotsAndPencils/go-saml (medium 5.3)
- [CVE-2020-36562](https://insights.sbomify.com/CVE-2020-36562/): Uncontrolled Resource Consumption in github.com/shiyanhui/dht (high 7.5)
- [CVE-2020-36561](https://insights.sbomify.com/CVE-2020-36561/): Path traversal in github.com/yi-ge/unzip (critical 9.1)
- [CVE-2020-36560](https://insights.sbomify.com/CVE-2020-36560/): Path traversal in github.com/artdarek/go-unzip (critical 9.1)
- [CVE-2020-3656](https://insights.sbomify.com/CVE-2020-3656/): Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables (high 7.8)
- [CVE-2020-36559](https://insights.sbomify.com/CVE-2020-36559/): Path Traversal in aahframe.work (high 7.5)
- [CVE-2020-36558](https://insights.sbomify.com/CVE-2020-36558/): Race condition in linux:linux kernel (medium 5.1)
- [CVE-2020-36557](https://insights.sbomify.com/CVE-2020-36557/): Use after free in linux:linux kernel (medium 5.1)
- [CVE-2020-36553](https://insights.sbomify.com/CVE-2020-36553/): Cross-site scripting in multi restaurant table reservation system project:multi restaurant table reservation system (medium 5.4)
- [CVE-2020-36552](https://insights.sbomify.com/CVE-2020-36552/): Cross-site scripting in multi restaurant table reservation system project:multi restaurant table reservation system (medium 5.4)
- [CVE-2020-36551](https://insights.sbomify.com/CVE-2020-36551/): Cross-site scripting in multi restaurant table reservation system project:multi restaurant table reservation system (medium 5.4)
- [CVE-2020-36550](https://insights.sbomify.com/CVE-2020-36550/): Cross-site scripting in multi restaurant table reservation system project:multi restaurant table reservation system (medium 5.4)
- [CVE-2020-36549](https://insights.sbomify.com/CVE-2020-36549/): GE Voluson S8 Windows Operating System Patches privileges management (high 8.8)
- [CVE-2020-36548](https://insights.sbomify.com/CVE-2020-36548/): GE Voluson S8 Service Browser users.cgi improper authentication (medium 5.9)
- [CVE-2020-36547](https://insights.sbomify.com/CVE-2020-36547/): GE Voluson S8 Service Browser hard-coded credentials (medium 5.9)
- [CVE-2020-36544](https://insights.sbomify.com/CVE-2020-36544/): SialWeb CMS Search cross site scriting (low 3.5)
- [CVE-2020-36543](https://insights.sbomify.com/CVE-2020-36543/): SialWeb CMS about.php sql injection (medium 6.3)
- [CVE-2020-36542](https://insights.sbomify.com/CVE-2020-36542/): Demokratian install3.php privileges management (high 7.3)
- [CVE-2020-36541](https://insights.sbomify.com/CVE-2020-36541/): Demokratian genera_select.php sql injection (high 7.3)
- [CVE-2020-36540](https://insights.sbomify.com/CVE-2020-36540/): Neetai Tech product.php sql injection (medium 6.3)
- [CVE-2020-3654](https://insights.sbomify.com/CVE-2020-3654/): Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables (critical 9.8)
- [CVE-2020-36539](https://insights.sbomify.com/CVE-2020-36539/): Lógico y Creativo sql injection (medium 6.3)
- [CVE-2020-36538](https://insights.sbomify.com/CVE-2020-36538/): Eatan CMS sql injection (medium 6.3)
- [CVE-2020-36537](https://insights.sbomify.com/CVE-2020-36537/): Everywhere CMS sql injection (medium 6.3)
- [CVE-2020-36536](https://insights.sbomify.com/CVE-2020-36536/): Brandbugle main.php sql injection (medium 6.3)
- [CVE-2020-36535](https://insights.sbomify.com/CVE-2020-36535/): MINMAX newsDia.php sql injection (medium 6.3)
- [CVE-2020-36534](https://insights.sbomify.com/CVE-2020-36534/): easyii CMS out cross-site request forgery (medium 4.3)
- [CVE-2020-36533](https://insights.sbomify.com/CVE-2020-36533/): Klapp App JSON Web Token improper authentication (low 3.7)
- [CVE-2020-36532](https://insights.sbomify.com/CVE-2020-36532/): Klapp App Authorization Credentials information disclosure (medium 4.3)
- [CVE-2020-36531](https://insights.sbomify.com/CVE-2020-36531/): SevOne Network Management System Device Manager Page injection (medium 6.3)
- [CVE-2020-36530](https://insights.sbomify.com/CVE-2020-36530/): SevOne Network Management System Alert Summary sql injection (medium 6.3)
- [CVE-2020-3653](https://insights.sbomify.com/CVE-2020-3653/): Memory corruption in Snapdragon Compute, Snapdragon Connectivity (critical 9.1)
- [CVE-2020-36529](https://insights.sbomify.com/CVE-2020-36529/): SevOne Network Management System Traceroute traceroute.php command injection (high 8.8)
- [CVE-2020-36528](https://insights.sbomify.com/CVE-2020-36528/): Platinum Mobile MobileHandler.ashx access control (medium 5.5)
- [CVE-2020-36527](https://insights.sbomify.com/CVE-2020-36527/): Server Status HTTP Status/SMTP Status cross site scripting (low 3.5)
- [CVE-2020-36526](https://insights.sbomify.com/CVE-2020-36526/): Countdown Timer Macro cross site scripting (low 3.5)
- [CVE-2020-36525](https://insights.sbomify.com/CVE-2020-36525/): Linking New Windows Macro cross site scripting (low 3.5)
- [CVE-2020-36524](https://insights.sbomify.com/CVE-2020-36524/): Refined Toolkit UI-Image/UI-Button cross site scripting (low 3.5)
- [CVE-2020-36523](https://insights.sbomify.com/CVE-2020-36523/): PlantUML Database Information Macro cross site scripting (low 3.5)
- [CVE-2020-36521](https://insights.sbomify.com/CVE-2020-36521/): Memory corruption in iCloud for Windows (high 7.1)
- [CVE-2020-3652](https://insights.sbomify.com/CVE-2020-3652/): Memory corruption in Snapdragon Compute, Snapdragon Connectivity (critical 9.1)
- [CVE-2020-36519](https://insights.sbomify.com/CVE-2020-36519/): Business logic in mimecast:email security (medium 4.9)
- [CVE-2020-36518](https://insights.sbomify.com/CVE-2020-36518/): Deeply nested json in jackson-databind (high 7.5)
- [CVE-2020-36517](https://insights.sbomify.com/CVE-2020-36517/): Information disclosure in home-assistant:home-assistant (high 7.5)
- [CVE-2020-36516](https://insights.sbomify.com/CVE-2020-36516/): Weak cryptography in linux:linux kernel (medium 5.9)
- [CVE-2020-36514](https://insights.sbomify.com/CVE-2020-36514/): Use of Uninitialized Resource in acc_reader. (critical 9.8)
- [CVE-2020-36513](https://insights.sbomify.com/CVE-2020-36513/): Use of Uninitialized Resource in acc_reader. (critical 9.8)
- [CVE-2020-36512](https://insights.sbomify.com/CVE-2020-36512/): InputStream::read_exact : `Read` on uninitialized buffer causes UB (critical 9.8)
- [CVE-2020-36511](https://insights.sbomify.com/CVE-2020-36511/): `read` on uninitialized buffer may cause UB (bite::read::BiteReadExpandedExt::read_framed_max) (high 7.5)
- [CVE-2020-36510](https://insights.sbomify.com/CVE-2020-36510/): 15Zine < 3.3.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2020-3651](https://insights.sbomify.com/CVE-2020-3651/): Denial of service in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables (high 7.5)
- [CVE-2020-36505](https://insights.sbomify.com/CVE-2020-36505/): Delete All Comments Easily <= 1.3 - All Comments Deletion via CSRF (medium 6.5)
- [CVE-2020-36504](https://insights.sbomify.com/CVE-2020-36504/): WP-Pro-Quiz <= 0.37 - Arbitrary Quiz Deletion via CSRF (medium 6.5)
- [CVE-2020-36503](https://insights.sbomify.com/CVE-2020-36503/): Connections Business Directory < 9.7 - Admin+ CSV Injection (high 8.0)
- [CVE-2020-36502](https://insights.sbomify.com/CVE-2020-36502/): Cross-site scripting in swiftfiletransfer:swift file transfer (medium 6.1)
- [CVE-2020-36501](https://insights.sbomify.com/CVE-2020-36501/): Cross-site scripting in sugarcrm:sugarcrm (medium 5.4)
- [CVE-2020-36499](https://insights.sbomify.com/CVE-2020-36499/): Cross-site scripting in taotesting:tao assessment platform (medium 5.4)
- [CVE-2020-36498](https://insights.sbomify.com/CVE-2020-36498/): Cross-site scripting in macrob7 macs framework content management system project:macrob7 macs framework content management system (medium 5.4)
- [CVE-2020-36497](https://insights.sbomify.com/CVE-2020-36497/): Cross-site scripting in dedecms:dedecms (medium 6.1)
- [CVE-2020-36496](https://insights.sbomify.com/CVE-2020-36496/): Cross-site scripting in dedecms:dedecms (medium 6.1)
- [CVE-2020-36495](https://insights.sbomify.com/CVE-2020-36495/): Cross-site scripting in dedecms:dedecms (medium 6.1)
- [CVE-2020-36494](https://insights.sbomify.com/CVE-2020-36494/): Cross-site scripting in dedecms:dedecms (medium 6.1)
- [CVE-2020-36493](https://insights.sbomify.com/CVE-2020-36493/): Cross-site scripting in dedecms:dedecms (medium 5.4)
- [CVE-2020-36492](https://insights.sbomify.com/CVE-2020-36492/): Cross-site scripting in dedecms:dedecms (medium 5.4)
- [CVE-2020-36491](https://insights.sbomify.com/CVE-2020-36491/): Cross-site scripting in dedecms:dedecms (medium 5.4)
- [CVE-2020-36490](https://insights.sbomify.com/CVE-2020-36490/): Cross-site scripting in dedecms:dedecms (medium 5.4)
- [CVE-2020-36489](https://insights.sbomify.com/CVE-2020-36489/): Cross-site scripting in dropouts:air share (medium 5.4)
- [CVE-2020-36488](https://insights.sbomify.com/CVE-2020-36488/): Path traversal in sky file project:sky file (medium 6.5)
- [CVE-2020-36486](https://insights.sbomify.com/CVE-2020-36486/): Cross-site scripting in swiftfiletransfer:swift file transfer (medium 6.1)
- [CVE-2020-36485](https://insights.sbomify.com/CVE-2020-36485/): File upload in madeportable:playable (high 7.8)
- [CVE-2020-3648](https://insights.sbomify.com/CVE-2020-3648/): Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables (high 7.8)
- [CVE-2020-36478](https://insights.sbomify.com/CVE-2020-36478/): Security feature bypass in arm:mbed tls (high 7.5)
- [CVE-2020-36477](https://insights.sbomify.com/CVE-2020-36477/): Security feature bypass in arm:mbed tls (medium 5.9)
- [CVE-2020-36476](https://insights.sbomify.com/CVE-2020-36476/): Information disclosure in arm:mbed tls (high 7.5)
- [CVE-2020-36475](https://insights.sbomify.com/CVE-2020-36475/): Denial of service in arm:mbed tls (high 7.5)
- [CVE-2020-36474](https://insights.sbomify.com/CVE-2020-36474/): SafeCurl before 0.9.2 has a DNS rebinding vulnerability. (critical 9.8)
- [CVE-2020-36473](https://insights.sbomify.com/CVE-2020-36473/): Information disclosure in ucweb:ucweb uc (low 3.7)
- [CVE-2020-36472](https://insights.sbomify.com/CVE-2020-36472/): Data races in max7301 (medium 5.9)
- [CVE-2020-36471](https://insights.sbomify.com/CVE-2020-36471/): Data races in generator (medium 5.9)
- [CVE-2020-36470](https://insights.sbomify.com/CVE-2020-36470/): Data race in disrustor (medium 5.9)
- [CVE-2020-3647](https://insights.sbomify.com/CVE-2020-3647/): Memory corruption in Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music (high 7.8)
- [CVE-2020-36469](https://insights.sbomify.com/CVE-2020-36469/): Data races in appendix (medium 5.9)
- [CVE-2020-36468](https://insights.sbomify.com/CVE-2020-36468/): Non-atomic writes in cgc (medium 5.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/74/