# Vulnerabilities published in 2020


- [CVE-2020-36217](https://insights.sbomify.com/CVE-2020-36217/): Data race in may_queue (medium 5.9)
- [CVE-2020-36216](https://insights.sbomify.com/CVE-2020-36216/): Data race in eventio (medium 5.9)
- [CVE-2020-36215](https://insights.sbomify.com/CVE-2020-36215/): Data races in hashconsing (high 7.5)
- [CVE-2020-36214](https://insights.sbomify.com/CVE-2020-36214/): Data races in multiqueue2 (medium 5.9)
- [CVE-2020-36213](https://insights.sbomify.com/CVE-2020-36213/): Memory corruption in abi stable project:abi stable (high 7.5)
- [CVE-2020-36212](https://insights.sbomify.com/CVE-2020-36212/): Memory corruption in abi stable project:abi stable (high 7.5)
- [CVE-2020-36211](https://insights.sbomify.com/CVE-2020-36211/): Data races in gfwx (high 7.0)
- [CVE-2020-36210](https://insights.sbomify.com/CVE-2020-36210/): Free of uninitialized memory in autorand (high 7.8)
- [CVE-2020-3621](https://insights.sbomify.com/CVE-2020-3621/): Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking (medium 5.5)
- [CVE-2020-36209](https://insights.sbomify.com/CVE-2020-36209/): Data races in late-static (high 7.0)
- [CVE-2020-36208](https://insights.sbomify.com/CVE-2020-36208/): Data races in conquer-once (high 7.8)
- [CVE-2020-36207](https://insights.sbomify.com/CVE-2020-36207/): Data races in aovec (high 7.0)
- [CVE-2020-36206](https://insights.sbomify.com/CVE-2020-36206/): Data races in rusb (high 7.0)
- [CVE-2020-36205](https://insights.sbomify.com/CVE-2020-36205/): Memory handling issues in xcb (medium 5.5)
- [CVE-2020-36204](https://insights.sbomify.com/CVE-2020-36204/): Data races in im (medium 4.7)
- [CVE-2020-36203](https://insights.sbomify.com/CVE-2020-36203/): Data races in reffers (medium 4.7)
- [CVE-2020-36202](https://insights.sbomify.com/CVE-2020-36202/): Other in rust-lang:async-h1 (medium 6.1)
- [CVE-2020-36201](https://insights.sbomify.com/CVE-2020-36201/): Weak cryptography in xerox:workcentre 3655 firmware (high 7.5)
- [CVE-2020-36200](https://insights.sbomify.com/CVE-2020-36200/): Server-side request forgery in Kaspersky TinyCheck (medium 6.5)
- [CVE-2020-3620](https://insights.sbomify.com/CVE-2020-3620/): Integer overflow in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking (medium 5.5)
- [CVE-2020-36199](https://insights.sbomify.com/CVE-2020-36199/): Command injection in Kaspersky TinyCheck (critical 9.8)
- [CVE-2020-36198](https://insights.sbomify.com/CVE-2020-36198/): Command Injection Vulnerability in Malware Remover (medium 6.7)
- [CVE-2020-36197](https://insights.sbomify.com/CVE-2020-36197/): Improper Access Control Vulnerability in Music Station (high 7.1)
- [CVE-2020-36196](https://insights.sbomify.com/CVE-2020-36196/): Stored XSS Vulnerability in QuLog Center (medium 6.1)
- [CVE-2020-36195](https://insights.sbomify.com/CVE-2020-36195/): SQL Injection Vulnerability in Multimedia Console and the Media Streaming Add-On (critical 9.8)
- [CVE-2020-36194](https://insights.sbomify.com/CVE-2020-36194/): XSS Vulnerability in QTS and QuTS heroCommand Injection Vulnerabilities in QTS and QuTS hero (medium 6.1)
- [CVE-2020-36193](https://insights.sbomify.com/CVE-2020-36193/): PEAR Archive_Tar Improper Link Resolution (high 7.5, exploited in the wild)
- [CVE-2020-36192](https://insights.sbomify.com/CVE-2020-36192/): Missing authorization in mantisbt:source integration (medium 5.3)
- [CVE-2020-36191](https://insights.sbomify.com/CVE-2020-36191/): Cross-Site Request Forgery in JupyterHub (medium 4.5)
- [CVE-2020-36190](https://insights.sbomify.com/CVE-2020-36190/): rails_admin ruby gem XSS vulnerability (medium 6.1)
- [CVE-2020-3619](https://insights.sbomify.com/CVE-2020-3619/): Race condition in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking (high 7.0)
- [CVE-2020-36189](https://insights.sbomify.com/CVE-2020-36189/): Unsafe Deserialization in jackson-databind (high 8.1)
- [CVE-2020-36188](https://insights.sbomify.com/CVE-2020-36188/): Unsafe Deserialization in jackson-databind (high 8.1)
- [CVE-2020-36187](https://insights.sbomify.com/CVE-2020-36187/): Unsafe Deserialization in jackson-databind (high 8.1)
- [CVE-2020-36186](https://insights.sbomify.com/CVE-2020-36186/): Unsafe Deserialization in jackson-databind (high 8.1)
- [CVE-2020-36185](https://insights.sbomify.com/CVE-2020-36185/): Unsafe Deserialization in jackson-databind (high 8.1)
- [CVE-2020-36184](https://insights.sbomify.com/CVE-2020-36184/): Unsafe Deserialization in jackson-databind (high 8.8)
- [CVE-2020-36183](https://insights.sbomify.com/CVE-2020-36183/): Unsafe Deserialization in jackson-databind (high 8.1)
- [CVE-2020-36182](https://insights.sbomify.com/CVE-2020-36182/): Unsafe Deserialization in jackson-databind (high 8.8)
- [CVE-2020-36181](https://insights.sbomify.com/CVE-2020-36181/): Unsafe Deserialization in jackson-databind (high 8.8)
- [CVE-2020-36180](https://insights.sbomify.com/CVE-2020-36180/): Unsafe Deserialization in jackson-databind (high 8.8)
- [CVE-2020-3618](https://insights.sbomify.com/CVE-2020-3618/): Null dereference in Snapdragon Compute, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking (high 7.8)
- [CVE-2020-36179](https://insights.sbomify.com/CVE-2020-36179/): Unsafe Deserialization in jackson-databind (high 8.8)
- [CVE-2020-36178](https://insights.sbomify.com/CVE-2020-36178/): Command injection in tp-link:tl-wr840n firmware (critical 9.8)
- [CVE-2020-36177](https://insights.sbomify.com/CVE-2020-36177/): Memory corruption in wolfssl:wolfssl (critical 9.8)
- [CVE-2020-36176](https://insights.sbomify.com/CVE-2020-36176/): Auth bypass in ithemes:ithemes security (high 7.5)
- [CVE-2020-36175](https://insights.sbomify.com/CVE-2020-36175/): Security feature bypass in ninjaforms:ninja forms (medium 5.3)
- [CVE-2020-36174](https://insights.sbomify.com/CVE-2020-36174/): Cross-site request forgery in ninjaforms:ninja forms (medium 6.5)
- [CVE-2020-36173](https://insights.sbomify.com/CVE-2020-36173/): Cross-site scripting in ninjaforms:ninja forms (medium 5.3)
- [CVE-2020-36172](https://insights.sbomify.com/CVE-2020-36172/): Cross-site scripting in advancedcustomfields:advanced custom fields (medium 6.1)
- [CVE-2020-36171](https://insights.sbomify.com/CVE-2020-36171/): Cross-site scripting in elementor:website builder (medium 6.1)
- [CVE-2020-36170](https://insights.sbomify.com/CVE-2020-36170/): Other in ultimatemember:ultimate member (medium 5.3)
- [CVE-2020-3617](https://insights.sbomify.com/CVE-2020-3617/): Memory corruption in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile (high 7.1)
- [CVE-2020-36169](https://insights.sbomify.com/CVE-2020-36169/): Privilege escalation in veritas:netbackup (critical 9.3)
- [CVE-2020-36168](https://insights.sbomify.com/CVE-2020-36168/): Privilege escalation in veritas:resiliency platform (critical 9.3)
- [CVE-2020-36167](https://insights.sbomify.com/CVE-2020-36167/): Privilege escalation in veritas:backup exec (critical 9.3)
- [CVE-2020-36166](https://insights.sbomify.com/CVE-2020-36166/): Privilege escalation in veritas:infoscale (critical 9.3)
- [CVE-2020-36165](https://insights.sbomify.com/CVE-2020-36165/): Privilege escalation in veritas:desktop and laptop option (critical 9.3)
- [CVE-2020-36164](https://insights.sbomify.com/CVE-2020-36164/): Privilege escalation in veritas:enterprise vault (critical 9.3)
- [CVE-2020-36163](https://insights.sbomify.com/CVE-2020-36163/): Privilege escalation in veritas:netbackup (critical 9.3)
- [CVE-2020-36162](https://insights.sbomify.com/CVE-2020-36162/): Privilege escalation in veritas:cloudpoint (critical 9.3)
- [CVE-2020-36161](https://insights.sbomify.com/CVE-2020-36161/): Privilege escalation in veritas:aptare it analytics (high 8.8)
- [CVE-2020-36160](https://insights.sbomify.com/CVE-2020-36160/): Privilege escalation in veritas:system recovery (critical 9.3)
- [CVE-2020-3616](https://insights.sbomify.com/CVE-2020-3616/): Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables (high 7.8)
- [CVE-2020-36159](https://insights.sbomify.com/CVE-2020-36159/): Information disclosure in veritas:desktop and laptop option (medium 5.3)
- [CVE-2020-36158](https://insights.sbomify.com/CVE-2020-36158/): Memory corruption in debian:debian linux (high 8.8)
- [CVE-2020-36157](https://insights.sbomify.com/CVE-2020-36157/): Privilege escalation in ultimatemember:ultimate member (critical 10.0)
- [CVE-2020-36156](https://insights.sbomify.com/CVE-2020-36156/): Privilege escalation in ultimatemember:ultimate member (critical 9.9)
- [CVE-2020-36155](https://insights.sbomify.com/CVE-2020-36155/): Privilege escalation in ultimatemember:ultimate member (critical 10.0)
- [CVE-2020-36154](https://insights.sbomify.com/CVE-2020-36154/): Misconfiguration in pearson:vue testing system (high 7.8)
- [CVE-2020-36152](https://insights.sbomify.com/CVE-2020-36152/): Memory corruption in fedoraproject:fedora (high 8.8)
- [CVE-2020-36151](https://insights.sbomify.com/CVE-2020-36151/): Memory corruption in fedoraproject:fedora (medium 6.5)
- [CVE-2020-36150](https://insights.sbomify.com/CVE-2020-36150/): Memory corruption in fedoraproject:fedora (medium 6.5)
- [CVE-2020-3615](https://insights.sbomify.com/CVE-2020-3615/): Denial of service in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile (critical 9.8)
- [CVE-2020-36149](https://insights.sbomify.com/CVE-2020-36149/): Null dereference in fedoraproject:fedora (medium 6.5)
- [CVE-2020-36148](https://insights.sbomify.com/CVE-2020-36148/): Null dereference in fedoraproject:fedora (medium 6.5)
- [CVE-2020-36144](https://insights.sbomify.com/CVE-2020-36144/): Other in redash:redash (medium 5.3)
- [CVE-2020-36142](https://insights.sbomify.com/CVE-2020-36142/): Path traversal in bloofox:bloofoxcms (medium 6.5)
- [CVE-2020-36141](https://insights.sbomify.com/CVE-2020-36141/): File upload in bloofox:bloofoxcms (high 8.8)
- [CVE-2020-36140](https://insights.sbomify.com/CVE-2020-36140/): Cross-site request forgery in bloofox:bloofoxcms (medium 6.5)
- [CVE-2020-3614](https://insights.sbomify.com/CVE-2020-3614/): Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking (critical 9.8)
- [CVE-2020-36139](https://insights.sbomify.com/CVE-2020-36139/): Cross-site scripting in bloofox:bloofoxcms (medium 5.4)
- [CVE-2020-36138](https://insights.sbomify.com/CVE-2020-36138/): Null dereference in ffmpeg:ffmpeg (high 7.5)
- [CVE-2020-36136](https://insights.sbomify.com/CVE-2020-36136/): SQL injection in cskaza:cszcms (high 7.5)
- [CVE-2020-36135](https://insights.sbomify.com/CVE-2020-36135/): Null dereference in aomedia:aomedia (medium 6.5)
- [CVE-2020-36134](https://insights.sbomify.com/CVE-2020-36134/): Memory corruption in aomedia:aomedia (medium 6.5)
- [CVE-2020-36133](https://insights.sbomify.com/CVE-2020-36133/): Memory corruption in aomedia:aomedia (high 8.8)
- [CVE-2020-36131](https://insights.sbomify.com/CVE-2020-36131/): Memory corruption in aomedia:aomedia (high 8.8)
- [CVE-2020-36130](https://insights.sbomify.com/CVE-2020-36130/): Null dereference in aomedia:aomedia (medium 6.5)
- [CVE-2020-3613](https://insights.sbomify.com/CVE-2020-3613/): Memory corruption in Snapdragon Compute, Snapdragon Mobile, Snapdragon Voice & Music (high 7.8)
- [CVE-2020-36129](https://insights.sbomify.com/CVE-2020-36129/): Memory corruption in aomedia:aomedia (high 8.8)
- [CVE-2020-36128](https://insights.sbomify.com/CVE-2020-36128/): Auth bypass in paxtechnology:paxstore (high 8.2)
- [CVE-2020-36127](https://insights.sbomify.com/CVE-2020-36127/): Information disclosure in paxtechnology:paxstore (medium 6.5)
- [CVE-2020-36126](https://insights.sbomify.com/CVE-2020-36126/): Missing authorization in paxtechnology:paxstore (high 8.1)
- [CVE-2020-36125](https://insights.sbomify.com/CVE-2020-36125/): Auth bypass in paxtechnology:paxstore (high 7.1)
- [CVE-2020-36124](https://insights.sbomify.com/CVE-2020-36124/): XML external entity in paxtechnology:paxstore (medium 6.5)
- [CVE-2020-36120](https://insights.sbomify.com/CVE-2020-36120/): Memory corruption in saitoha:libsixel (high 7.5)
- [CVE-2020-36115](https://insights.sbomify.com/CVE-2020-36115/): Cross-site scripting in egavilanmedia:phpcrud (medium 5.4)
- [CVE-2020-36112](https://insights.sbomify.com/CVE-2020-36112/): SQL injection in cse bookstore project:cse bookstore (critical 9.8)
- [CVE-2020-3611](https://insights.sbomify.com/CVE-2020-3611/): Security feature bypass in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/77/