# Vulnerabilities published in 2020


- [CVE-2020-36109](https://insights.sbomify.com/CVE-2020-36109/): Memory corruption in asus:rt-ax86u firmware (critical 9.8)
- [CVE-2020-3610](https://insights.sbomify.com/CVE-2020-3610/): Memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables (high 7.8)
- [CVE-2020-36085](https://insights.sbomify.com/CVE-2020-36085/): Stored Cross Site Scripting(XSS) vulnerability in Egavilan Media Resumes Management and Job Application Website 1.0 allows remote attackers (medium 6.3)
- [CVE-2020-36084](https://insights.sbomify.com/CVE-2020-36084/): SQL injection in jkev:responsive e-learning system (critical 9.8)
- [CVE-2020-36082](https://insights.sbomify.com/CVE-2020-36082/): File upload in bloofox:bloofoxcms (critical 9.8)
- [CVE-2020-36079](https://insights.sbomify.com/CVE-2020-36079/): File upload in zenphoto:zenphoto (high 7.2)
- [CVE-2020-36077](https://insights.sbomify.com/CVE-2020-36077/): SQL injection in tailor management system project:tailor management system (high 8.8)
- [CVE-2020-36074](https://insights.sbomify.com/CVE-2020-36074/): SQL injection in tailor management system project:tailor management system (high 8.8)
- [CVE-2020-36073](https://insights.sbomify.com/CVE-2020-36073/): SQL injection in tailor management system project:tailor management system (high 8.8)
- [CVE-2020-36072](https://insights.sbomify.com/CVE-2020-36072/): SQL injection in tailor management system project:tailor management system (high 8.8)
- [CVE-2020-36071](https://insights.sbomify.com/CVE-2020-36071/): SQL injection in tailor management system project:tailor management system (high 8.8)
- [CVE-2020-36070](https://insights.sbomify.com/CVE-2020-36070/): Remote code execution in Voyager (critical 9.8)
- [CVE-2020-36067](https://insights.sbomify.com/CVE-2020-36067/): Improper Validation of Array Index in GJSON (high 7.5)
- [CVE-2020-36066](https://insights.sbomify.com/CVE-2020-36066/): github.com/tidwall/gjson is vulnerable to Denial of service (high 7.5)
- [CVE-2020-36065](https://insights.sbomify.com/CVE-2020-36065/): Cross-site request forgery in flycms project:flycms (high 8.8)
- [CVE-2020-36064](https://insights.sbomify.com/CVE-2020-36064/): Hardcoded credentials in online course registration project:online course registration (critical 9.8)
- [CVE-2020-36062](https://insights.sbomify.com/CVE-2020-36062/): Hardcoded credentials in phpgurukul:dairy farm shop management system (critical 9.8)
- [CVE-2020-36056](https://insights.sbomify.com/CVE-2020-36056/): Cross-site scripting in beetel:777vr1 firmware (medium 5.4)
- [CVE-2020-36052](https://insights.sbomify.com/CVE-2020-36052/): Path traversal in 1234n:minicms (critical 9.8)
- [CVE-2020-36051](https://insights.sbomify.com/CVE-2020-36051/): Path traversal in 1234n:minicms (high 7.5)
- [CVE-2020-36049](https://insights.sbomify.com/CVE-2020-36049/): Resource exhaustion in socket.io-parser (high 7.5)
- [CVE-2020-36048](https://insights.sbomify.com/CVE-2020-36048/): Resource exhaustion in engine.io (high 7.5)
- [CVE-2020-3604](https://insights.sbomify.com/CVE-2020-3604/): Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities (high 7.8)
- [CVE-2020-36037](https://insights.sbomify.com/CVE-2020-36037/): Code injection in wuzhicms:wuzhicms (high 8.8)
- [CVE-2020-36034](https://insights.sbomify.com/CVE-2020-36034/): SQL injection in school faculty scheduling system project:school faculty scheduling system (critical 9.8)
- [CVE-2020-36033](https://insights.sbomify.com/CVE-2020-36033/): SQL injection in water billing system project:water billing system (critical 9.8)
- [CVE-2020-3603](https://insights.sbomify.com/CVE-2020-3603/): Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities (high 7.8)
- [CVE-2020-36024](https://insights.sbomify.com/CVE-2020-36024/): Null dereference in freedesktop:poppler (medium 5.5)
- [CVE-2020-36023](https://insights.sbomify.com/CVE-2020-36023/): Denial of service in freedesktop:poppler (medium 6.5)
- [CVE-2020-3602](https://insights.sbomify.com/CVE-2020-3602/): Cisco StarOS Privilege Escalation Vulnerability (medium 6.3)
- [CVE-2020-36012](https://insights.sbomify.com/CVE-2020-36012/): Cross-site scripting in bdtask:multi-store (medium 4.8)
- [CVE-2020-36011](https://insights.sbomify.com/CVE-2020-36011/): Cross-site scripting in qdocs:smart hospital (medium 4.8)
- [CVE-2020-3601](https://insights.sbomify.com/CVE-2020-3601/): Cisco StarOS Privilege Escalation Vulnerability (medium 4.4)
- [CVE-2020-36009](https://insights.sbomify.com/CVE-2020-36009/): Path traversal in obottle project:obottle (high 7.5)
- [CVE-2020-36008](https://insights.sbomify.com/CVE-2020-36008/): Path traversal in obottle project:obottle (high 8.1)
- [CVE-2020-36007](https://insights.sbomify.com/CVE-2020-36007/): Cross-site scripting in appcms:appcms (medium 6.1)
- [CVE-2020-36006](https://insights.sbomify.com/CVE-2020-36006/): Path traversal in appcms:appcms (medium 6.5)
- [CVE-2020-36005](https://insights.sbomify.com/CVE-2020-36005/): Path traversal in appcms:appcms (medium 6.5)
- [CVE-2020-36004](https://insights.sbomify.com/CVE-2020-36004/): SQL injection in appcms:appcms (medium 6.5)
- [CVE-2020-36003](https://insights.sbomify.com/CVE-2020-36003/): SQL injection in online book store project:online book store (high 7.5)
- [CVE-2020-36002](https://insights.sbomify.com/CVE-2020-36002/): SQL injection in seat-reservation-system project:seat-reservation-system (high 7.5)
- [CVE-2020-3600](https://insights.sbomify.com/CVE-2020-3600/): Cisco SD-WAN Software Privilege Escalation Vulnerability (high 7.8)
- [CVE-2020-35992](https://insights.sbomify.com/CVE-2020-35992/): Weak cryptography in fiserv:prologue (medium 6.5)
- [CVE-2020-35990](https://insights.sbomify.com/CVE-2020-35990/): Memory corruption in foxit:pdf reader (medium 5.5)
- [CVE-2020-3599](https://insights.sbomify.com/CVE-2020-3599/): Cisco Adaptive Security Appliance Software Web-Based Management Interface Reflected Cross-Site Scripting Vulnerability (medium 6.1)
- [CVE-2020-35987](https://insights.sbomify.com/CVE-2020-35987/): Cross-site scripting in rukovoditel:rukovoditel (medium 5.4)
- [CVE-2020-35986](https://insights.sbomify.com/CVE-2020-35986/): Cross-site scripting in rukovoditel:rukovoditel (medium 5.4)
- [CVE-2020-35985](https://insights.sbomify.com/CVE-2020-35985/): Cross-site scripting in rukovoditel:rukovoditel (medium 5.4)
- [CVE-2020-35984](https://insights.sbomify.com/CVE-2020-35984/): Cross-site scripting in rukovoditel:rukovoditel (medium 5.4)
- [CVE-2020-35982](https://insights.sbomify.com/CVE-2020-35982/): Null dereference in gpac:gpac (high 7.8)
- [CVE-2020-35981](https://insights.sbomify.com/CVE-2020-35981/): Null dereference in gpac:gpac (high 7.8)
- [CVE-2020-35980](https://insights.sbomify.com/CVE-2020-35980/): Use after free in gpac:gpac (high 7.8)
- [CVE-2020-3598](https://insights.sbomify.com/CVE-2020-3598/): Cisco Vision Dynamic Signage Director Missing Authentication Vulnerability (medium 6.5)
- [CVE-2020-35979](https://insights.sbomify.com/CVE-2020-35979/): Memory corruption in gpac:gpac (high 7.8)
- [CVE-2020-35973](https://insights.sbomify.com/CVE-2020-35973/): Cross-site scripting in zzcms:zzcms (medium 5.4)
- [CVE-2020-35972](https://insights.sbomify.com/CVE-2020-35972/): Cross-site request forgery in yzmcms:yzmcms (medium 4.3)
- [CVE-2020-35971](https://insights.sbomify.com/CVE-2020-35971/): Cross-site scripting in yzmcms:yzmcms (medium 5.4)
- [CVE-2020-35970](https://insights.sbomify.com/CVE-2020-35970/): Server-side request forgery in yzmcms:yzmcms (high 7.5)
- [CVE-2020-3597](https://insights.sbomify.com/CVE-2020-3597/): Cisco Nexus Data Broker Software Path Traversal Vulnerability (medium 5.4)
- [CVE-2020-35965](https://insights.sbomify.com/CVE-2020-35965/): Memory corruption in debian:debian linux (high 7.5)
- [CVE-2020-35964](https://insights.sbomify.com/CVE-2020-35964/): Memory corruption in ffmpeg:ffmpeg (medium 6.5)
- [CVE-2020-35963](https://insights.sbomify.com/CVE-2020-35963/): Memory corruption in treasuredata:fluent bit (high 7.8)
- [CVE-2020-35962](https://insights.sbomify.com/CVE-2020-35962/): Missing authorization in loopring:loopring (high 7.5)
- [CVE-2020-3596](https://insights.sbomify.com/CVE-2020-3596/): Cisco Expressway Series and TelePresence Video Communication Server Denial of Service Vulnerability (medium 5.9)
- [CVE-2020-35952](https://insights.sbomify.com/CVE-2020-35952/): Information disclosure in php-fusion:php-fusion (medium 6.5)
- [CVE-2020-35951](https://insights.sbomify.com/CVE-2020-35951/): Missing authorization in expresstech:quiz and survey master (critical 9.9)
- [CVE-2020-35950](https://insights.sbomify.com/CVE-2020-35950/): Cross-site request forgery in xcloner:xcloner (critical 9.8)
- [CVE-2020-3595](https://insights.sbomify.com/CVE-2020-3595/): Cisco SD-WAN Software Privilege Escalation Vulnerability (high 7.8)
- [CVE-2020-35949](https://insights.sbomify.com/CVE-2020-35949/): File upload in expresstech:quiz and survey master (critical 10.0)
- [CVE-2020-35948](https://insights.sbomify.com/CVE-2020-35948/): Missing authorization in xcloner:xcloner (critical 9.9)
- [CVE-2020-35947](https://insights.sbomify.com/CVE-2020-35947/): Missing authorization in pagelayer:pagelayer (high 7.4)
- [CVE-2020-35946](https://insights.sbomify.com/CVE-2020-35946/): Cross-site scripting in semperplugins:all in one seo pack (medium 5.4)
- [CVE-2020-35945](https://insights.sbomify.com/CVE-2020-35945/): File upload in elegantthemes:divi (critical 9.9)
- [CVE-2020-35944](https://insights.sbomify.com/CVE-2020-35944/): Cross-site request forgery in pagelayer:pagelayer (high 8.8)
- [CVE-2020-35943](https://insights.sbomify.com/CVE-2020-35943/): Cross-site request forgery in imagely:nextgen gallery (medium 6.5)
- [CVE-2020-35942](https://insights.sbomify.com/CVE-2020-35942/): Cross-site request forgery in imagely:nextgen gallery (high 8.8)
- [CVE-2020-3594](https://insights.sbomify.com/CVE-2020-3594/): Cisco SD-WAN Software Privilege Escalation Vulnerability (high 7.8)
- [CVE-2020-35939](https://insights.sbomify.com/CVE-2020-35939/): Deserialization in pickplugins:post grid (high 7.5)
- [CVE-2020-35938](https://insights.sbomify.com/CVE-2020-35938/): Deserialization in pickplugins:post grid (high 7.5)
- [CVE-2020-35937](https://insights.sbomify.com/CVE-2020-35937/): Cross-site scripting in pickplugins:post grid (high 7.5)
- [CVE-2020-35936](https://insights.sbomify.com/CVE-2020-35936/): Cross-site scripting in pickplugins:post grid (high 7.5)
- [CVE-2020-35935](https://insights.sbomify.com/CVE-2020-35935/): Privilege escalation in vasyltech:advanced access manager (high 7.5)
- [CVE-2020-35934](https://insights.sbomify.com/CVE-2020-35934/): Information disclosure in vasyltech:advanced access manager (medium 4.3)
- [CVE-2020-35933](https://insights.sbomify.com/CVE-2020-35933/): Cross-site scripting in thenewsletterplugin:newsletter (medium 6.5)
- [CVE-2020-35932](https://insights.sbomify.com/CVE-2020-35932/): Deserialization in tribulant:newsletter (high 7.5)
- [CVE-2020-35931](https://insights.sbomify.com/CVE-2020-35931/): Security feature bypass in foxitsoftware:foxit reader (high 7.8)
- [CVE-2020-35930](https://insights.sbomify.com/CVE-2020-35930/): Cross-site scripting in seopanel:seo panel (medium 5.4)
- [CVE-2020-3593](https://insights.sbomify.com/CVE-2020-3593/): Cisco SD-WAN Software Privilege Escalation Vulnerability (high 7.8)
- [CVE-2020-35929](https://insights.sbomify.com/CVE-2020-35929/): Hardcoded credentials in TinyCheck (critical 9.8)
- [CVE-2020-35928](https://insights.sbomify.com/CVE-2020-35928/): Data races in concread (medium 4.7)
- [CVE-2020-35927](https://insights.sbomify.com/CVE-2020-35927/): Data races in thex (medium 5.5)
- [CVE-2020-35926](https://insights.sbomify.com/CVE-2020-35926/): Improper random number generation in nanorand (critical 9.8)
- [CVE-2020-35925](https://insights.sbomify.com/CVE-2020-35925/): Data races in magnetic (medium 5.5)
- [CVE-2020-35924](https://insights.sbomify.com/CVE-2020-35924/): Data races in try-mutex (medium 5.5)
- [CVE-2020-35923](https://insights.sbomify.com/CVE-2020-35923/): ordered_float:NotNan may contain NaN after panic in assignment operators (medium 5.5)
- [CVE-2020-35922](https://insights.sbomify.com/CVE-2020-35922/): mio invalidly assumes the memory layout of std::net::SocketAddr (medium 5.5)
- [CVE-2020-35921](https://insights.sbomify.com/CVE-2020-35921/): miow invalidly assumes the memory layout of std::net::SocketAddr (medium 5.5)
- [CVE-2020-35920](https://insights.sbomify.com/CVE-2020-35920/): Memory corruption in rust-lang:socket2 (medium 5.5)
- [CVE-2020-3592](https://insights.sbomify.com/CVE-2020-3592/): Cisco SD-WAN vManage Software Authorization Bypass Vulnerability (medium 6.5)
- [CVE-2020-35919](https://insights.sbomify.com/CVE-2020-35919/): Memory corruption in net2 project:net2 (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/78/