# Vulnerabilities published in 2020


- [CVE-2020-35918](https://insights.sbomify.com/CVE-2020-35918/): Unexpected panic when decoding tokens in branca (medium 5.5)
- [CVE-2020-35917](https://insights.sbomify.com/CVE-2020-35917/): Reference counting error in pyo3 (medium 5.5)
- [CVE-2020-35916](https://insights.sbomify.com/CVE-2020-35916/): Mutable reference with immutable provenance in image (medium 5.5)
- [CVE-2020-35915](https://insights.sbomify.com/CVE-2020-35915/): Data races in futures-intrusive (medium 5.5)
- [CVE-2020-35914](https://insights.sbomify.com/CVE-2020-35914/): Race condition in lock api project:lock api (medium 4.7)
- [CVE-2020-35913](https://insights.sbomify.com/CVE-2020-35913/): Race condition in lock api project:lock api (medium 4.7)
- [CVE-2020-35912](https://insights.sbomify.com/CVE-2020-35912/): Race condition in lock api project:lock api (medium 4.7)
- [CVE-2020-35911](https://insights.sbomify.com/CVE-2020-35911/): Race condition in lock api project:lock api (medium 4.7)
- [CVE-2020-35910](https://insights.sbomify.com/CVE-2020-35910/): Race condition in lock api project:lock api (medium 5.5)
- [CVE-2020-3591](https://insights.sbomify.com/CVE-2020-3591/): Cisco SD-WAN vManage Cross-Site Scripting Vulnerability (medium 4.3)
- [CVE-2020-35909](https://insights.sbomify.com/CVE-2020-35909/): Unexpected panic in multihash (high 7.5)
- [CVE-2020-35908](https://insights.sbomify.com/CVE-2020-35908/): Improper `Sync` implementation on `FuturesUnordered` in futures-utils can cause data corruption (medium 5.5)
- [CVE-2020-35907](https://insights.sbomify.com/CVE-2020-35907/): futures_task::noop_waker_ref can segfault due to dereferencing a NULL pointer (medium 5.5)
- [CVE-2020-35906](https://insights.sbomify.com/CVE-2020-35906/): futures_task::waker may cause a use-after-free if used on a type that isn't 'static (high 7.8)
- [CVE-2020-35905](https://insights.sbomify.com/CVE-2020-35905/): MutexGuard::map can cause a data race in safe code (medium 4.7)
- [CVE-2020-35904](https://insights.sbomify.com/CVE-2020-35904/): Memory corruption in crossbeam-channel project:crossbeam-channel (medium 5.5)
- [CVE-2020-35903](https://insights.sbomify.com/CVE-2020-35903/): Out of bounds read in dync (medium 5.5)
- [CVE-2020-35902](https://insights.sbomify.com/CVE-2020-35902/): Use-after-free in actix-codec (critical 9.8)
- [CVE-2020-35901](https://insights.sbomify.com/CVE-2020-35901/): Use-after-free in actix-http (high 7.5)
- [CVE-2020-35900](https://insights.sbomify.com/CVE-2020-35900/): use-after-free vulnerability in Rust array-queue (medium 5.5)
- [CVE-2020-3590](https://insights.sbomify.com/CVE-2020-3590/): Cisco SD-WAN vManage Software Cross-Site Scripting Vulnerability (medium 6.4)
- [CVE-2020-35899](https://insights.sbomify.com/CVE-2020-35899/): Use after free in actix-service (medium 5.5)
- [CVE-2020-35898](https://insights.sbomify.com/CVE-2020-35898/): Use after free in actix-utils (critical 9.1)
- [CVE-2020-35897](https://insights.sbomify.com/CVE-2020-35897/): Data races in atom (medium 4.7)
- [CVE-2020-35896](https://insights.sbomify.com/CVE-2020-35896/): Insufficient size checks in ws (high 7.5)
- [CVE-2020-35895](https://insights.sbomify.com/CVE-2020-35895/): Out-of-bounds write in stack (critical 9.8)
- [CVE-2020-35894](https://insights.sbomify.com/CVE-2020-35894/): Unaligned references in Obstack (high 7.5)
- [CVE-2020-35893](https://insights.sbomify.com/CVE-2020-35893/): Memory corruption in simple-slab project:simple-slab (high 7.5)
- [CVE-2020-35892](https://insights.sbomify.com/CVE-2020-35892/): Memory corruption in simple-slab project:simple-slab (critical 9.1)
- [CVE-2020-35891](https://insights.sbomify.com/CVE-2020-35891/): Double free in ordnung (high 7.5)
- [CVE-2020-35890](https://insights.sbomify.com/CVE-2020-35890/): Out of bounds read in ordnung (high 7.5)
- [CVE-2020-3589](https://insights.sbomify.com/CVE-2020-3589/): Cisco Identity Services Engine Cross-Site Scripting Vulnerability (medium 4.8)
- [CVE-2020-35889](https://insights.sbomify.com/CVE-2020-35889/): Memory safety violation in crayon (high 8.1)
- [CVE-2020-35888](https://insights.sbomify.com/CVE-2020-35888/): Memory corruption in arr project:arr (critical 9.8)
- [CVE-2020-35887](https://insights.sbomify.com/CVE-2020-35887/): Multiple security issues including data race, buffer overflow, and uninitialized memory drop in arr (critical 9.8)
- [CVE-2020-35886](https://insights.sbomify.com/CVE-2020-35886/): Race condition in arr project:arr (medium 4.7)
- [CVE-2020-35885](https://insights.sbomify.com/CVE-2020-35885/): Double free in alpm-rs (critical 9.8)
- [CVE-2020-35884](https://insights.sbomify.com/CVE-2020-35884/): HTTP Request smuggling in tiny_http (medium 6.5)
- [CVE-2020-35883](https://insights.sbomify.com/CVE-2020-35883/): Path traversal in mozwire (critical 9.1)
- [CVE-2020-35882](https://insights.sbomify.com/CVE-2020-35882/): Data races in rocket (high 8.1)
- [CVE-2020-35881](https://insights.sbomify.com/CVE-2020-35881/): Out of bounds write in traitobject (critical 9.8)
- [CVE-2020-35880](https://insights.sbomify.com/CVE-2020-35880/): Unsoundness in bigint (critical 9.8)
- [CVE-2020-3588](https://insights.sbomify.com/CVE-2020-3588/): Cisco Webex Meetings Desktop App Arbitrary Code Execution Vulnerability (high 7.3)
- [CVE-2020-35879](https://insights.sbomify.com/CVE-2020-35879/): Data races in rulinalg (critical 9.8)
- [CVE-2020-35878](https://insights.sbomify.com/CVE-2020-35878/): Drop of uninitialized memory in Ozone (critical 9.8)
- [CVE-2020-35877](https://insights.sbomify.com/CVE-2020-35877/): Out of bounds read in Ozone (critical 9.8)
- [CVE-2020-35876](https://insights.sbomify.com/CVE-2020-35876/): Use after free in rio (critical 9.8)
- [CVE-2020-35875](https://insights.sbomify.com/CVE-2020-35875/): Excessive memory usage in tokio-rustls (high 7.5)
- [CVE-2020-35874](https://insights.sbomify.com/CVE-2020-35874/): Use after free in internment (high 8.1)
- [CVE-2020-35873](https://insights.sbomify.com/CVE-2020-35873/): Use after free in rusqlite project:rusqlite (critical 9.8)
- [CVE-2020-35872](https://insights.sbomify.com/CVE-2020-35872/): Memory corruption in rusqlite project:rusqlite (critical 9.8)
- [CVE-2020-35871](https://insights.sbomify.com/CVE-2020-35871/): Race condition in rusqlite project:rusqlite (high 8.1)
- [CVE-2020-35870](https://insights.sbomify.com/CVE-2020-35870/): Use after free in rusqlite project:rusqlite (critical 9.8)
- [CVE-2020-3587](https://insights.sbomify.com/CVE-2020-3587/): Cisco SD-WAN vManage Software Cross-Site Scripting Vulnerability (medium 6.4)
- [CVE-2020-35869](https://insights.sbomify.com/CVE-2020-35869/): Memory corruption in rusqlite project:rusqlite (critical 9.8)
- [CVE-2020-35868](https://insights.sbomify.com/CVE-2020-35868/): Memory corruption in rusqlite project:rusqlite (critical 9.8)
- [CVE-2020-35867](https://insights.sbomify.com/CVE-2020-35867/): Memory corruption in rusqlite project:rusqlite (critical 9.8)
- [CVE-2020-35866](https://insights.sbomify.com/CVE-2020-35866/): Memory corruption in rusqlite project:rusqlite (critical 9.8)
- [CVE-2020-35865](https://insights.sbomify.com/CVE-2020-35865/): os_str_bytes relies on undefined behavior of `char::from_u32_unchecked` (high 7.5)
- [CVE-2020-35864](https://insights.sbomify.com/CVE-2020-35864/): Dangling reference in flatbuffers (high 7.5)
- [CVE-2020-35863](https://insights.sbomify.com/CVE-2020-35863/): HTTP Request Smuggling in hyper (critical 9.8)
- [CVE-2020-35862](https://insights.sbomify.com/CVE-2020-35862/): Use after free and double free in bitvec (critical 9.8)
- [CVE-2020-35861](https://insights.sbomify.com/CVE-2020-35861/): Out of bounds read in bumpalo (high 7.5)
- [CVE-2020-35860](https://insights.sbomify.com/CVE-2020-35860/): NULL Pointer Dereference in cbox (critical 9.8)
- [CVE-2020-3586](https://insights.sbomify.com/CVE-2020-3586/): Cisco DNA Spaces Connector Command Injection Vulnerability (critical 9.4)
- [CVE-2020-35859](https://insights.sbomify.com/CVE-2020-35859/): Out of bounds access in lucet-runtime-internals (critical 9.1)
- [CVE-2020-35858](https://insights.sbomify.com/CVE-2020-35858/): Out of bounds write in prost (critical 9.8)
- [CVE-2020-35857](https://insights.sbomify.com/CVE-2020-35857/): Stack consumption in trust-dns-server (high 7.5)
- [CVE-2020-35856](https://insights.sbomify.com/CVE-2020-35856/): Cross-site scripting in solarwinds:orion platform (medium 4.8)
- [CVE-2020-35854](https://insights.sbomify.com/CVE-2020-35854/): Cross-site scripting in textpattern:textpattern (medium 4.8)
- [CVE-2020-35853](https://insights.sbomify.com/CVE-2020-35853/): Cross-site scripting in 4homepages:4images (medium 4.8)
- [CVE-2020-35852](https://insights.sbomify.com/CVE-2020-35852/): Cross-site scripting in getgist:chatbox (medium 6.1)
- [CVE-2020-35851](https://insights.sbomify.com/CVE-2020-35851/): HGiga MailSherlock - Command Injection (high 8.1)
- [CVE-2020-35850](https://insights.sbomify.com/CVE-2020-35850/): Server-side request forgery in cockpit-project:cockpit (medium 6.5)
- [CVE-2020-3585](https://insights.sbomify.com/CVE-2020-3585/): Cisco Firepower 1000 Series Bleichenbacher Attack Vulnerability (medium 5.3)
- [CVE-2020-35849](https://insights.sbomify.com/CVE-2020-35849/): MantisBT Incorrect Authorization for bug_revision_view_page.php check (high 7.5)
- [CVE-2020-35848](https://insights.sbomify.com/CVE-2020-35848/): SQL injection in agentejo:cockpit (critical 9.8)
- [CVE-2020-35847](https://insights.sbomify.com/CVE-2020-35847/): SQL injection in agentejo:cockpit (critical 9.8)
- [CVE-2020-35846](https://insights.sbomify.com/CVE-2020-35846/): SQL injection in agentejo:cockpit (critical 9.8)
- [CVE-2020-35845](https://insights.sbomify.com/CVE-2020-35845/): Memory corruption in faststone:image viewer (high 7.8)
- [CVE-2020-35844](https://insights.sbomify.com/CVE-2020-35844/): Memory corruption in faststone:image viewer (high 7.8)
- [CVE-2020-35843](https://insights.sbomify.com/CVE-2020-35843/): Memory corruption in faststone:image viewer (medium 5.5)
- [CVE-2020-35842](https://insights.sbomify.com/CVE-2020-35842/): Cross-site scripting in netgear:d6200 firmware (medium 6.9)
- [CVE-2020-35841](https://insights.sbomify.com/CVE-2020-35841/): Cross-site scripting in netgear:d6200 firmware (medium 6.9)
- [CVE-2020-35840](https://insights.sbomify.com/CVE-2020-35840/): Cross-site scripting in netgear:d6200 firmware (medium 6.9)
- [CVE-2020-35839](https://insights.sbomify.com/CVE-2020-35839/): Cross-site scripting in netgear:d7800 firmware (medium 6.1)
- [CVE-2020-35838](https://insights.sbomify.com/CVE-2020-35838/): Cross-site scripting in netgear:d7800 firmware (medium 6.1)
- [CVE-2020-35837](https://insights.sbomify.com/CVE-2020-35837/): Cross-site scripting in netgear:d7800 firmware (medium 6.1)
- [CVE-2020-35836](https://insights.sbomify.com/CVE-2020-35836/): Cross-site scripting in netgear:d7800 firmware (medium 6.1)
- [CVE-2020-35835](https://insights.sbomify.com/CVE-2020-35835/): Cross-site scripting in netgear:d7800 firmware (medium 6.1)
- [CVE-2020-35834](https://insights.sbomify.com/CVE-2020-35834/): Cross-site scripting in netgear:d7800 firmware (medium 6.1)
- [CVE-2020-35833](https://insights.sbomify.com/CVE-2020-35833/): Cross-site scripting in netgear:d7800 firmware (medium 6.1)
- [CVE-2020-35832](https://insights.sbomify.com/CVE-2020-35832/): Cross-site scripting in netgear:d7800 firmware (medium 6.1)
- [CVE-2020-35831](https://insights.sbomify.com/CVE-2020-35831/): Cross-site scripting in netgear:d7800 firmware (medium 6.1)
- [CVE-2020-35830](https://insights.sbomify.com/CVE-2020-35830/): Cross-site scripting in netgear:d7800 firmware (medium 6.1)
- [CVE-2020-3583](https://insights.sbomify.com/CVE-2020-3583/): Cross-site scripting in Cisco Adaptive Security Appliance (ASA) Software (medium 6.1)
- [CVE-2020-35829](https://insights.sbomify.com/CVE-2020-35829/): Cross-site scripting in netgear:d7800 firmware (medium 6.1)
- [CVE-2020-35828](https://insights.sbomify.com/CVE-2020-35828/): Cross-site scripting in netgear:d7800 firmware (medium 6.1)
- [CVE-2020-35827](https://insights.sbomify.com/CVE-2020-35827/): Cross-site scripting in netgear:d7800 firmware (medium 6.1)
- [CVE-2020-35826](https://insights.sbomify.com/CVE-2020-35826/): Cross-site scripting in netgear:d7800 firmware (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/79/