# Vulnerabilities published in 2020


- [CVE-2020-35719](https://insights.sbomify.com/CVE-2020-35719/): Cross-site scripting in quest:policy authority for unified communications (medium 6.1)
- [CVE-2020-35717](https://insights.sbomify.com/CVE-2020-35717/): Cross-site scripting in electronjs:zonote (critical 9.0)
- [CVE-2020-35716](https://insights.sbomify.com/CVE-2020-35716/): Denial of service in linksys:re6500 firmware (high 7.5)
- [CVE-2020-35715](https://insights.sbomify.com/CVE-2020-35715/): Command injection in linksys:re6500 firmware (high 8.8)
- [CVE-2020-35714](https://insights.sbomify.com/CVE-2020-35714/): Command injection in linksys:re6500 firmware (high 8.8)
- [CVE-2020-35713](https://insights.sbomify.com/CVE-2020-35713/): Command injection in linksys:re6500 firmware (critical 9.8)
- [CVE-2020-35712](https://insights.sbomify.com/CVE-2020-35712/): Server-side request forgery in esri:arcgis server (critical 9.8)
- [CVE-2020-35711](https://insights.sbomify.com/CVE-2020-35711/): Dangling reference in `access::Map` with Constant (high 7.5)
- [CVE-2020-35710](https://insights.sbomify.com/CVE-2020-35710/): Information disclosure in parallels:remote application server (medium 5.3)
- [CVE-2020-3571](https://insights.sbomify.com/CVE-2020-3571/): Cisco Firepower 4110 ICMP Flood Denial of Service Vulnerability (high 8.6)
- [CVE-2020-35709](https://insights.sbomify.com/CVE-2020-35709/): Path traversal in bloofox:bloofoxcms (medium 4.9)
- [CVE-2020-35708](https://insights.sbomify.com/CVE-2020-35708/): SQL injection in phplist:phplist (high 7.2)
- [CVE-2020-35707](https://insights.sbomify.com/CVE-2020-35707/): Cross-site scripting in daybydaycrm:daybyday (medium 5.4)
- [CVE-2020-35706](https://insights.sbomify.com/CVE-2020-35706/): Cross-site scripting in daybydaycrm:daybyday (medium 5.4)
- [CVE-2020-35705](https://insights.sbomify.com/CVE-2020-35705/): Cross-site scripting in daybydaycrm:daybyday (medium 5.4)
- [CVE-2020-35704](https://insights.sbomify.com/CVE-2020-35704/): Cross-site scripting in daybydaycrm:daybyday (medium 5.4)
- [CVE-2020-35702](https://insights.sbomify.com/CVE-2020-35702/): Memory corruption in freedesktop:poppler (high 7.8)
- [CVE-2020-35701](https://insights.sbomify.com/CVE-2020-35701/): SQL injection in cacti:cacti (high 8.8)
- [CVE-2020-35700](https://insights.sbomify.com/CVE-2020-35700/): SQL Injection in librenms (high 8.8)
- [CVE-2020-35698](https://insights.sbomify.com/CVE-2020-35698/): Cross-site scripting in thinkific:thinkific (medium 6.1)
- [CVE-2020-35693](https://insights.sbomify.com/CVE-2020-35693/): Information disclosure in google:android (high 8.8)
- [CVE-2020-3569](https://insights.sbomify.com/CVE-2020-3569/): Cisco IOS XR Software DVMRP Memory Exhaustion (high 8.6, exploited in the wild)
- [CVE-2020-35687](https://insights.sbomify.com/CVE-2020-35687/): Cross-site request forgery in php-fusion:phpfusion (medium 4.3)
- [CVE-2020-35686](https://insights.sbomify.com/CVE-2020-35686/): Privilege escalation in soundresearch:dchu model software component modules (high 7.8)
- [CVE-2020-35685](https://insights.sbomify.com/CVE-2020-35685/): Weak cryptography in hcc-embedded:nichestack (critical 9.1)
- [CVE-2020-35684](https://insights.sbomify.com/CVE-2020-35684/): Memory corruption in hcc-embedded:nichestack (high 7.5)
- [CVE-2020-35683](https://insights.sbomify.com/CVE-2020-35683/): Memory corruption in hcc-embedded:nichestack (high 7.5)
- [CVE-2020-35682](https://insights.sbomify.com/CVE-2020-35682/): Auth bypass in zohocorp:manageengine servicedesk plus (high 8.8)
- [CVE-2020-35681](https://insights.sbomify.com/CVE-2020-35681/): Django Channels leakage of session identifiers using legacy AsgiHandler (high 7.4)
- [CVE-2020-35680](https://insights.sbomify.com/CVE-2020-35680/): Null dereference in fedoraproject:fedora (high 7.5)
- [CVE-2020-3568](https://insights.sbomify.com/CVE-2020-3568/): Cisco Email Security Appliance URL Filtering Bypass Vulnerability (medium 5.8)
- [CVE-2020-35679](https://insights.sbomify.com/CVE-2020-35679/): Denial of service in fedoraproject:fedora (high 7.5)
- [CVE-2020-35678](https://insights.sbomify.com/CVE-2020-35678/): Open Redirect in autobahn (medium 6.1)
- [CVE-2020-35677](https://insights.sbomify.com/CVE-2020-35677/): Cross-site scripting in bigprof:online invoicing system (medium 4.8)
- [CVE-2020-35676](https://insights.sbomify.com/CVE-2020-35676/): Cross-site scripting in bigprof:online invoicing system (medium 6.1)
- [CVE-2020-35675](https://insights.sbomify.com/CVE-2020-35675/): Cross-site request forgery in bigprof:online invoicing system (high 8.8)
- [CVE-2020-35674](https://insights.sbomify.com/CVE-2020-35674/): SQL injection in bigprof:online invoicing system (critical 9.8)
- [CVE-2020-3567](https://insights.sbomify.com/CVE-2020-3567/): Cisco Industrial Network Director Denial of Service Vulnerability (medium 6.5)
- [CVE-2020-35669](https://insights.sbomify.com/CVE-2020-35669/): http before 0.13.3 vulnerable to header injection (medium 6.1)
- [CVE-2020-35668](https://insights.sbomify.com/CVE-2020-35668/): Null dereference in redislabs:redisgraph (high 7.5)
- [CVE-2020-35667](https://insights.sbomify.com/CVE-2020-35667/): Server-side request forgery in jetbrains:teamcity (high 7.5)
- [CVE-2020-35666](https://insights.sbomify.com/CVE-2020-35666/): SQL injection in steedos:steedos (high 8.8)
- [CVE-2020-35665](https://insights.sbomify.com/CVE-2020-35665/): Command injection in terra-master:terramaster operating system (critical 9.8)
- [CVE-2020-35664](https://insights.sbomify.com/CVE-2020-35664/): Cross-site scripting in acronis:cyber protect (medium 6.1)
- [CVE-2020-35662](https://insights.sbomify.com/CVE-2020-35662/): SaltStack Salt Improper SSL Certificate Validation (high 7.4)
- [CVE-2020-35660](https://insights.sbomify.com/CVE-2020-35660/): Cross-site scripting in monicahq:monica (medium 5.4)
- [CVE-2020-3566](https://insights.sbomify.com/CVE-2020-3566/): Cisco IOS XR Software DVMRP Memory Exhaustion (high 8.6, exploited in the wild)
- [CVE-2020-35659](https://insights.sbomify.com/CVE-2020-35659/): Cross-site scripting in pi-hole:pi-hole (medium 6.1)
- [CVE-2020-35658](https://insights.sbomify.com/CVE-2020-35658/): Weak cryptography in titanhq:spamtitan (medium 5.3)
- [CVE-2020-35657](https://insights.sbomify.com/CVE-2020-35657/): File upload in jaws project:jaws (high 7.2)
- [CVE-2020-35656](https://insights.sbomify.com/CVE-2020-35656/): File upload in jaws project:jaws (high 7.2)
- [CVE-2020-35655](https://insights.sbomify.com/CVE-2020-35655/): Pillow Out-of-bounds Read (medium 5.4)
- [CVE-2020-35654](https://insights.sbomify.com/CVE-2020-35654/): Pillow Out-of-bounds Write (high 8.8)
- [CVE-2020-35653](https://insights.sbomify.com/CVE-2020-35653/): Pillow Out-of-bounds Read (high 7.1)
- [CVE-2020-35652](https://insights.sbomify.com/CVE-2020-35652/): Denial of service in digium:asterisk (medium 6.5)
- [CVE-2020-35650](https://insights.sbomify.com/CVE-2020-35650/): Cross-site scripting in uncannyowl:uncanny groups for learndash (medium 6.1)
- [CVE-2020-3565](https://insights.sbomify.com/CVE-2020-3565/): Cisco Firepower Threat Defense Software TCP Intercept Bypass Vulnerability (medium 5.8)
- [CVE-2020-3564](https://insights.sbomify.com/CVE-2020-3564/): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software FTP Inspection Bypass Vulnerability (medium 5.8)
- [CVE-2020-35636](https://insights.sbomify.com/CVE-2020-35636/): Memory corruption in CGAL Project (critical 10.0)
- [CVE-2020-35635](https://insights.sbomify.com/CVE-2020-35635/): Memory corruption in CGAL Project (critical 10.0)
- [CVE-2020-35634](https://insights.sbomify.com/CVE-2020-35634/): Memory corruption in CGAL Project (critical 10.0)
- [CVE-2020-35633](https://insights.sbomify.com/CVE-2020-35633/): Memory corruption in CGAL Project (critical 10.0)
- [CVE-2020-35632](https://insights.sbomify.com/CVE-2020-35632/): Memory corruption in libcgal (critical 10.0)
- [CVE-2020-35631](https://insights.sbomify.com/CVE-2020-35631/): Memory corruption in libcgal (critical 10.0)
- [CVE-2020-35630](https://insights.sbomify.com/CVE-2020-35630/): Memory corruption in libcgal (critical 10.0)
- [CVE-2020-3563](https://insights.sbomify.com/CVE-2020-3563/): Cisco Firepower Threat Defense Software TCP Flood Denial of Service Vulnerability (high 8.6)
- [CVE-2020-35629](https://insights.sbomify.com/CVE-2020-35629/): Memory corruption in libcgal (critical 10.0)
- [CVE-2020-35628](https://insights.sbomify.com/CVE-2020-35628/): Memory corruption in CGAL (critical 10.0)
- [CVE-2020-35627](https://insights.sbomify.com/CVE-2020-35627/): File upload in woocommerce:gift cards (high 8.8)
- [CVE-2020-35626](https://insights.sbomify.com/CVE-2020-35626/): Cross-site request forgery in mediawiki:mediawiki (high 8.8)
- [CVE-2020-35625](https://insights.sbomify.com/CVE-2020-35625/): Missing authorization in mediawiki:mediawiki (high 8.8)
- [CVE-2020-35624](https://insights.sbomify.com/CVE-2020-35624/): Information disclosure in mediawiki:mediawiki (medium 5.3)
- [CVE-2020-35623](https://insights.sbomify.com/CVE-2020-35623/): Auth bypass in mediawiki:mediawiki (high 7.5)
- [CVE-2020-35622](https://insights.sbomify.com/CVE-2020-35622/): Cross-site scripting in mediawiki:mediawiki (medium 6.1)
- [CVE-2020-3562](https://insights.sbomify.com/CVE-2020-3562/): Cisco Firepower 2100 Series SSL/TLS Inspection Denial of Service Vulnerability (high 8.6)
- [CVE-2020-35616](https://insights.sbomify.com/CVE-2020-35616/): [20201107] - Core - Write ACL violation in multiple core views (high 7.5)
- [CVE-2020-35615](https://insights.sbomify.com/CVE-2020-35615/): [20201106] - Core - CSRF in com_privacy emailexport feature (medium 6.3)
- [CVE-2020-35614](https://insights.sbomify.com/CVE-2020-35614/): [20201105] - Core - User Enumeration in backend login (medium 5.3)
- [CVE-2020-35613](https://insights.sbomify.com/CVE-2020-35613/): [20201104] - Core - SQL injection in com_users list view (critical 9.8)
- [CVE-2020-35612](https://insights.sbomify.com/CVE-2020-35612/): [20201103] - Core - Path traversal in mod_random_image (high 7.5)
- [CVE-2020-35611](https://insights.sbomify.com/CVE-2020-35611/): [20201102] - Core - Disclosure of secrets in Global Configuration page (high 7.5)
- [CVE-2020-35610](https://insights.sbomify.com/CVE-2020-35610/): [20201101] - Core - com_finder ignores access levels on autosuggest (high 7.5)
- [CVE-2020-3561](https://insights.sbomify.com/CVE-2020-3561/): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software WebVPN CRLF Injection Vulnerability (medium 4.7)
- [CVE-2020-35609](https://insights.sbomify.com/CVE-2020-35609/): Denial of service in microsoft:azure sphere (medium 5.5)
- [CVE-2020-35608](https://insights.sbomify.com/CVE-2020-35608/): Code injection in microsoft:azure sphere (high 7.8)
- [CVE-2020-35606](https://insights.sbomify.com/CVE-2020-35606/): Command injection in webmin:webmin (high 8.8)
- [CVE-2020-35605](https://insights.sbomify.com/CVE-2020-35605/): Command injection in debian:debian linux (critical 9.8)
- [CVE-2020-35604](https://insights.sbomify.com/CVE-2020-35604/): XML external entity in kronos:web time and attendance (critical 9.8)
- [CVE-2020-3560](https://insights.sbomify.com/CVE-2020-3560/): Cisco Aironet Access Points UDP Flooding Denial of Service Vulnerability (high 8.6)
- [CVE-2020-35598](https://insights.sbomify.com/CVE-2020-35598/): Path traversal in advanced comment system project:advanced comment system (high 7.5)
- [CVE-2020-35597](https://insights.sbomify.com/CVE-2020-35597/): SQL injection in victor cms project:victor cms (high 8.8)
- [CVE-2020-35594](https://insights.sbomify.com/CVE-2020-35594/): Cross-site scripting in zohocorp:manageengine admanager plus (medium 6.1)
- [CVE-2020-35593](https://insights.sbomify.com/CVE-2020-35593/): Privilege escalation in bmc:patrol agent (high 7.8)
- [CVE-2020-35592](https://insights.sbomify.com/CVE-2020-35592/): Cross-site scripting in pi-hole:pi-hole (medium 5.4)
- [CVE-2020-35591](https://insights.sbomify.com/CVE-2020-35591/): Auth bypass in pi-hole:pi-hole (medium 5.4)
- [CVE-2020-35590](https://insights.sbomify.com/CVE-2020-35590/): Security feature bypass in limitloginattempts:limit login attempts reloaded (critical 9.8)
- [CVE-2020-3559](https://insights.sbomify.com/CVE-2020-3559/): Cisco Aironet Access Point Authentication Flood Denial of Service Vulnerability (medium 6.8)
- [CVE-2020-35589](https://insights.sbomify.com/CVE-2020-35589/): Cross-site scripting in limitloginattempts:limit login attempts reloaded (medium 5.4)
- [CVE-2020-35587](https://insights.sbomify.com/CVE-2020-35587/): Weak cryptography in mersive:solstice firmware (high 7.5)
- [CVE-2020-35586](https://insights.sbomify.com/CVE-2020-35586/): Auth bypass in mersive:solstice pod firmware (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/81/