# Vulnerabilities published in 2020


- [CVE-2020-35252](https://insights.sbomify.com/CVE-2020-35252/): Cross-site scripting in egavilanmedia:user registration and login system with admin panel (medium 6.1)
- [CVE-2020-3525](https://insights.sbomify.com/CVE-2020-3525/): Cisco Identity Services Engine Password Disclosure to an Unauthorized Actor Vulnerability (medium 4.3)
- [CVE-2020-35249](https://insights.sbomify.com/CVE-2020-35249/): Cross-site scripting in elkarbackup:elkarbackup (medium 6.1)
- [CVE-2020-35245](https://insights.sbomify.com/CVE-2020-35245/): SQL injection in flamingo project:flamingo (critical 9.8)
- [CVE-2020-35244](https://insights.sbomify.com/CVE-2020-35244/): SQL injection in flamingo project:flamingo (critical 9.8)
- [CVE-2020-35243](https://insights.sbomify.com/CVE-2020-35243/): SQL injection in flamingo project:flamingo (critical 9.8)
- [CVE-2020-35242](https://insights.sbomify.com/CVE-2020-35242/): SQL injection in flamingo project:flamingo (critical 9.8)
- [CVE-2020-35241](https://insights.sbomify.com/CVE-2020-35241/): Cross-site scripting in flatpress:flatpress (medium 4.8)
- [CVE-2020-35240](https://insights.sbomify.com/CVE-2020-35240/): Cross-site scripting in fluxbb:fluxbb (medium 4.8)
- [CVE-2020-3524](https://insights.sbomify.com/CVE-2020-3524/): Cisco IOS XE ROM Monitor Software Vulnerability (medium 6.4)
- [CVE-2020-35239](https://insights.sbomify.com/CVE-2020-35239/): CakePHP allows method override parameters to bypass CSRF checks (high 8.8)
- [CVE-2020-35236](https://insights.sbomify.com/CVE-2020-35236/): Missing authorization in amazee:lagoon (medium 5.3)
- [CVE-2020-35235](https://insights.sbomify.com/CVE-2020-35235/): Missing authorization in themexa:secure file manager (high 8.8)
- [CVE-2020-35234](https://insights.sbomify.com/CVE-2020-35234/): Information disclosure in wp-ecommerce:easy wp smtp (high 7.5)
- [CVE-2020-35233](https://insights.sbomify.com/CVE-2020-35233/): Denial of service in netgear:gs116e firmware (medium 6.5)
- [CVE-2020-35231](https://insights.sbomify.com/CVE-2020-35231/): Auth bypass in netgear:gs116e firmware (high 8.8)
- [CVE-2020-35230](https://insights.sbomify.com/CVE-2020-35230/): Integer overflow in netgear:gs116e firmware (medium 6.8)
- [CVE-2020-3523](https://insights.sbomify.com/CVE-2020-3523/): Cisco Data Center Network Manager Cross-Site Scripting Vulnerability (medium 6.5)
- [CVE-2020-35229](https://insights.sbomify.com/CVE-2020-35229/): Auth bypass in netgear:gs116e firmware (high 8.8)
- [CVE-2020-35228](https://insights.sbomify.com/CVE-2020-35228/): Cross-site scripting in netgear:gs116e firmware (medium 4.8)
- [CVE-2020-35227](https://insights.sbomify.com/CVE-2020-35227/): Memory corruption in netgear:gs116e firmware (high 7.2)
- [CVE-2020-35226](https://insights.sbomify.com/CVE-2020-35226/): Missing authorization in netgear:gs116e firmware (high 7.1)
- [CVE-2020-35225](https://insights.sbomify.com/CVE-2020-35225/): Memory corruption in netgear:gs116e firmware (medium 6.8)
- [CVE-2020-35224](https://insights.sbomify.com/CVE-2020-35224/): Memory corruption in netgear:gs116e firmware (medium 6.5)
- [CVE-2020-35223](https://insights.sbomify.com/CVE-2020-35223/): Cross-site request forgery in netgear:gs116e firmware (high 8.8)
- [CVE-2020-35221](https://insights.sbomify.com/CVE-2020-35221/): Weak cryptography in netgear:gs116e firmware (high 8.8)
- [CVE-2020-3522](https://insights.sbomify.com/CVE-2020-3522/): Cisco Data Center Network Manager Authorization Bypass Vulnerability (medium 6.3)
- [CVE-2020-35219](https://insights.sbomify.com/CVE-2020-35219/): Auth bypass in asus:dsl-n17u firmware (critical 9.8)
- [CVE-2020-35217](https://insights.sbomify.com/CVE-2020-35217/): Cross-Site Request Forgery in Vert.x-Web framework (high 8.8)
- [CVE-2020-35216](https://insights.sbomify.com/CVE-2020-35216/): An issue in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via false member down event messages. (medium 5.9)
- [CVE-2020-35215](https://insights.sbomify.com/CVE-2020-35215/): Malicious Atomix node queries expose sensitive information (medium 6.5)
- [CVE-2020-35214](https://insights.sbomify.com/CVE-2020-35214/): An issue in Atomix v3.1.5 allows a malicious Atomix node to remove states of ONOS storage via abuse of primitive operations. (high 8.1)
- [CVE-2020-35213](https://insights.sbomify.com/CVE-2020-35213/): An issue in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via false link event messages sent to a master ONOS node. (high 8.1)
- [CVE-2020-35211](https://insights.sbomify.com/CVE-2020-35211/): An issue in Atomix v3.1.5 allows unauthorized Atomix nodes to become the lead node. (high 7.5)
- [CVE-2020-35210](https://insights.sbomify.com/CVE-2020-35210/): A vulnerability in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via a Raft session flooding attack using Raft OpenSessionRequest messages. (medium 6.5)
- [CVE-2020-3521](https://insights.sbomify.com/CVE-2020-3521/): Cisco Data Center Network Manager Read File Path Traversal Vulnerability (medium 5.3)
- [CVE-2020-35209](https://insights.sbomify.com/CVE-2020-35209/): An issue in Atomix v3.1.5 allows unauthorized Atomix nodes to join a target cluster via providing configuration information. (high 7.5)
- [CVE-2020-35208](https://insights.sbomify.com/CVE-2020-35208/): Auth bypass in logmein:lastpass (medium 5.7)
- [CVE-2020-35207](https://insights.sbomify.com/CVE-2020-35207/): Auth bypass in logmein:lastpass (medium 5.7)
- [CVE-2020-35206](https://insights.sbomify.com/CVE-2020-35206/): Cross-site scripting in quest:policy authority for unified communications (medium 6.1)
- [CVE-2020-35205](https://insights.sbomify.com/CVE-2020-35205/): Server-side request forgery in quest:policy authority for unified communications (critical 9.8)
- [CVE-2020-35204](https://insights.sbomify.com/CVE-2020-35204/): Cross-site scripting in quest:policy authority for unified communications (medium 6.1)
- [CVE-2020-35203](https://insights.sbomify.com/CVE-2020-35203/): Cross-site scripting in quest:policy authority for unified communications (medium 6.1)
- [CVE-2020-35202](https://insights.sbomify.com/CVE-2020-35202/): Cross-site scripting in igniterealtime:openfire (medium 5.4)
- [CVE-2020-35201](https://insights.sbomify.com/CVE-2020-35201/): Cross-site scripting in igniterealtime:openfire (medium 5.4)
- [CVE-2020-35200](https://insights.sbomify.com/CVE-2020-35200/): Cross-site scripting in igniterealtime:openfire (medium 6.1)
- [CVE-2020-3520](https://insights.sbomify.com/CVE-2020-3520/): Cisco Data Center Network Manager Information Disclosure Vulnerability (medium 5.5)
- [CVE-2020-35199](https://insights.sbomify.com/CVE-2020-35199/): Cross-site scripting in igniterealtime:openfire (medium 5.4)
- [CVE-2020-35198](https://insights.sbomify.com/CVE-2020-35198/): Integer overflow in oracle:communications eagle (critical 9.8)
- [CVE-2020-35197](https://insights.sbomify.com/CVE-2020-35197/): Hardcoded credentials in docker:memcached docker image (critical 9.8)
- [CVE-2020-35196](https://insights.sbomify.com/CVE-2020-35196/): Hardcoded credentials in docker:rabbitmq docker image (critical 9.8)
- [CVE-2020-35195](https://insights.sbomify.com/CVE-2020-35195/): Hardcoded credentials in docker:haproxy docker image (critical 9.8)
- [CVE-2020-35193](https://insights.sbomify.com/CVE-2020-35193/): Hardcoded credentials in sonarsource:sonarqube docker image (critical 9.8)
- [CVE-2020-35192](https://insights.sbomify.com/CVE-2020-35192/): Hardcoded credentials in hashicorp:vault (critical 9.8)
- [CVE-2020-35191](https://insights.sbomify.com/CVE-2020-35191/): Hardcoded credentials in drupal:drupal docker images (critical 9.8)
- [CVE-2020-35190](https://insights.sbomify.com/CVE-2020-35190/): Hardcoded credentials in plone:plone (critical 9.8)
- [CVE-2020-3519](https://insights.sbomify.com/CVE-2020-3519/): Cisco Data Center Network Manager Path Traversal Vulnerability (medium 5.4)
- [CVE-2020-35189](https://insights.sbomify.com/CVE-2020-35189/): Hardcoded credentials in kong:kong alpine docker image (critical 9.8)
- [CVE-2020-35187](https://insights.sbomify.com/CVE-2020-35187/): Hardcoded credentials in influxdata:telegraf (critical 9.8)
- [CVE-2020-35186](https://insights.sbomify.com/CVE-2020-35186/): Hardcoded credentials in docker:adminer (critical 9.8)
- [CVE-2020-35185](https://insights.sbomify.com/CVE-2020-35185/): Hardcoded credentials in docker:ghost alpine docker image (critical 9.8)
- [CVE-2020-35184](https://insights.sbomify.com/CVE-2020-35184/): Hardcoded credentials in docker:composer docker image (critical 9.8)
- [CVE-2020-3518](https://insights.sbomify.com/CVE-2020-3518/): Cisco Data Center Network Manager Cross-Site Scripting Vulnerability (medium 6.5)
- [CVE-2020-35177](https://insights.sbomify.com/CVE-2020-35177/): Enumeration of users in HashiCorp Vault (medium 5.3)
- [CVE-2020-35176](https://insights.sbomify.com/CVE-2020-35176/): Path traversal in awstats:awstats (medium 5.3)
- [CVE-2020-35175](https://insights.sbomify.com/CVE-2020-35175/): Security feature bypass in frappe:frappe (medium 5.3)
- [CVE-2020-35173](https://insights.sbomify.com/CVE-2020-35173/): Missing authorization in amaze file manager project:amaze file manager (critical 9.8)
- [CVE-2020-35170](https://insights.sbomify.com/CVE-2020-35170/): Cross-site scripting in Unisphere for PowerMax (medium 6.3)
- [CVE-2020-3517](https://insights.sbomify.com/CVE-2020-3517/): Cisco FXOS and NX-OS Software Cisco Fabric Services Denial of Service Vulnerability (high 8.6)
- [CVE-2020-35169](https://insights.sbomify.com/CVE-2020-35169/): Other in Dell BSAFE Crypto-C Micro Edition (critical 9.1)
- [CVE-2020-35168](https://insights.sbomify.com/CVE-2020-35168/): Weak cryptography in Dell BSAFE Crypto-C Micro Edition (medium 4.7)
- [CVE-2020-35167](https://insights.sbomify.com/CVE-2020-35167/): Weak cryptography in Dell BSAFE Crypto-C Micro Edition (medium 4.8)
- [CVE-2020-35166](https://insights.sbomify.com/CVE-2020-35166/): Weak cryptography in BSAFE Crypto-C Micro Edition (medium 5.1)
- [CVE-2020-35165](https://insights.sbomify.com/CVE-2020-35165/): Weak cryptography in Dell BSAFE Crypto-C Micro Edition (medium 5.1)
- [CVE-2020-35164](https://insights.sbomify.com/CVE-2020-35164/): Weak cryptography in Dell BSAFE Crypto-C Micro Edition (medium 6.7)
- [CVE-2020-35163](https://insights.sbomify.com/CVE-2020-35163/): Weak cryptography in Dell BSAFE Crypto-C Micro Edition (medium 5.3)
- [CVE-2020-3516](https://insights.sbomify.com/CVE-2020-3516/): Cisco IOS XE Software Web UI Improper Input Validation Vulnerability (medium 4.3)
- [CVE-2020-35152](https://insights.sbomify.com/CVE-2020-35152/): Privilege escalation through unquoted service binary path on Cloudflare WARP for Windows (medium 4.5)
- [CVE-2020-35151](https://insights.sbomify.com/CVE-2020-35151/): SQL injection in phpgurukul:online marriage registration system (high 8.8)
- [CVE-2020-3515](https://insights.sbomify.com/CVE-2020-3515/): Cisco Firepower Management Center Software Cross-Site Scripting Vulnerabilities (medium 4.8)
- [CVE-2020-35149](https://insights.sbomify.com/CVE-2020-35149/): Code Injection in mquery (medium 5.3)
- [CVE-2020-35145](https://insights.sbomify.com/CVE-2020-35145/): Privilege escalation in acronis:true image (high 7.8)
- [CVE-2020-35141](https://insights.sbomify.com/CVE-2020-35141/): FaucetSDN Ryu Denial of Service Vulnerability (high 7.5)
- [CVE-2020-3514](https://insights.sbomify.com/CVE-2020-3514/): Cisco Firepower Threat Defense Software Multi-Instance Container Escape Vulnerability (high 8.2)
- [CVE-2020-35139](https://insights.sbomify.com/CVE-2020-35139/): FaucetSDN Ryu Denial of Service Vulnerability (high 7.5)
- [CVE-2020-35138](https://insights.sbomify.com/CVE-2020-35138/): Hardcoded credentials in mobileiron:mobile\@work (critical 9.8)
- [CVE-2020-35137](https://insights.sbomify.com/CVE-2020-35137/): Hardcoded credentials in mobileiron:mobile\@work (high 7.5)
- [CVE-2020-35136](https://insights.sbomify.com/CVE-2020-35136/): Dolibarr authenticated Remote Code Execution (high 7.2)
- [CVE-2020-35135](https://insights.sbomify.com/CVE-2020-35135/): Cross-site request forgery in infolific:ultimate category excluder (high 8.8)
- [CVE-2020-35133](https://insights.sbomify.com/CVE-2020-35133/): Memory corruption in irfanview:irfanview (high 7.5)
- [CVE-2020-35132](https://insights.sbomify.com/CVE-2020-35132/): Cross-site scripting in fedoraproject:fedora (medium 5.4)
- [CVE-2020-35131](https://insights.sbomify.com/CVE-2020-35131/): Code injection in agentejo:cockpit (critical 9.8)
- [CVE-2020-3513](https://insights.sbomify.com/CVE-2020-3513/): Cisco IOS XE Software for Cisco ASR 900 Series Route Switch Processor 3 Arbitrary Code Execution Vulnerabilities (medium 6.7)
- [CVE-2020-35129](https://insights.sbomify.com/CVE-2020-35129/): Mautic stored Cross-site Scripting (XSS) (critical 9.0)
- [CVE-2020-35128](https://insights.sbomify.com/CVE-2020-35128/): Mautic stored Cross-site Scripting (XSS) (critical 9.0)
- [CVE-2020-35127](https://insights.sbomify.com/CVE-2020-35127/): Cross-site scripting in igniterealtime:openfire (medium 5.4)
- [CVE-2020-35126](https://insights.sbomify.com/CVE-2020-35126/): Cross-site scripting in typesettercms:typesetter (medium 4.8)
- [CVE-2020-35125](https://insights.sbomify.com/CVE-2020-35125/): Mautic is vulnerable to XSS vulnerability (critical 9.6)
- [CVE-2020-35124](https://insights.sbomify.com/CVE-2020-35124/): XSS vulnerability leveraged through referrers could allow un-authorized admin access in Mautic (critical 9.6)
- [CVE-2020-35123](https://insights.sbomify.com/CVE-2020-35123/): XML external entity in zimbra:collaboration (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/84/