# Vulnerabilities published in 2020


- [CVE-2020-2977](https://insights.sbomify.com/CVE-2020-2977/): Other in Application Express (medium 4.6)
- [CVE-2020-2976](https://insights.sbomify.com/CVE-2020-2976/): Other in Application Express (medium 5.4)
- [CVE-2020-2975](https://insights.sbomify.com/CVE-2020-2975/): Other in Application Express (medium 5.4)
- [CVE-2020-2974](https://insights.sbomify.com/CVE-2020-2974/): Other in Application Express (medium 5.4)
- [CVE-2020-2973](https://insights.sbomify.com/CVE-2020-2973/): Other in Application Express (medium 5.4)
- [CVE-2020-2972](https://insights.sbomify.com/CVE-2020-2972/): Cross-site scripting in Application Express (medium 5.4)
- [CVE-2020-2971](https://insights.sbomify.com/CVE-2020-2971/): Other in Application Express (medium 5.4)
- [CVE-2020-2969](https://insights.sbomify.com/CVE-2020-2969/): Other in Oracle Database (medium 6.6)
- [CVE-2020-2968](https://insights.sbomify.com/CVE-2020-2968/): Other in Oracle Database (high 8.0)
- [CVE-2020-2967](https://insights.sbomify.com/CVE-2020-2967/): Other in WebLogic Server (high 7.5)
- [CVE-2020-29669](https://insights.sbomify.com/CVE-2020-29669/): Privilege escalation in macally:wifisd2-2a82 firmware (high 8.8)
- [CVE-2020-29668](https://insights.sbomify.com/CVE-2020-29668/): Auth bypass in debian:debian linux (low 3.7)
- [CVE-2020-29667](https://insights.sbomify.com/CVE-2020-29667/): Auth bypass in lanatmservice:m3 atm monitoring system (critical 9.8)
- [CVE-2020-29666](https://insights.sbomify.com/CVE-2020-29666/): Information disclosure in lanatmservice:m3 atm monitoring system (medium 5.3)
- [CVE-2020-29664](https://insights.sbomify.com/CVE-2020-29664/): Command injection in dji:mavic 2 firmware (high 7.8)
- [CVE-2020-29663](https://insights.sbomify.com/CVE-2020-29663/): Security feature bypass in icinga:icinga (critical 9.1)
- [CVE-2020-29662](https://insights.sbomify.com/CVE-2020-29662/): "catalog's registry v2 api exposed on unauthenticated path in Harbor" (medium 5.3)
- [CVE-2020-29661](https://insights.sbomify.com/CVE-2020-29661/): Use after free in broadcom:fabric operating system (high 7.8)
- [CVE-2020-29660](https://insights.sbomify.com/CVE-2020-29660/): Use after free in broadcom:fabric operating system (medium 4.4)
- [CVE-2020-2966](https://insights.sbomify.com/CVE-2020-2966/): Other in WebLogic Server (medium 5.4)
- [CVE-2020-29659](https://insights.sbomify.com/CVE-2020-29659/): Memory corruption in flexense:dupscout (critical 9.8)
- [CVE-2020-29658](https://insights.sbomify.com/CVE-2020-29658/): Misconfiguration in zohocorp:manageengine applications control plus (critical 9.8)
- [CVE-2020-29657](https://insights.sbomify.com/CVE-2020-29657/): Memory corruption in jerryscript:jerryscript (critical 9.1)
- [CVE-2020-29656](https://insights.sbomify.com/CVE-2020-29656/): Information disclosure in asus:rt-ac88u firmware (high 7.5)
- [CVE-2020-29655](https://insights.sbomify.com/CVE-2020-29655/): Other in asus:rt-ac88u firmware (high 7.5)
- [CVE-2020-29654](https://insights.sbomify.com/CVE-2020-29654/): Privilege escalation in westerndigital:dashboard (high 7.8)
- [CVE-2020-29653](https://insights.sbomify.com/CVE-2020-29653/): HTML Injection in Froxlor (medium 6.1)
- [CVE-2020-29652](https://insights.sbomify.com/CVE-2020-29652/): golang.org/x/crypto/ssh NULL Pointer Dereference vulnerability (high 7.5)
- [CVE-2020-29651](https://insights.sbomify.com/CVE-2020-29651/): py vulnerable to Regular Expression Denial of Service (high 7.5)
- [CVE-2020-2964](https://insights.sbomify.com/CVE-2020-2964/): Other in Financial Services Data Foundation (high 7.1)
- [CVE-2020-29639](https://insights.sbomify.com/CVE-2020-29639/): Memory corruption in iOS and iPadOS (medium 5.5)
- [CVE-2020-29633](https://insights.sbomify.com/CVE-2020-29633/): Auth bypass in macOS (high 8.8)
- [CVE-2020-2963](https://insights.sbomify.com/CVE-2020-2963/): Other in WebLogic Server (high 7.2)
- [CVE-2020-29629](https://insights.sbomify.com/CVE-2020-29629/): Memory corruption in macOS (medium 5.5)
- [CVE-2020-29625](https://insights.sbomify.com/CVE-2020-29625/): Memory corruption in macOS (high 7.8)
- [CVE-2020-29624](https://insights.sbomify.com/CVE-2020-29624/): Memory corruption in iOS and iPadOS (high 7.8)
- [CVE-2020-29623](https://insights.sbomify.com/CVE-2020-29623/): Information disclosure in iOS and iPadOS (low 3.3)
- [CVE-2020-29622](https://insights.sbomify.com/CVE-2020-29622/): Race condition in Security Update - Catalina (high 7.5)
- [CVE-2020-29621](https://insights.sbomify.com/CVE-2020-29621/): Security feature bypass in macOS (medium 5.5)
- [CVE-2020-29620](https://insights.sbomify.com/CVE-2020-29620/): Privilege escalation in macOS (high 7.8)
- [CVE-2020-29619](https://insights.sbomify.com/CVE-2020-29619/): Memory corruption in iOS and iPadOS (high 7.8)
- [CVE-2020-29618](https://insights.sbomify.com/CVE-2020-29618/): Memory corruption in iOS and iPadOS (high 7.8)
- [CVE-2020-29617](https://insights.sbomify.com/CVE-2020-29617/): Memory corruption in iOS and iPadOS (high 7.8)
- [CVE-2020-29616](https://insights.sbomify.com/CVE-2020-29616/): Memory corruption in macOS (high 7.8)
- [CVE-2020-29615](https://insights.sbomify.com/CVE-2020-29615/): Memory corruption in iOS and iPadOS (medium 5.5)
- [CVE-2020-29614](https://insights.sbomify.com/CVE-2020-29614/): Memory corruption in iOS and iPadOS (high 7.8)
- [CVE-2020-29613](https://insights.sbomify.com/CVE-2020-29613/): Business logic in iOS and iPadOS (medium 5.5)
- [CVE-2020-29612](https://insights.sbomify.com/CVE-2020-29612/): Memory corruption in macOS (high 7.8)
- [CVE-2020-29611](https://insights.sbomify.com/CVE-2020-29611/): Memory corruption in iOS and iPadOS (high 7.8)
- [CVE-2020-29610](https://insights.sbomify.com/CVE-2020-29610/): Memory corruption in iOS and iPadOS (medium 5.5)
- [CVE-2020-2961](https://insights.sbomify.com/CVE-2020-2961/): Other in Enterprise Manager Base Platform (critical 9.8)
- [CVE-2020-29608](https://insights.sbomify.com/CVE-2020-29608/): Memory corruption in iOS and iPadOS (medium 5.5)
- [CVE-2020-29607](https://insights.sbomify.com/CVE-2020-29607/): File upload in pluck-cms:pluck (high 7.2)
- [CVE-2020-29605](https://insights.sbomify.com/CVE-2020-29605/): MantisBT Incorrect Authorization in bug_actiongroup_page.php (medium 4.3)
- [CVE-2020-29604](https://insights.sbomify.com/CVE-2020-29604/): MantisBT Missing Authorization access check in bug_actiongroup.php (medium 6.5)
- [CVE-2020-29603](https://insights.sbomify.com/CVE-2020-29603/): MantisBT Insecure Storage in manage_proj_edit_page.php (medium 4.3)
- [CVE-2020-29602](https://insights.sbomify.com/CVE-2020-29602/): Hardcoded credentials in irssi:docker image (critical 9.8)
- [CVE-2020-29601](https://insights.sbomify.com/CVE-2020-29601/): Hardcoded credentials in docker:notary docker image (critical 9.8)
- [CVE-2020-29600](https://insights.sbomify.com/CVE-2020-29600/): Path traversal in awstats:awstats (critical 9.8)
- [CVE-2020-29599](https://insights.sbomify.com/CVE-2020-29599/): Command injection in debian:debian linux (high 7.8)
- [CVE-2020-29597](https://insights.sbomify.com/CVE-2020-29597/): File upload in incomcms project:incomcms (critical 9.8)
- [CVE-2020-29596](https://insights.sbomify.com/CVE-2020-29596/): Memory corruption in miniweb http server project:miniweb http server (high 7.5)
- [CVE-2020-29595](https://insights.sbomify.com/CVE-2020-29595/): Memory corruption in acdsee:photo studio 2021 (critical 9.8)
- [CVE-2020-29594](https://insights.sbomify.com/CVE-2020-29594/): Auth bypass in rocket.chat:rocket.chat (critical 9.8)
- [CVE-2020-29593](https://insights.sbomify.com/CVE-2020-29593/): Cross-site scripting in orchardproject:orchard (medium 5.4)
- [CVE-2020-29592](https://insights.sbomify.com/CVE-2020-29592/): File upload in orchardproject:orchard (critical 9.8)
- [CVE-2020-29591](https://insights.sbomify.com/CVE-2020-29591/): Hardcoded credentials in docker:registry (critical 9.8)
- [CVE-2020-2959](https://insights.sbomify.com/CVE-2020-2959/): Denial of service in VM VirtualBox (high 8.6)
- [CVE-2020-29587](https://insights.sbomify.com/CVE-2020-29587/): Cross-site scripting in simplcommerce:simplcommerce (medium 5.4)
- [CVE-2020-29583](https://insights.sbomify.com/CVE-2020-29583/): Zyxel Multiple Products Use of Hard-Coded Credentials (critical 9.8, exploited in the wild)
- [CVE-2020-29582](https://insights.sbomify.com/CVE-2020-29582/): Incorrect Default Permissions in JetBrains Kotlin (medium 5.3)
- [CVE-2020-29581](https://insights.sbomify.com/CVE-2020-29581/): Hardcoded credentials in docker:spiped alpine docker image (critical 9.8)
- [CVE-2020-29580](https://insights.sbomify.com/CVE-2020-29580/): Hardcoded credentials in docker:storm docker image (critical 9.8)
- [CVE-2020-2958](https://insights.sbomify.com/CVE-2020-2958/): Other in VM VirtualBox (high 7.5)
- [CVE-2020-29579](https://insights.sbomify.com/CVE-2020-29579/): Hardcoded credentials in express-gateway:express-gateway docker image (critical 9.8)
- [CVE-2020-29578](https://insights.sbomify.com/CVE-2020-29578/): Hardcoded credentials in matomo:piwik fpm-alpine docker image (critical 9.8)
- [CVE-2020-29577](https://insights.sbomify.com/CVE-2020-29577/): Hardcoded credentials in znc:znc docker image (critical 9.8)
- [CVE-2020-29576](https://insights.sbomify.com/CVE-2020-29576/): Hardcoded credentials in eggheads:eggdrop docker image (critical 9.8)
- [CVE-2020-29575](https://insights.sbomify.com/CVE-2020-29575/): Hardcoded credentials in docker:elixir alpine docker image (critical 9.8)
- [CVE-2020-29574](https://insights.sbomify.com/CVE-2020-29574/): CyberoamOS (CROS) SQL Injection (critical 9.8, exploited in the wild)
- [CVE-2020-29573](https://insights.sbomify.com/CVE-2020-29573/): Memory corruption in gnu:glibc (high 7.5)
- [CVE-2020-29572](https://insights.sbomify.com/CVE-2020-29572/): Cross-site scripting in misp-project:misp (medium 6.1)
- [CVE-2020-29571](https://insights.sbomify.com/CVE-2020-29571/): Null dereference in debian:debian linux (medium 6.2)
- [CVE-2020-29570](https://insights.sbomify.com/CVE-2020-29570/): Denial of service in debian:debian linux (medium 6.2)
- [CVE-2020-29569](https://insights.sbomify.com/CVE-2020-29569/): Use after free in debian:debian linux (high 8.8)
- [CVE-2020-29568](https://insights.sbomify.com/CVE-2020-29568/): Denial of service in debian:debian linux (medium 6.5)
- [CVE-2020-29567](https://insights.sbomify.com/CVE-2020-29567/): Denial of service in fedoraproject:fedora (medium 6.2)
- [CVE-2020-29566](https://insights.sbomify.com/CVE-2020-29566/): Denial of service in debian:debian linux (medium 5.5)
- [CVE-2020-29565](https://insights.sbomify.com/CVE-2020-29565/): OpenStack Horizon Open redirect in workflow forms (medium 6.1)
- [CVE-2020-29564](https://insights.sbomify.com/CVE-2020-29564/): Hardcoded credentials in hashicorp:consul docker image (critical 9.8)
- [CVE-2020-29563](https://insights.sbomify.com/CVE-2020-29563/): Auth bypass in westerndigital:my cloud os 5 (critical 9.8)
- [CVE-2020-29562](https://insights.sbomify.com/CVE-2020-29562/): Denial of service in fedoraproject:fedora (medium 4.8)
- [CVE-2020-29561](https://insights.sbomify.com/CVE-2020-29561/): Other in boom-core:risvc-boom (medium 5.5)
- [CVE-2020-2956](https://insights.sbomify.com/CVE-2020-2956/): Other in Human Resources (high 8.1)
- [CVE-2020-29557](https://insights.sbomify.com/CVE-2020-29557/): D-Link DIR-825 R1 Devices Buffer Overflow (critical 9.8, exploited in the wild)
- [CVE-2020-29556](https://insights.sbomify.com/CVE-2020-29556/): Grav CMS Local File Injection (medium 5.5)
- [CVE-2020-29555](https://insights.sbomify.com/CVE-2020-29555/): Grav CMS Arbitrary File Deletion (high 8.1)
- [CVE-2020-29553](https://insights.sbomify.com/CVE-2020-29553/): Grav CMS Cross-Site Request Forgery (CSRF) (high 8.8)
- [CVE-2020-29552](https://insights.sbomify.com/CVE-2020-29552/): Command injection in urve:urve (critical 9.8)
- [CVE-2020-29551](https://insights.sbomify.com/CVE-2020-29551/): Missing authorization in urve:urve (critical 9.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/89/