# Vulnerabilities published in 2020


- [CVE-2020-29146](https://insights.sbomify.com/CVE-2020-29146/): Cross-site scripting in wayang-cms project:wayang-cms (medium 6.1)
- [CVE-2020-29145](https://insights.sbomify.com/CVE-2020-29145/): Cross-site scripting in ericsson:bscs ix r18 billing \& rating admx (medium 5.4)
- [CVE-2020-29144](https://insights.sbomify.com/CVE-2020-29144/): Cross-site scripting in ericsson:bscs ix r18 billing \& rating admx (medium 5.4)
- [CVE-2020-29143](https://insights.sbomify.com/CVE-2020-29143/): SQL injection in open-emr:openemr (high 7.2)
- [CVE-2020-29142](https://insights.sbomify.com/CVE-2020-29142/): SQL injection in open-emr:openemr (high 7.2)
- [CVE-2020-29140](https://insights.sbomify.com/CVE-2020-29140/): SQL injection in open-emr:openemr (high 7.2)
- [CVE-2020-2914](https://insights.sbomify.com/CVE-2020-2914/): Other in VM VirtualBox (high 7.0)
- [CVE-2020-29139](https://insights.sbomify.com/CVE-2020-29139/): SQL injection in open-emr:openemr (high 7.2)
- [CVE-2020-29138](https://insights.sbomify.com/CVE-2020-29138/): Missing authorization in sagemcom:f\@st 3486 router firmware (medium 5.3)
- [CVE-2020-29137](https://insights.sbomify.com/CVE-2020-29137/): Cross-site scripting in cpanel:cpanel (medium 6.1)
- [CVE-2020-29136](https://insights.sbomify.com/CVE-2020-29136/): Auth bypass in cpanel:cpanel (medium 6.5)
- [CVE-2020-29135](https://insights.sbomify.com/CVE-2020-29135/): Other in cpanel:cpanel (medium 4.1)
- [CVE-2020-29134](https://insights.sbomify.com/CVE-2020-29134/): Path traversal in totvs:fluig (high 8.6)
- [CVE-2020-29133](https://insights.sbomify.com/CVE-2020-29133/): Cross-site scripting in coremail xt project:coremail xt (medium 6.1)
- [CVE-2020-29130](https://insights.sbomify.com/CVE-2020-29130/): Memory corruption in debian:debian linux (medium 4.3)
- [CVE-2020-2913](https://insights.sbomify.com/CVE-2020-2913/): Other in VM VirtualBox (high 7.0)
- [CVE-2020-29129](https://insights.sbomify.com/CVE-2020-29129/): Memory corruption in debian:debian linux (medium 4.3)
- [CVE-2020-29128](https://insights.sbomify.com/CVE-2020-29128/): Duplicate Advisory: XML Injection in petl (critical 9.8)
- [CVE-2020-29127](https://insights.sbomify.com/CVE-2020-29127/): Auth bypass in fujitsu:eternus storage dx200 s4 firmware (critical 9.8)
- [CVE-2020-2912](https://insights.sbomify.com/CVE-2020-2912/): Information disclosure in PeopleSoft Enterprise CS Campus Community (medium 5.0)
- [CVE-2020-2911](https://insights.sbomify.com/CVE-2020-2911/): Other in VM VirtualBox (high 7.5)
- [CVE-2020-2910](https://insights.sbomify.com/CVE-2020-2910/): Other in VM VirtualBox (medium 6.5)
- [CVE-2020-2909](https://insights.sbomify.com/CVE-2020-2909/): Denial of service in VM VirtualBox (low 2.8)
- [CVE-2020-2908](https://insights.sbomify.com/CVE-2020-2908/): Memory corruption in VM VirtualBox (high 8.2)
- [CVE-2020-29075](https://insights.sbomify.com/CVE-2020-29075/): PDF Injection BlackHat Talk (high 7.1)
- [CVE-2020-29074](https://insights.sbomify.com/CVE-2020-29074/): Misconfiguration in debian:debian linux (high 8.8)
- [CVE-2020-29072](https://insights.sbomify.com/CVE-2020-29072/): Cross-site scripting in liquidfiles:liquidfiles (medium 6.1)
- [CVE-2020-29071](https://insights.sbomify.com/CVE-2020-29071/): Cross-site scripting in liquidfiles:liquidfiles (critical 9.0)
- [CVE-2020-29070](https://insights.sbomify.com/CVE-2020-29070/): Cross-site scripting in oscommerce:oscommerce (medium 4.8)
- [CVE-2020-2907](https://insights.sbomify.com/CVE-2020-2907/): Other in VM VirtualBox (high 7.5)
- [CVE-2020-29069](https://insights.sbomify.com/CVE-2020-29069/): Denial of service in modern honey network project:modern honey network (medium 5.5)
- [CVE-2020-29063](https://insights.sbomify.com/CVE-2020-29063/): Weak cryptography in cdatatec:72408a firmware (high 7.5)
- [CVE-2020-29062](https://insights.sbomify.com/CVE-2020-29062/): Hardcoded credentials in cdatatec:72408a firmware (critical 9.8)
- [CVE-2020-29061](https://insights.sbomify.com/CVE-2020-29061/): Hardcoded credentials in cdatatec:72408a firmware (critical 9.8)
- [CVE-2020-29060](https://insights.sbomify.com/CVE-2020-29060/): Hardcoded credentials in cdatatec:72408a firmware (critical 9.8)
- [CVE-2020-2906](https://insights.sbomify.com/CVE-2020-2906/): Other in PeopleSoft Enterprise SCM Purchasing (medium 6.5)
- [CVE-2020-29059](https://insights.sbomify.com/CVE-2020-29059/): Hardcoded credentials in cdatatec:72408a firmware (critical 9.8)
- [CVE-2020-29058](https://insights.sbomify.com/CVE-2020-29058/): Information disclosure in cdatatec:72408a firmware (critical 9.8)
- [CVE-2020-29057](https://insights.sbomify.com/CVE-2020-29057/): Denial of service in cdatatec:72408a firmware (high 7.5)
- [CVE-2020-29056](https://insights.sbomify.com/CVE-2020-29056/): Command injection in cdata:fd1104 firmware (critical 9.8)
- [CVE-2020-29055](https://insights.sbomify.com/CVE-2020-29055/): Weak cryptography in cdatatec:72408a firmware (medium 5.9)
- [CVE-2020-29054](https://insights.sbomify.com/CVE-2020-29054/): Information disclosure in cdatatec:72408a firmware (critical 9.8)
- [CVE-2020-29053](https://insights.sbomify.com/CVE-2020-29053/): Cross-site scripting in hrsale:hrsale (medium 6.1)
- [CVE-2020-29050](https://insights.sbomify.com/CVE-2020-29050/): Path traversal in debian:debian linux (high 7.5)
- [CVE-2020-2905](https://insights.sbomify.com/CVE-2020-2905/): Other in VM VirtualBox (high 8.2)
- [CVE-2020-29047](https://insights.sbomify.com/CVE-2020-29047/): Deserialization in thimpress:wp hotel booking (critical 9.8)
- [CVE-2020-29045](https://insights.sbomify.com/CVE-2020-29045/): Deserialization in fivestarplugins:five star restaurant menu (critical 9.8)
- [CVE-2020-29043](https://insights.sbomify.com/CVE-2020-29043/): Business logic in bigbluebutton:bigbluebutton (high 7.5)
- [CVE-2020-29042](https://insights.sbomify.com/CVE-2020-29042/): Auth bypass in bigbluebutton:bigbluebutton (low 3.7)
- [CVE-2020-29041](https://insights.sbomify.com/CVE-2020-29041/): Information disclosure in sesame-system:web-sesame (medium 5.3)
- [CVE-2020-29040](https://insights.sbomify.com/CVE-2020-29040/): Memory corruption in xen:xen (high 8.8)
- [CVE-2020-2904](https://insights.sbomify.com/CVE-2020-2904/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2020-29032](https://insights.sbomify.com/CVE-2020-29032/): Add integrity check of GateManager firmware (high 8.4)
- [CVE-2020-29031](https://insights.sbomify.com/CVE-2020-29031/): Insecure Direct Object Reference in GateManager WebUI can cause privilege escalation (high 7.1)
- [CVE-2020-29030](https://insights.sbomify.com/CVE-2020-29030/): Insufficient CSRF guards (high 8.1)
- [CVE-2020-2903](https://insights.sbomify.com/CVE-2020-2903/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2020-29029](https://insights.sbomify.com/CVE-2020-29029/): XSS issue due to insufficient sanitization of input field (high 7.3)
- [CVE-2020-29028](https://insights.sbomify.com/CVE-2020-29028/): Reflected XSS issues (medium 6.3)
- [CVE-2020-29027](https://insights.sbomify.com/CVE-2020-29027/): Reflected Cross Site Scripting (medium 5.4)
- [CVE-2020-29026](https://insights.sbomify.com/CVE-2020-29026/): Path traversal in GateManager (critical 9.0)
- [CVE-2020-29025](https://insights.sbomify.com/CVE-2020-29025/): DOM-based Javascript injection (medium 5.4)
- [CVE-2020-29024](https://insights.sbomify.com/CVE-2020-29024/): Missing HtppOnly and Secure flags (medium 5.3)
- [CVE-2020-29023](https://insights.sbomify.com/CVE-2020-29023/): CSV Formula Injection possible due to improper fields escaping in GateManager (low 3.5)
- [CVE-2020-29022](https://insights.sbomify.com/CVE-2020-29022/): Host Header Injection allowing web cache poisoning attacks (medium 5.3)
- [CVE-2020-29021](https://insights.sbomify.com/CVE-2020-29021/): Scripting tag chars < > not filtered in input fields could cause Cross-Site Scripting (XSS) (low 3.5)
- [CVE-2020-29020](https://insights.sbomify.com/CVE-2020-29020/): Reject Remote Management via Cellular UPLINK2 (critical 9.1)
- [CVE-2020-2902](https://insights.sbomify.com/CVE-2020-2902/): Memory corruption in VM VirtualBox (high 8.8)
- [CVE-2020-29019](https://insights.sbomify.com/CVE-2020-29019/): Memory corruption in Fortinet FortiWeb (medium 5.3)
- [CVE-2020-29018](https://insights.sbomify.com/CVE-2020-29018/): Memory corruption in Fortinet FortiWeb (high 8.8)
- [CVE-2020-29017](https://insights.sbomify.com/CVE-2020-29017/): Command injection in Fortinet FortiDeceptor (high 8.8)
- [CVE-2020-29016](https://insights.sbomify.com/CVE-2020-29016/): Memory corruption in Fortinet FortiWeb (critical 9.8)
- [CVE-2020-29015](https://insights.sbomify.com/CVE-2020-29015/): SQL injection in Fortinet FortiWeb (critical 9.8)
- [CVE-2020-29014](https://insights.sbomify.com/CVE-2020-29014/): Race condition in Fortinet FortiSandbox (medium 6.3)
- [CVE-2020-29013](https://insights.sbomify.com/CVE-2020-29013/): Denial of service in Fortinet FortiSandbox (medium 5.4)
- [CVE-2020-29012](https://insights.sbomify.com/CVE-2020-29012/): Auth bypass in Fortinet FortiSandbox (medium 5.6)
- [CVE-2020-29011](https://insights.sbomify.com/CVE-2020-29011/): SQL injection in Fortinet FortiSandbox (high 8.8)
- [CVE-2020-29010](https://insights.sbomify.com/CVE-2020-29010/): Information disclosure in FortiOS (medium 4.9)
- [CVE-2020-2901](https://insights.sbomify.com/CVE-2020-2901/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2020-29007](https://insights.sbomify.com/CVE-2020-29007/): Code injection in mediawiki:score (critical 9.8)
- [CVE-2020-29006](https://insights.sbomify.com/CVE-2020-29006/): Missing authorization in misp-project:misp (critical 9.8)
- [CVE-2020-29005](https://insights.sbomify.com/CVE-2020-29005/): Information disclosure in mediawiki:mediawiki (high 7.5)
- [CVE-2020-29004](https://insights.sbomify.com/CVE-2020-29004/): Cross-site request forgery in mediawiki:mediawiki (high 8.8)
- [CVE-2020-29003](https://insights.sbomify.com/CVE-2020-29003/): Cross-site scripting in mediawiki:mediawiki (medium 5.4)
- [CVE-2020-29002](https://insights.sbomify.com/CVE-2020-29002/): Cross-site scripting in mediawiki:mediawiki (medium 4.8)
- [CVE-2020-29001](https://insights.sbomify.com/CVE-2020-29001/): Hardcoded credentials in merkuryinnovations:geeni gnc-cw025 firmware (high 7.2)
- [CVE-2020-29000](https://insights.sbomify.com/CVE-2020-29000/): Auth bypass in mygeeni:gnc-cw013 firmware (high 7.2)
- [CVE-2020-2900](https://insights.sbomify.com/CVE-2020-2900/): Other in GraalVM Enterprise Edition (low 3.7)
- [CVE-2020-28999](https://insights.sbomify.com/CVE-2020-28999/): Hardcoded credentials in mygeeni:gnc-cw013 firmware (high 7.2)
- [CVE-2020-28998](https://insights.sbomify.com/CVE-2020-28998/): Hardcoded credentials in mygeeni:gnc-cw013 firmware (critical 9.8)
- [CVE-2020-28994](https://insights.sbomify.com/CVE-2020-28994/): SQL injection in karenderia multiple restaurant system project:karenderia multiple restaurant system (critical 9.8)
- [CVE-2020-28993](https://insights.sbomify.com/CVE-2020-28993/): Path traversal in atx:minicmts200a firmware (high 7.5)
- [CVE-2020-28991](https://insights.sbomify.com/CVE-2020-28991/): Improper Access Control in Gitea (critical 9.8)
- [CVE-2020-2899](https://insights.sbomify.com/CVE-2020-2899/): Other in PeopleSoft Enterprise SCM Purchasing (medium 4.8)
- [CVE-2020-28984](https://insights.sbomify.com/CVE-2020-28984/): Improper Input Validation in SPIP (critical 9.8)
- [CVE-2020-2898](https://insights.sbomify.com/CVE-2020-2898/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2020-28978](https://insights.sbomify.com/CVE-2020-28978/): Server-side request forgery in canto:canto (medium 5.3)
- [CVE-2020-28977](https://insights.sbomify.com/CVE-2020-28977/): Server-side request forgery in canto:canto (medium 5.3)
- [CVE-2020-28976](https://insights.sbomify.com/CVE-2020-28976/): Server-side request forgery in canto:canto (medium 5.3)
- [CVE-2020-28975](https://insights.sbomify.com/CVE-2020-28975/): scikit-learn Denial of Service (high 7.5)
- [CVE-2020-28974](https://insights.sbomify.com/CVE-2020-28974/): Memory corruption in debian:debian linux (medium 5.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/92/