# Vulnerabilities published in 2020


- [CVE-2020-28973](https://insights.sbomify.com/CVE-2020-28973/): Auth bypass in abus:secvest wireless alarm system fuaa50000 firmware (high 7.5)
- [CVE-2020-28972](https://insights.sbomify.com/CVE-2020-28972/): SaltStack Salt Improper Certificate Validation (medium 5.9)
- [CVE-2020-28971](https://insights.sbomify.com/CVE-2020-28971/): Auth bypass in westerndigital:my cloud os 5 (critical 9.8)
- [CVE-2020-28970](https://insights.sbomify.com/CVE-2020-28970/): Auth bypass in westerndigital:my cloud os 5 (critical 9.8)
- [CVE-2020-2897](https://insights.sbomify.com/CVE-2020-2897/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2020-28969](https://insights.sbomify.com/CVE-2020-28969/): Memory corruption in aplixio:pdf shapingup (high 7.8)
- [CVE-2020-28968](https://insights.sbomify.com/CVE-2020-28968/): Cross-site scripting in draytek:vigorap 1000c firmware (medium 5.4)
- [CVE-2020-28967](https://insights.sbomify.com/CVE-2020-28967/): Memory corruption in flashget:flashget (high 8.8)
- [CVE-2020-28964](https://insights.sbomify.com/CVE-2020-28964/): Memory corruption in tonec:internet download manager (medium 6.7)
- [CVE-2020-28963](https://insights.sbomify.com/CVE-2020-28963/): Memory corruption in krylack:zip password recovery (high 7.8)
- [CVE-2020-28961](https://insights.sbomify.com/CVE-2020-28961/): Cross-site scripting in perfexcrm:perfex crm (medium 5.4)
- [CVE-2020-28960](https://insights.sbomify.com/CVE-2020-28960/): SQL injection in cct95:chichen tech cms (critical 9.8)
- [CVE-2020-2896](https://insights.sbomify.com/CVE-2020-2896/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2020-28957](https://insights.sbomify.com/CVE-2020-28957/): Foxlor cross-site scripting (XSS) vulnerability (medium 5.4)
- [CVE-2020-28956](https://insights.sbomify.com/CVE-2020-28956/): Cross-site scripting in sugarcrm:sugarcrm (medium 5.4)
- [CVE-2020-28955](https://insights.sbomify.com/CVE-2020-28955/): Cross-site scripting in sugarcrm:sugarcrm (medium 5.4)
- [CVE-2020-28954](https://insights.sbomify.com/CVE-2020-28954/): Other in bigbluebutton:bigbluebutton (medium 5.3)
- [CVE-2020-28953](https://insights.sbomify.com/CVE-2020-28953/): Business logic in bigbluebutton:bigbluebutton (medium 4.3)
- [CVE-2020-28952](https://insights.sbomify.com/CVE-2020-28952/): Hardcoded credentials in homey:homey firmware (high 7.5)
- [CVE-2020-28951](https://insights.sbomify.com/CVE-2020-28951/): Use after free in openwrt:openwrt (critical 9.8)
- [CVE-2020-28950](https://insights.sbomify.com/CVE-2020-28950/): Privilege escalation in Kaspersky Anti-Ransomware Tool (high 7.8)
- [CVE-2020-2895](https://insights.sbomify.com/CVE-2020-2895/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2020-28949](https://insights.sbomify.com/CVE-2020-28949/): PEAR Archive_Tar Deserialization of Untrusted Data (high 7.8, exploited in the wild)
- [CVE-2020-28948](https://insights.sbomify.com/CVE-2020-28948/): Deserialization in debian:debian linux (high 7.8)
- [CVE-2020-28947](https://insights.sbomify.com/CVE-2020-28947/): Cross-site scripting in misp-project:misp (medium 6.1)
- [CVE-2020-28946](https://insights.sbomify.com/CVE-2020-28946/): Misconfiguration in plummac:ik-401 firmware (high 7.5)
- [CVE-2020-28945](https://insights.sbomify.com/CVE-2020-28945/): Cross-site scripting in open-xchange:open-xchange appsuite (medium 6.1)
- [CVE-2020-28944](https://insights.sbomify.com/CVE-2020-28944/): Denial of service in open-xchange:ox guard (high 7.5)
- [CVE-2020-28943](https://insights.sbomify.com/CVE-2020-28943/): Server-side request forgery in open-xchange:open-xchange appsuite (medium 6.5)
- [CVE-2020-28942](https://insights.sbomify.com/CVE-2020-28942/): Security feature bypass in primekey:ejbca (medium 4.3)
- [CVE-2020-28941](https://insights.sbomify.com/CVE-2020-28941/): Memory corruption in debian:debian linux (medium 5.5)
- [CVE-2020-28940](https://insights.sbomify.com/CVE-2020-28940/): Auth bypass in westerndigital:my cloud os 5 (critical 9.8)
- [CVE-2020-2894](https://insights.sbomify.com/CVE-2020-2894/): Other in VM VirtualBox (medium 6.0)
- [CVE-2020-28939](https://insights.sbomify.com/CVE-2020-28939/): File upload in openclinic project:openclinic (high 7.2)
- [CVE-2020-28938](https://insights.sbomify.com/CVE-2020-28938/): Cross-site scripting in openclinic project:openclinic (medium 5.4)
- [CVE-2020-28937](https://insights.sbomify.com/CVE-2020-28937/): Missing authorization in openclinic project:openclinic (high 7.5)
- [CVE-2020-28935](https://insights.sbomify.com/CVE-2020-28935/): Local symlink attack in Unbound and NSD (medium 5.5)
- [CVE-2020-28931](https://insights.sbomify.com/CVE-2020-28931/): Cross-site request forgery in epson:eps tse server 8 firmware (high 8.8)
- [CVE-2020-28930](https://insights.sbomify.com/CVE-2020-28930/): Cross-site scripting in epson:eps tse server 8 firmware (medium 5.4)
- [CVE-2020-2893](https://insights.sbomify.com/CVE-2020-2893/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2020-28929](https://insights.sbomify.com/CVE-2020-28929/): Missing authorization in epson:eps tse server 8 firmware (critical 9.8)
- [CVE-2020-28928](https://insights.sbomify.com/CVE-2020-28928/): Memory corruption in debian:debian linux (medium 5.5)
- [CVE-2020-28927](https://insights.sbomify.com/CVE-2020-28927/): Cross-site scripting in magicpin:magicpin (medium 6.1)
- [CVE-2020-28926](https://insights.sbomify.com/CVE-2020-28926/): Memory corruption in debian:debian linux (critical 9.8)
- [CVE-2020-28925](https://insights.sbomify.com/CVE-2020-28925/): OS Command injection in Bolt (medium 5.3)
- [CVE-2020-28924](https://insights.sbomify.com/CVE-2020-28924/): Use of Cryptographically Weak Pseudo-Random Number Generator in Rclone (high 7.5)
- [CVE-2020-28923](https://insights.sbomify.com/CVE-2020-28923/): Data Amplification in Play Framework (low 2.7)
- [CVE-2020-28922](https://insights.sbomify.com/CVE-2020-28922/): Privilege escalation in pcanalyser:pc analyser (high 8.8)
- [CVE-2020-28921](https://insights.sbomify.com/CVE-2020-28921/): Privilege escalation in pcanalyser:pc analyser (high 8.8)
- [CVE-2020-2892](https://insights.sbomify.com/CVE-2020-2892/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2020-28919](https://insights.sbomify.com/CVE-2020-28919/): Cross-site scripting in checkmk:checkmk (medium 5.4)
- [CVE-2020-28918](https://insights.sbomify.com/CVE-2020-28918/): Information disclosure in deepnetsecurity:dualshield (medium 5.3)
- [CVE-2020-28917](https://insights.sbomify.com/CVE-2020-28917/): Information disclosure in view frontend statistics project:view frontend statistics (medium 6.5)
- [CVE-2020-28916](https://insights.sbomify.com/CVE-2020-28916/): Denial of service in debian:debian linux (medium 5.5)
- [CVE-2020-28915](https://insights.sbomify.com/CVE-2020-28915/): Memory corruption in linux:linux kernel (medium 5.8)
- [CVE-2020-28914](https://insights.sbomify.com/CVE-2020-28914/): Misconfiguration in katacontainers:kata-containers (high 7.1)
- [CVE-2020-28912](https://insights.sbomify.com/CVE-2020-28912/): Misconfiguration in mariadb:mariadb (high 7.0)
- [CVE-2020-28911](https://insights.sbomify.com/CVE-2020-28911/): Missing authorization in nagios:fusion (medium 6.5)
- [CVE-2020-28910](https://insights.sbomify.com/CVE-2020-28910/): Privilege escalation in nagios:nagios xi (critical 9.8)
- [CVE-2020-2891](https://insights.sbomify.com/CVE-2020-2891/): Other in Financial Services Liquidity Risk Management (high 7.1)
- [CVE-2020-28909](https://insights.sbomify.com/CVE-2020-28909/): Privilege escalation in nagios:fusion (high 8.8)
- [CVE-2020-28908](https://insights.sbomify.com/CVE-2020-28908/): Command injection in nagios:fusion (critical 9.8)
- [CVE-2020-28907](https://insights.sbomify.com/CVE-2020-28907/): Security feature bypass in nagios:fusion (critical 9.8)
- [CVE-2020-28906](https://insights.sbomify.com/CVE-2020-28906/): Misconfiguration in nagios:fusion (high 8.8)
- [CVE-2020-28905](https://insights.sbomify.com/CVE-2020-28905/): Code injection in nagios:fusion (high 8.8)
- [CVE-2020-28904](https://insights.sbomify.com/CVE-2020-28904/): Privilege escalation in nagios:fusion (critical 9.8)
- [CVE-2020-28903](https://insights.sbomify.com/CVE-2020-28903/): Cross-site scripting in nagios:fusion (medium 6.1)
- [CVE-2020-28902](https://insights.sbomify.com/CVE-2020-28902/): Command injection in nagios:fusion (critical 9.8)
- [CVE-2020-28901](https://insights.sbomify.com/CVE-2020-28901/): Command injection in nagios:fusion (critical 9.8)
- [CVE-2020-28900](https://insights.sbomify.com/CVE-2020-28900/): Security feature bypass in nagios:fusion (critical 9.8)
- [CVE-2020-2890](https://insights.sbomify.com/CVE-2020-2890/): Other in Applications Framework (high 8.2)
- [CVE-2020-28899](https://insights.sbomify.com/CVE-2020-28899/): Missing authorization in zyxel:lte4506-m606 firmware (critical 9.1)
- [CVE-2020-28898](https://insights.sbomify.com/CVE-2020-28898/): Denial of service in resourcexpress:resourcexpress (medium 5.3)
- [CVE-2020-28896](https://insights.sbomify.com/CVE-2020-28896/): Security feature bypass in debian:debian linux (medium 5.3)
- [CVE-2020-28895](https://insights.sbomify.com/CVE-2020-28895/): integer overflow in calloc (high 7.3)
- [CVE-2020-2889](https://insights.sbomify.com/CVE-2020-2889/): Information disclosure in CRM Technical Foundation (medium 5.3)
- [CVE-2020-28885](https://insights.sbomify.com/CVE-2020-28885/): Command injection in liferay:liferay portal (high 7.2)
- [CVE-2020-28884](https://insights.sbomify.com/CVE-2020-28884/): Command injection in liferay:liferay portal (high 7.2)
- [CVE-2020-2888](https://insights.sbomify.com/CVE-2020-2888/): Information disclosure in Marketing (medium 5.3)
- [CVE-2020-28877](https://insights.sbomify.com/CVE-2020-28877/): Memory corruption in tp-link:wdr7400 firmware (critical 9.8)
- [CVE-2020-28874](https://insights.sbomify.com/CVE-2020-28874/): Auth bypass in projectsend:projectsend (high 7.5)
- [CVE-2020-28873](https://insights.sbomify.com/CVE-2020-28873/): Denial of service in fluxbb:fluxbb (high 7.5)
- [CVE-2020-28872](https://insights.sbomify.com/CVE-2020-28872/): Auth bypass in monitorr:monitorr (critical 9.8)
- [CVE-2020-28871](https://insights.sbomify.com/CVE-2020-28871/): File upload in monitorr:monitorr (critical 9.8)
- [CVE-2020-28870](https://insights.sbomify.com/CVE-2020-28870/): Code injection in inoideas:inoerp (critical 9.8)
- [CVE-2020-2887](https://insights.sbomify.com/CVE-2020-2887/): Other in Customer Interaction History (medium 5.3)
- [CVE-2020-28865](https://insights.sbomify.com/CVE-2020-28865/): Insufficiently Protected Credentials in PowerJob (high 7.5)
- [CVE-2020-28864](https://insights.sbomify.com/CVE-2020-28864/): Memory corruption in winscp:winscp (critical 9.8)
- [CVE-2020-28861](https://insights.sbomify.com/CVE-2020-28861/): Missing authorization in openasset:digital asset management (medium 5.3)
- [CVE-2020-28860](https://insights.sbomify.com/CVE-2020-28860/): SQL injection in openasset:digital asset management (high 8.8)
- [CVE-2020-2886](https://insights.sbomify.com/CVE-2020-2886/): Other in CRM Technical Foundation (medium 4.7)
- [CVE-2020-28859](https://insights.sbomify.com/CVE-2020-28859/): Cross-site scripting in openasset:digital asset management (medium 6.1)
- [CVE-2020-28858](https://insights.sbomify.com/CVE-2020-28858/): Cross-site request forgery in openasset:digital asset management (high 8.8)
- [CVE-2020-28857](https://insights.sbomify.com/CVE-2020-28857/): Cross-site scripting in openasset:digital asset management (medium 6.1)
- [CVE-2020-28856](https://insights.sbomify.com/CVE-2020-28856/): Security feature bypass in openasset:digital asset management (high 7.5)
- [CVE-2020-28852](https://insights.sbomify.com/CVE-2020-28852/): Denial of service in golang:text (high 7.5)
- [CVE-2020-28851](https://insights.sbomify.com/CVE-2020-28851/): Denial of service in golang:go (high 7.5)
- [CVE-2020-2885](https://insights.sbomify.com/CVE-2020-2885/): Other in Document Management and Collaboration (high 8.2)
- [CVE-2020-28849](https://insights.sbomify.com/CVE-2020-28849/): Cross-site scripting in churchcrm:churchcrm (medium 5.4)
- [CVE-2020-28848](https://insights.sbomify.com/CVE-2020-28848/): Code injection in churchcrm:churchcrm (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/93/