# Vulnerabilities published in 2020 - [CVE-2020-28433](https://insights.sbomify.com/CVE-2020-28433/): Command Injection (high 7.3) - [CVE-2020-2843](https://insights.sbomify.com/CVE-2020-2843/): Other in iSupport (high 8.2) - [CVE-2020-28429](https://insights.sbomify.com/CVE-2020-28429/): Command Injection (high 7.3) - [CVE-2020-28426](https://insights.sbomify.com/CVE-2020-28426/): Command Injection (high 7.3) - [CVE-2020-28425](https://insights.sbomify.com/CVE-2020-28425/): Command Injection (high 7.3) - [CVE-2020-28424](https://insights.sbomify.com/CVE-2020-28424/): Command Injection (high 7.2) - [CVE-2020-28423](https://insights.sbomify.com/CVE-2020-28423/): Command Injection (critical 9.8) - [CVE-2020-28422](https://insights.sbomify.com/CVE-2020-28422/): Command Injection (medium 6.4) - [CVE-2020-28421](https://insights.sbomify.com/CVE-2020-28421/): Privilege escalation in CA Unified Infrastructure Management (high 7.8) - [CVE-2020-2842](https://insights.sbomify.com/CVE-2020-2842/): Other in Depot Repair (high 8.2) - [CVE-2020-28419](https://insights.sbomify.com/CVE-2020-28419/): Other in HP LaserJet Printer; HP LaserJet Pro Printer; HP PageWide Printer; HP PageWide Pro Printer; HP inkjet Printer; HP OfficeJet Printer (high 8.8) - [CVE-2020-28416](https://insights.sbomify.com/CVE-2020-28416/): Other in HP OfficeJet Printer; HP PageWide Printer (high 7.8) - [CVE-2020-28415](https://insights.sbomify.com/CVE-2020-28415/): Cross-site scripting in tranzware payment gateway project:tranzware payment gateway (medium 6.1) - [CVE-2020-28414](https://insights.sbomify.com/CVE-2020-28414/): Cross-site scripting in tranzware payment gateway project:tranzware payment gateway (medium 6.1) - [CVE-2020-28413](https://insights.sbomify.com/CVE-2020-28413/): MantisBT SQL Injection via mc_project_get_users function (medium 5.3) - [CVE-2020-2841](https://insights.sbomify.com/CVE-2020-2841/): Other in Knowledge Management (high 8.2) - [CVE-2020-28409](https://insights.sbomify.com/CVE-2020-28409/): Cross-site scripting in dundas:dundas bi (medium 5.4) - [CVE-2020-28408](https://insights.sbomify.com/CVE-2020-28408/): Cross-site scripting in dundas:dundas bi (medium 5.4) - [CVE-2020-28407](https://insights.sbomify.com/CVE-2020-28407/): Other in swtpm project:swtpm (high 7.1) - [CVE-2020-28406](https://insights.sbomify.com/CVE-2020-28406/): Missing authorization in iris:star practice management (medium 6.5) - [CVE-2020-28405](https://insights.sbomify.com/CVE-2020-28405/): Missing authorization in iris:star practice management (high 8.8) - [CVE-2020-28404](https://insights.sbomify.com/CVE-2020-28404/): Missing authorization in iris:star practice management (medium 6.5) - [CVE-2020-28403](https://insights.sbomify.com/CVE-2020-28403/): Cross-site request forgery in iris:star (high 8.0) - [CVE-2020-28402](https://insights.sbomify.com/CVE-2020-28402/): Missing authorization in iris:star practice management (medium 5.4) - [CVE-2020-28401](https://insights.sbomify.com/CVE-2020-28401/): Missing authorization in iris:star practice management (medium 6.5) - [CVE-2020-28400](https://insights.sbomify.com/CVE-2020-28400/): Denial of service in Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller (high 8.7) - [CVE-2020-2840](https://insights.sbomify.com/CVE-2020-2840/): Other in E-Business Intelligence (high 8.2) - [CVE-2020-28398](https://insights.sbomify.com/CVE-2020-28398/): Cross-site request forgery in RUGGEDCOM ROX MX5000 (high 8.6) - [CVE-2020-28397](https://insights.sbomify.com/CVE-2020-28397/): Missing authorization in SIMATIC Drive Controller family (medium 5.3) - [CVE-2020-28396](https://insights.sbomify.com/CVE-2020-28396/): Weak cryptography in SICAM A8000 CP-8000 (high 7.3) - [CVE-2020-28395](https://insights.sbomify.com/CVE-2020-28395/): Hardcoded credentials in SCALANCE X-200RNA switch family (medium 5.9) - [CVE-2020-28394](https://insights.sbomify.com/CVE-2020-28394/): Memory corruption in JT2Go (medium 5.5) - [CVE-2020-28393](https://insights.sbomify.com/CVE-2020-28393/): Denial of service in SCALANCE XM-400, XR-500 (high 7.5) - [CVE-2020-28392](https://insights.sbomify.com/CVE-2020-28392/): Misconfiguration in SIMARIS configuration (high 7.8) - [CVE-2020-28391](https://insights.sbomify.com/CVE-2020-28391/): Hardcoded credentials in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (medium 5.9) - [CVE-2020-28390](https://insights.sbomify.com/CVE-2020-28390/): Information disclosure in Opcenter Execution Core (medium 5.5) - [CVE-2020-2839](https://insights.sbomify.com/CVE-2020-2839/): Other in Service Intelligence (high 8.2) - [CVE-2020-28388](https://insights.sbomify.com/CVE-2020-28388/): Weak cryptography in APOGEE PXC Compact (BACnet) (medium 6.5) - [CVE-2020-28387](https://insights.sbomify.com/CVE-2020-28387/): XML external entity in Solid Edge SE2020 (medium 5.5) - [CVE-2020-28386](https://insights.sbomify.com/CVE-2020-28386/): Memory corruption in Solid Edge SE2020 (high 7.8) - [CVE-2020-28385](https://insights.sbomify.com/CVE-2020-28385/): Memory corruption in Solid Edge SE2020 (high 7.8) - [CVE-2020-28384](https://insights.sbomify.com/CVE-2020-28384/): Memory corruption in Solid Edge SE2020 (high 7.8) - [CVE-2020-28383](https://insights.sbomify.com/CVE-2020-28383/): Memory corruption in JT2Go (high 7.8) - [CVE-2020-28382](https://insights.sbomify.com/CVE-2020-28382/): Memory corruption in Solid Edge SE2020 (high 7.8) - [CVE-2020-28381](https://insights.sbomify.com/CVE-2020-28381/): Memory corruption in Solid Edge SE2020 (high 7.8) - [CVE-2020-2838](https://insights.sbomify.com/CVE-2020-2838/): Other in CRM Gateway for Mobile Devices (high 8.6) - [CVE-2020-28374](https://insights.sbomify.com/CVE-2020-28374/): Path traversal in debian:debian linux (high 8.1) - [CVE-2020-28373](https://insights.sbomify.com/CVE-2020-28373/): Memory corruption in netgear:r6250 firmware (high 8.8) - [CVE-2020-28371](https://insights.sbomify.com/CVE-2020-28371/): Integer overflow in readytalk:avian (critical 9.8) - [CVE-2020-2837](https://insights.sbomify.com/CVE-2020-2837/): Other in Marketing (high 8.2) - [CVE-2020-28369](https://insights.sbomify.com/CVE-2020-28369/): Privilege escalation in beyondtrust:privilege management for windows (high 7.8) - [CVE-2020-28368](https://insights.sbomify.com/CVE-2020-28368/): Information disclosure in debian:debian linux (medium 4.4) - [CVE-2020-28367](https://insights.sbomify.com/CVE-2020-28367/): Arbitrary code execution via the go command with cgo in cmd/go (high 7.5) - [CVE-2020-28366](https://insights.sbomify.com/CVE-2020-28366/): Arbitrary code execution in go command with cgo in cmd/go and cmd/cgo (high 7.5) - [CVE-2020-28365](https://insights.sbomify.com/CVE-2020-28365/): Cross-site scripting in sapplica:sentrifugo (medium 6.1) - [CVE-2020-28364](https://insights.sbomify.com/CVE-2020-28364/): Locust Stored Cross-site Scripting Vulnerability (medium 6.1) - [CVE-2020-28362](https://insights.sbomify.com/CVE-2020-28362/): Denial of service in fedoraproject:fedora (high 7.5) - [CVE-2020-28361](https://insights.sbomify.com/CVE-2020-28361/): Security feature bypass in kamailio:kamailio (medium 5.4) - [CVE-2020-28360](https://insights.sbomify.com/CVE-2020-28360/): Server-Side Request Forgery in private-ip (critical 9.8) - [CVE-2020-2836](https://insights.sbomify.com/CVE-2020-2836/): Other in Marketing (high 8.2) - [CVE-2020-28351](https://insights.sbomify.com/CVE-2020-28351/): Cross-site scripting in mitel:shoretel firmware (medium 6.1) - [CVE-2020-28350](https://insights.sbomify.com/CVE-2020-28350/): Cross-site scripting in sokrates:sowasql (medium 6.1) - [CVE-2020-2835](https://insights.sbomify.com/CVE-2020-2835/): Other in Marketing (high 8.2) - [CVE-2020-28349](https://insights.sbomify.com/CVE-2020-28349/): Denial of service in chirpstack:network server (medium 6.5) - [CVE-2020-28348](https://insights.sbomify.com/CVE-2020-28348/): Path Traversal in HashiCorp Nomad (medium 6.5) - [CVE-2020-28347](https://insights.sbomify.com/CVE-2020-28347/): Command injection in tp-link:ac1750 firmware (critical 9.8) - [CVE-2020-28346](https://insights.sbomify.com/CVE-2020-28346/): Null dereference in projectacrn:acrn (high 7.5) - [CVE-2020-28345](https://insights.sbomify.com/CVE-2020-28345/): Null dereference in google:android (high 7.5) - [CVE-2020-28344](https://insights.sbomify.com/CVE-2020-28344/): Null dereference in google:android (high 7.5) - [CVE-2020-28343](https://insights.sbomify.com/CVE-2020-28343/): Memory corruption in google:android (high 7.8) - [CVE-2020-28342](https://insights.sbomify.com/CVE-2020-28342/): Auth bypass in google:android (high 7.8) - [CVE-2020-28341](https://insights.sbomify.com/CVE-2020-28341/): Memory corruption in google:android (high 7.8) - [CVE-2020-28340](https://insights.sbomify.com/CVE-2020-28340/): Security feature bypass in google:android (critical 9.8) - [CVE-2020-2834](https://insights.sbomify.com/CVE-2020-2834/): Other in Marketing (high 8.2) - [CVE-2020-28339](https://insights.sbomify.com/CVE-2020-28339/): Deserialization in welcart:welcart e-commerce (high 7.5) - [CVE-2020-28337](https://insights.sbomify.com/CVE-2020-28337/): Zip slip in Microweber (high 7.2) - [CVE-2020-28334](https://insights.sbomify.com/CVE-2020-28334/): Hardcoded credentials in barco:wepresent wipg-1600w firmware (critical 9.8) - [CVE-2020-28333](https://insights.sbomify.com/CVE-2020-28333/): Auth bypass in barco:wepresent wipg-1600w firmware (critical 9.8) - [CVE-2020-28332](https://insights.sbomify.com/CVE-2020-28332/): Security feature bypass in barco:wepresent wipg-1600w firmware (critical 9.8) - [CVE-2020-28331](https://insights.sbomify.com/CVE-2020-28331/): Missing authorization in barco:wepresent wipg-1600w firmware (high 7.5) - [CVE-2020-28330](https://insights.sbomify.com/CVE-2020-28330/): Information disclosure in barco:wepresent wipg-1600w firmware (medium 6.5) - [CVE-2020-2833](https://insights.sbomify.com/CVE-2020-2833/): Other in Quoting (high 8.2) - [CVE-2020-28329](https://insights.sbomify.com/CVE-2020-28329/): Hardcoded credentials in barco:wepresent wipg-1600w firmware (critical 9.8) - [CVE-2020-28328](https://insights.sbomify.com/CVE-2020-28328/): File upload in salesagility:suitecrm (high 8.8) - [CVE-2020-28327](https://insights.sbomify.com/CVE-2020-28327/): Use after free in digium:certified asterisk (medium 5.3) - [CVE-2020-2832](https://insights.sbomify.com/CVE-2020-2832/): Other in One-to-One Fulfillment (high 8.2) - [CVE-2020-2831](https://insights.sbomify.com/CVE-2020-2831/): Other in Marketing (high 8.2) - [CVE-2020-2830](https://insights.sbomify.com/CVE-2020-2830/): Denial of service in Java (medium 5.3) - [CVE-2020-2829](https://insights.sbomify.com/CVE-2020-2829/): Information disclosure in WebLogic Server (medium 4.9) - [CVE-2020-28283](https://insights.sbomify.com/CVE-2020-28283/): Prototype pollution vulnerability in 'libnested' (critical 9.8) - [CVE-2020-28282](https://insights.sbomify.com/CVE-2020-28282/): Prototype pollution in getobject (critical 9.8) - [CVE-2020-28281](https://insights.sbomify.com/CVE-2020-28281/): Prototype pollution in set-object-value (critical 9.8) - [CVE-2020-28280](https://insights.sbomify.com/CVE-2020-28280/): Prototype pollution vulnerability in 'predefine' (critical 9.8) - [CVE-2020-2828](https://insights.sbomify.com/CVE-2020-2828/): Other in WebLogic Server (high 7.5) - [CVE-2020-28279](https://insights.sbomify.com/CVE-2020-28279/): flattenizer vulnerable to prototype pollution (critical 9.8) - [CVE-2020-28278](https://insights.sbomify.com/CVE-2020-28278/): shvl vulnerable to prototype pollution (critical 9.8) - [CVE-2020-28277](https://insights.sbomify.com/CVE-2020-28277/): dset vulnerable to prototype pollution (critical 9.8) - [CVE-2020-28276](https://insights.sbomify.com/CVE-2020-28276/): Prototype pollution vulnerability in 'deep-set' (critical 9.8) - [CVE-2020-28274](https://insights.sbomify.com/CVE-2020-28274/): Prototype pollution vulnerability in 'deepref' (critical 9.8) - [CVE-2020-28273](https://insights.sbomify.com/CVE-2020-28273/): Prototype pollution in set-in (critical 9.8) --- From sbomify Insights: https://insights.sbomify.com/years/2020/page/96/