# Vulnerabilities published in 2020


- [CVE-2020-28272](https://insights.sbomify.com/CVE-2020-28272/): keyget vulnerable to prototype pollution (critical 9.8)
- [CVE-2020-28271](https://insights.sbomify.com/CVE-2020-28271/): Prototype Pollution in deephas (critical 9.8)
- [CVE-2020-28270](https://insights.sbomify.com/CVE-2020-28270/): Prototype pollution in object-hierarchy-access (critical 9.8)
- [CVE-2020-2827](https://insights.sbomify.com/CVE-2020-2827/): Other in One-to-One Fulfillment (high 8.2)
- [CVE-2020-28269](https://insights.sbomify.com/CVE-2020-28269/): Prototype Pollution in field (critical 9.8)
- [CVE-2020-28268](https://insights.sbomify.com/CVE-2020-28268/): Prototype pollution in controlled-merge (high 7.5)
- [CVE-2020-28267](https://insights.sbomify.com/CVE-2020-28267/): Prototype pollution in @strikeentco/set (high 7.5)
- [CVE-2020-2826](https://insights.sbomify.com/CVE-2020-2826/): Other in One-to-One Fulfillment (high 8.2)
- [CVE-2020-28251](https://insights.sbomify.com/CVE-2020-28251/): Privilege escalation in netscout:airmagnet enterprise (high 8.1)
- [CVE-2020-28250](https://insights.sbomify.com/CVE-2020-28250/): Auth bypass in cellinx:nvt web server (critical 9.8)
- [CVE-2020-2825](https://insights.sbomify.com/CVE-2020-2825/): Other in One-to-One Fulfillment (high 8.2)
- [CVE-2020-28249](https://insights.sbomify.com/CVE-2020-28249/): Cross-site scripting in Joplin (medium 6.1)
- [CVE-2020-28248](https://insights.sbomify.com/CVE-2020-28248/): Integer Overflow in png-img (high 8.8)
- [CVE-2020-28247](https://insights.sbomify.com/CVE-2020-28247/): Argument injection in lettre (medium 5.3)
- [CVE-2020-28246](https://insights.sbomify.com/CVE-2020-28246/): Server-Side Template Injection in formio (critical 9.8)
- [CVE-2020-28243](https://insights.sbomify.com/CVE-2020-28243/): SaltStack Salt command injection via a crafted process name (high 7.8)
- [CVE-2020-28242](https://insights.sbomify.com/CVE-2020-28242/): Denial of service in asterisk:certified asterisk (medium 6.5)
- [CVE-2020-28241](https://insights.sbomify.com/CVE-2020-28241/): Memory corruption in debian:debian linux (medium 6.5)
- [CVE-2020-2824](https://insights.sbomify.com/CVE-2020-2824/): Other in One-to-One Fulfillment (high 8.2)
- [CVE-2020-2823](https://insights.sbomify.com/CVE-2020-2823/): Other in Common Applications Calendar (high 8.2)
- [CVE-2020-28221](https://insights.sbomify.com/CVE-2020-28221/): Other in EcoStruxure™ Operator Terminal Expert 3.1 Service Pack 1A and prior running on Harmony HMIs HMIST6 Series, HMIG3U in HMIGTU Series, HMISTO Series and Pro-face BLUE 3.1 Service Pack 1A and prior running on Pro-face HMIs: ST6000 Series, SP-5B41 in SP5000 Series, GP4100 Series (critical 9.8)
- [CVE-2020-28220](https://insights.sbomify.com/CVE-2020-28220/): Memory corruption in Modicon M258 Firmware (All versions prior to V5.0.4.11) and SoMachine/SoMachine Motion software (All versions) (medium 4.7)
- [CVE-2020-2822](https://insights.sbomify.com/CVE-2020-2822/): Other in Trade Management (high 8.2)
- [CVE-2020-28219](https://insights.sbomify.com/CVE-2020-28219/): Information disclosure in EcoStruxure Geo SCADA Expert 2019 (Original release and Monthly Updates to September 2020, from 81.7268.1 to 81.7578.1) and EcoStruxure Geo SCADA Expert 2020 (Original release and Monthly Updates to September 2020, from 83.7551.1 to 83.7578.1) (high 7.8)
- [CVE-2020-28218](https://insights.sbomify.com/CVE-2020-28218/): Other in Easergy T300 (firmware 2.7 and older) (medium 6.5)
- [CVE-2020-28217](https://insights.sbomify.com/CVE-2020-28217/): Information disclosure in Easergy T300 (firmware 2.7 and older) (high 7.5)
- [CVE-2020-28216](https://insights.sbomify.com/CVE-2020-28216/): Information disclosure in Easergy T300 (firmware 2.7 and older) (high 7.5)
- [CVE-2020-28215](https://insights.sbomify.com/CVE-2020-28215/): Missing authorization in Easergy T300 (firmware 2.7 and older) (critical 9.8)
- [CVE-2020-28214](https://insights.sbomify.com/CVE-2020-28214/): Weak cryptography in Modicon M221 (all references, all versions) (critical 9.8)
- [CVE-2020-28213](https://insights.sbomify.com/CVE-2020-28213/): Supply chain in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) (high 8.8)
- [CVE-2020-28212](https://insights.sbomify.com/CVE-2020-28212/): Auth bypass in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) (critical 9.8)
- [CVE-2020-28211](https://insights.sbomify.com/CVE-2020-28211/): Auth bypass in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) (high 7.8)
- [CVE-2020-28210](https://insights.sbomify.com/CVE-2020-28210/): Cross-site scripting in EcoStruxure Building Operation WebStation V2.0 - V3.1 (medium 6.1)
- [CVE-2020-2821](https://insights.sbomify.com/CVE-2020-2821/): Other in Trade Management (high 8.2)
- [CVE-2020-28209](https://insights.sbomify.com/CVE-2020-28209/): Privilege escalation in EcoStruxure Building Operation Enterprise Server installer V1.9 - V3.1 and Enterprise Central installer V2.0 - V3.1 (high 7.0)
- [CVE-2020-28208](https://insights.sbomify.com/CVE-2020-28208/): Information disclosure in rocket.chat:rocket.chat (medium 5.3)
- [CVE-2020-28206](https://insights.sbomify.com/CVE-2020-28206/): Auth bypass in bitrix24:bitrix framework (medium 6.5)
- [CVE-2020-28203](https://insights.sbomify.com/CVE-2020-28203/): Null dereference in foxitsoftware:foxit reader (medium 5.5)
- [CVE-2020-28200](https://insights.sbomify.com/CVE-2020-28200/): Denial of service in dovecot:dovecot (medium 4.3)
- [CVE-2020-2820](https://insights.sbomify.com/CVE-2020-2820/): Other in Common Applications Calendar (high 8.2)
- [CVE-2020-28199](https://insights.sbomify.com/CVE-2020-28199/): Information disclosure in bestit:amazon pay (critical 9.1)
- [CVE-2020-28198](https://insights.sbomify.com/CVE-2020-28198/): Memory corruption in ibm:tivoli storage manager (high 7.0)
- [CVE-2020-28196](https://insights.sbomify.com/CVE-2020-28196/): Denial of service in fedoraproject:fedora (high 7.5)
- [CVE-2020-28194](https://insights.sbomify.com/CVE-2020-28194/): Integer overflow in accel-ppp:accel-ppp (critical 9.8)
- [CVE-2020-28191](https://insights.sbomify.com/CVE-2020-28191/): Togglz console missing cross-site request forgery (CSRF) protection (high 8.8)
- [CVE-2020-28190](https://insights.sbomify.com/CVE-2020-28190/): Weak cryptography in terra-master:tos (medium 5.9)
- [CVE-2020-2819](https://insights.sbomify.com/CVE-2020-2819/): Other in Universal Work Queue (high 8.2)
- [CVE-2020-28188](https://insights.sbomify.com/CVE-2020-28188/): Command injection in terra-master:tos (critical 9.8)
- [CVE-2020-28187](https://insights.sbomify.com/CVE-2020-28187/): Path traversal in terra-master:tos (critical 9.8)
- [CVE-2020-28186](https://insights.sbomify.com/CVE-2020-28186/): Auth bypass in terra-master:tos (high 7.3)
- [CVE-2020-28185](https://insights.sbomify.com/CVE-2020-28185/): Information disclosure in terra-master:tos (medium 5.3)
- [CVE-2020-28184](https://insights.sbomify.com/CVE-2020-28184/): Cross-site scripting in terra-master:tos (medium 5.4)
- [CVE-2020-28183](https://insights.sbomify.com/CVE-2020-28183/): SQL injection in water billing system project:water billing system (critical 9.8)
- [CVE-2020-2818](https://insights.sbomify.com/CVE-2020-2818/): Other in Universal Work Queue (high 8.2)
- [CVE-2020-28175](https://insights.sbomify.com/CVE-2020-28175/): Privilege escalation in almico:speedfan (high 7.8)
- [CVE-2020-28173](https://insights.sbomify.com/CVE-2020-28173/): File upload in simple college project:simple college (high 7.2)
- [CVE-2020-28172](https://insights.sbomify.com/CVE-2020-28172/): SQL injection in simple college project:simple college (critical 9.8)
- [CVE-2020-2817](https://insights.sbomify.com/CVE-2020-2817/): Other in Scripting (high 8.2)
- [CVE-2020-28169](https://insights.sbomify.com/CVE-2020-28169/): Privilege escalation in debian:debian linux (high 7.0)
- [CVE-2020-28168](https://insights.sbomify.com/CVE-2020-28168/): Axios vulnerable to Server-Side Request Forgery (medium 5.9)
- [CVE-2020-28165](https://insights.sbomify.com/CVE-2020-28165/): File upload in easycorp:zentao (critical 9.8)
- [CVE-2020-28163](https://insights.sbomify.com/CVE-2020-28163/): Null dereference in libdwarf project:libdwarf (medium 6.5)
- [CVE-2020-2816](https://insights.sbomify.com/CVE-2020-2816/): Other in Java (high 7.5)
- [CVE-2020-28150](https://insights.sbomify.com/CVE-2020-28150/): Open redirect in inetsoftware:i-net clear reports (medium 6.1)
- [CVE-2020-2815](https://insights.sbomify.com/CVE-2020-2815/): Other in iSupport (high 8.2)
- [CVE-2020-28149](https://insights.sbomify.com/CVE-2020-28149/): Cross-site scripting in mydbr:mydbr (critical 9.6)
- [CVE-2020-28146](https://insights.sbomify.com/CVE-2020-28146/): Cross-site scripting in eyoucms:eyoucms (medium 6.1)
- [CVE-2020-28145](https://insights.sbomify.com/CVE-2020-28145/): Path traversal in wuzhicms:wuzhicms (high 7.5)
- [CVE-2020-28144](https://insights.sbomify.com/CVE-2020-28144/): Memory corruption in moxa:edr-810-2gsfp-t firmware (critical 9.8)
- [CVE-2020-28141](https://insights.sbomify.com/CVE-2020-28141/): Cross-site scripting in online discussion forum project:online discussion forum (medium 5.4)
- [CVE-2020-28140](https://insights.sbomify.com/CVE-2020-28140/): File upload in online clothing store project:online clothing store (critical 9.8)
- [CVE-2020-2814](https://insights.sbomify.com/CVE-2020-2814/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2020-28139](https://insights.sbomify.com/CVE-2020-28139/): Cross-site scripting in online clothing store project:online clothing store (medium 6.1)
- [CVE-2020-28138](https://insights.sbomify.com/CVE-2020-28138/): SQL injection in online clothing store project:online clothing store (critical 9.8)
- [CVE-2020-28137](https://insights.sbomify.com/CVE-2020-28137/): Cross-site request forgery in genexis:platinum 4410 firmware (medium 6.5)
- [CVE-2020-28136](https://insights.sbomify.com/CVE-2020-28136/): File upload in phpgurukul:tourism management system (high 8.8)
- [CVE-2020-28133](https://insights.sbomify.com/CVE-2020-28133/): SQL injection in simple grocery store sales and inventory sales project:simple grocery store sales and inventory system (critical 9.8)
- [CVE-2020-28130](https://insights.sbomify.com/CVE-2020-28130/): File upload in online library management system project:online library management system (critical 9.8)
- [CVE-2020-2813](https://insights.sbomify.com/CVE-2020-2813/): Other in Email Center (high 8.2)
- [CVE-2020-28129](https://insights.sbomify.com/CVE-2020-28129/): Cross-site scripting in admerc:gym management system (medium 6.1)
- [CVE-2020-28124](https://insights.sbomify.com/CVE-2020-28124/): Cross Site Scripting (XSS) in LavaLite 5.8.0 (medium 5.4)
- [CVE-2020-2812](https://insights.sbomify.com/CVE-2020-2812/): Denial of service in MySQL Server (medium 4.9)
- [CVE-2020-28119](https://insights.sbomify.com/CVE-2020-28119/): Cross-site scripting in 53kf:53kf (medium 6.1)
- [CVE-2020-28115](https://insights.sbomify.com/CVE-2020-28115/): SQL injection in web-audimex:audimexee (high 8.8)
- [CVE-2020-2811](https://insights.sbomify.com/CVE-2020-2811/): Cross-site scripting in WebLogic Server (medium 6.1)
- [CVE-2020-28103](https://insights.sbomify.com/CVE-2020-28103/): SQL injection in chshcms:cscms (critical 9.8)
- [CVE-2020-28102](https://insights.sbomify.com/CVE-2020-28102/): SQL injection in chshcms:cscms (critical 9.8)
- [CVE-2020-2810](https://insights.sbomify.com/CVE-2020-2810/): Other in iStore (medium 4.7)
- [CVE-2020-28097](https://insights.sbomify.com/CVE-2020-28097/): Memory corruption in linux:linux kernel (medium 5.9)
- [CVE-2020-28096](https://insights.sbomify.com/CVE-2020-28096/): Hardcoded credentials in foscammall:foscam x1 firmware (medium 6.8)
- [CVE-2020-28095](https://insights.sbomify.com/CVE-2020-28095/): Denial of service in tenda:ac6 firmware (high 7.5)
- [CVE-2020-28094](https://insights.sbomify.com/CVE-2020-28094/): Supply chain in tendacn:ac1200 firmware (high 7.5)
- [CVE-2020-28093](https://insights.sbomify.com/CVE-2020-28093/): Hardcoded credentials in tendacn:ac1200 firmware (high 7.2)
- [CVE-2020-28092](https://insights.sbomify.com/CVE-2020-28092/): Cross-site scripting in pescms:pescms team (medium 6.1)
- [CVE-2020-28091](https://insights.sbomify.com/CVE-2020-28091/): SQL injection in cxuu:cxuucms (high 7.5)
- [CVE-2020-2809](https://insights.sbomify.com/CVE-2020-2809/): Other in E-Business Intelligence (high 8.2)
- [CVE-2020-28088](https://insights.sbomify.com/CVE-2020-28088/): Jeecg-Boot CMS arbitrary file upload vulnerability (critical 9.8)
- [CVE-2020-28087](https://insights.sbomify.com/CVE-2020-28087/): SQL injection in jeecg:jeecg boot (high 7.5)
- [CVE-2020-28086](https://insights.sbomify.com/CVE-2020-28086/): Security feature bypass in zx2c4:password-store (high 7.5)
- [CVE-2020-2808](https://insights.sbomify.com/CVE-2020-2808/): Other in E-Business Intelligence (high 8.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/97/