# Vulnerabilities published in 2020


- [CVE-2020-28074](https://insights.sbomify.com/CVE-2020-28074/): SQL injection in online health care system project:online health care system (critical 9.8)
- [CVE-2020-28073](https://insights.sbomify.com/CVE-2020-28073/): SQL injection in library management system project:library management system (critical 9.8)
- [CVE-2020-28072](https://insights.sbomify.com/CVE-2020-28072/): File upload in alumni management system project:alumni management system (high 7.2)
- [CVE-2020-28071](https://insights.sbomify.com/CVE-2020-28071/): Cross-site scripting in alumni management system project:alumni management system (medium 4.8)
- [CVE-2020-28070](https://insights.sbomify.com/CVE-2020-28070/): SQL injection in alumni management system project:alumni management system (critical 9.8)
- [CVE-2020-2807](https://insights.sbomify.com/CVE-2020-2807/): Other in Marketing Encyclopedia System (high 8.2)
- [CVE-2020-28063](https://insights.sbomify.com/CVE-2020-28063/): File upload in articlecms project:articlecms (critical 9.8)
- [CVE-2020-28062](https://insights.sbomify.com/CVE-2020-28062/): File upload in hisiphp:hisiphp (high 7.2)
- [CVE-2020-2806](https://insights.sbomify.com/CVE-2020-2806/): Denial of service in MySQL Server (medium 5.3)
- [CVE-2020-28055](https://insights.sbomify.com/CVE-2020-28055/): Misconfiguration in tcl:32s330 firmware (high 7.8)
- [CVE-2020-28054](https://insights.sbomify.com/CVE-2020-28054/): Auth bypass in tsmmanager:tsmmanager (high 7.5)
- [CVE-2020-28053](https://insights.sbomify.com/CVE-2020-28053/): Privilege Escalation in HashiCorp Consul (medium 6.5)
- [CVE-2020-28052](https://insights.sbomify.com/CVE-2020-28052/): Logic error in Legion of the Bouncy Castle BC Java (high 8.1)
- [CVE-2020-28050](https://insights.sbomify.com/CVE-2020-28050/): Hardcoded credentials in zohocorp:manageengine desktop central (critical 9.1)
- [CVE-2020-2805](https://insights.sbomify.com/CVE-2020-2805/): Other in Java (high 8.3)
- [CVE-2020-28049](https://insights.sbomify.com/CVE-2020-28049/): Race condition in debian:debian linux (medium 6.3)
- [CVE-2020-28047](https://insights.sbomify.com/CVE-2020-28047/): Cross-site scripting in web-audimex:audimexee (medium 5.4)
- [CVE-2020-28046](https://insights.sbomify.com/CVE-2020-28046/): Privilege escalation in pax:prolinos (high 7.8)
- [CVE-2020-28045](https://insights.sbomify.com/CVE-2020-28045/): Security feature bypass in pax:prolinos (high 7.8)
- [CVE-2020-28044](https://insights.sbomify.com/CVE-2020-28044/): Misconfiguration in pax:prolinos (medium 6.8)
- [CVE-2020-28043](https://insights.sbomify.com/CVE-2020-28043/): Server-side request forgery in misp-project:misp (high 7.5)
- [CVE-2020-28042](https://insights.sbomify.com/CVE-2020-28042/): Signature validation bypass in ServiceStack (medium 5.3)
- [CVE-2020-28041](https://insights.sbomify.com/CVE-2020-28041/): Security feature bypass in netgear:nighthawk r7000 firmware (medium 6.5)
- [CVE-2020-28040](https://insights.sbomify.com/CVE-2020-28040/): Cross-site request forgery in canonical:ubuntu linux (medium 4.3)
- [CVE-2020-2804](https://insights.sbomify.com/CVE-2020-2804/): Denial of service in MySQL Server (medium 5.9)
- [CVE-2020-28039](https://insights.sbomify.com/CVE-2020-28039/): Path traversal in canonical:ubuntu linux (critical 9.1)
- [CVE-2020-28038](https://insights.sbomify.com/CVE-2020-28038/): Cross-site scripting in debian:debian linux (medium 6.1)
- [CVE-2020-28037](https://insights.sbomify.com/CVE-2020-28037/): Other in debian:debian linux (critical 9.8)
- [CVE-2020-28036](https://insights.sbomify.com/CVE-2020-28036/): Missing authorization in debian:debian linux (critical 9.8)
- [CVE-2020-28035](https://insights.sbomify.com/CVE-2020-28035/): Privilege escalation in debian:debian linux (critical 9.8)
- [CVE-2020-28034](https://insights.sbomify.com/CVE-2020-28034/): Cross-site scripting in debian:debian linux (medium 6.1)
- [CVE-2020-28033](https://insights.sbomify.com/CVE-2020-28033/): Security feature bypass in debian:debian linux (high 7.5)
- [CVE-2020-28032](https://insights.sbomify.com/CVE-2020-28032/): Deserialization in debian:debian linux (critical 9.8)
- [CVE-2020-28031](https://insights.sbomify.com/CVE-2020-28031/): Other in eramba:eramba (medium 4.3)
- [CVE-2020-28030](https://insights.sbomify.com/CVE-2020-28030/): Denial of service in debian:debian linux (high 7.5)
- [CVE-2020-2803](https://insights.sbomify.com/CVE-2020-2803/): Other in Java (high 8.3)
- [CVE-2020-28026](https://insights.sbomify.com/CVE-2020-28026/): Command injection in exim:exim (critical 9.8)
- [CVE-2020-28025](https://insights.sbomify.com/CVE-2020-28025/): Memory corruption in exim:exim (high 7.5)
- [CVE-2020-28024](https://insights.sbomify.com/CVE-2020-28024/): Memory corruption in exim:exim (critical 9.8)
- [CVE-2020-28023](https://insights.sbomify.com/CVE-2020-28023/): Information disclosure in exim:exim (high 7.5)
- [CVE-2020-28022](https://insights.sbomify.com/CVE-2020-28022/): Memory corruption in exim:exim (critical 9.8)
- [CVE-2020-28021](https://insights.sbomify.com/CVE-2020-28021/): Code injection in exim:exim (high 8.8)
- [CVE-2020-28020](https://insights.sbomify.com/CVE-2020-28020/): Integer overflow in exim:exim (critical 9.8)
- [CVE-2020-2802](https://insights.sbomify.com/CVE-2020-2802/): Denial of service in GraalVM Enterprise Edition (high 7.7)
- [CVE-2020-28019](https://insights.sbomify.com/CVE-2020-28019/): Denial of service in exim:exim (high 7.5)
- [CVE-2020-28018](https://insights.sbomify.com/CVE-2020-28018/): Use after free in exim:exim (critical 9.8)
- [CVE-2020-28017](https://insights.sbomify.com/CVE-2020-28017/): Integer overflow in exim:exim (critical 9.8)
- [CVE-2020-28016](https://insights.sbomify.com/CVE-2020-28016/): Memory corruption in exim:exim (high 7.8)
- [CVE-2020-28015](https://insights.sbomify.com/CVE-2020-28015/): Other in exim:exim (high 7.8)
- [CVE-2020-28014](https://insights.sbomify.com/CVE-2020-28014/): Privilege escalation in exim:exim (medium 6.1)
- [CVE-2020-28013](https://insights.sbomify.com/CVE-2020-28013/): Memory corruption in exim:exim (high 7.8)
- [CVE-2020-28012](https://insights.sbomify.com/CVE-2020-28012/): Information disclosure in exim:exim (high 7.8)
- [CVE-2020-28011](https://insights.sbomify.com/CVE-2020-28011/): Memory corruption in exim:exim (high 7.8)
- [CVE-2020-28010](https://insights.sbomify.com/CVE-2020-28010/): Memory corruption in exim:exim (high 7.8)
- [CVE-2020-2801](https://insights.sbomify.com/CVE-2020-2801/): Other in WebLogic Server (critical 9.8)
- [CVE-2020-28009](https://insights.sbomify.com/CVE-2020-28009/): Integer overflow in exim:exim (high 7.8)
- [CVE-2020-28008](https://insights.sbomify.com/CVE-2020-28008/): Privilege escalation in exim:exim (high 7.8)
- [CVE-2020-28007](https://insights.sbomify.com/CVE-2020-28007/): Privilege escalation in exim:exim (high 7.8)
- [CVE-2020-28005](https://insights.sbomify.com/CVE-2020-28005/): Memory corruption in tp-link:tl-wpa4220 firmware (medium 6.5)
- [CVE-2020-28002](https://insights.sbomify.com/CVE-2020-28002/): Auth bypass in sonarsource:sonarqube (medium 5.3)
- [CVE-2020-28001](https://insights.sbomify.com/CVE-2020-28001/): Cross-site scripting in solarwinds:serv-u (medium 5.4)
- [CVE-2020-2800](https://insights.sbomify.com/CVE-2020-2800/): Other in Java (medium 4.8)
- [CVE-2020-27998](https://insights.sbomify.com/CVE-2020-27998/): Missing Authorization in FastReport (critical 9.8)
- [CVE-2020-27997](https://insights.sbomify.com/CVE-2020-27997/): Cross-site request forgery in smartstore:smartstorenet (high 8.8)
- [CVE-2020-27996](https://insights.sbomify.com/CVE-2020-27996/): Other in smartstore:smartstorenet (high 8.8)
- [CVE-2020-27995](https://insights.sbomify.com/CVE-2020-27995/): SQL injection in zohocorp:manageengine applications manager (critical 9.8)
- [CVE-2020-27994](https://insights.sbomify.com/CVE-2020-27994/): Path traversal in solarwinds:serv-u (medium 6.5)
- [CVE-2020-27993](https://insights.sbomify.com/CVE-2020-27993/): Path traversal in hrsale:hrsale (medium 5.3)
- [CVE-2020-27992](https://insights.sbomify.com/CVE-2020-27992/): Privilege escalation in wondershare:dr.fone (high 7.8)
- [CVE-2020-27991](https://insights.sbomify.com/CVE-2020-27991/): Cross-site scripting in nagios:nagios xi (medium 5.4)
- [CVE-2020-27990](https://insights.sbomify.com/CVE-2020-27990/): Cross-site scripting in nagios:nagios xi (medium 5.4)
- [CVE-2020-2799](https://insights.sbomify.com/CVE-2020-2799/): Other in GraalVM Enterprise Edition (medium 6.3)
- [CVE-2020-27989](https://insights.sbomify.com/CVE-2020-27989/): Cross-site scripting in nagios:nagios xi (medium 5.4)
- [CVE-2020-27988](https://insights.sbomify.com/CVE-2020-27988/): Cross-site scripting in nagios:nagios xi (medium 5.4)
- [CVE-2020-27986](https://insights.sbomify.com/CVE-2020-27986/): Information disclosure in sonarsource:sonarqube (high 7.5)
- [CVE-2020-27985](https://insights.sbomify.com/CVE-2020-27985/): Misconfiguration in securityonionsolutions:security onion (high 7.8)
- [CVE-2020-27982](https://insights.sbomify.com/CVE-2020-27982/): Cross-site scripting in icewarp:mail server (medium 6.1)
- [CVE-2020-27980](https://insights.sbomify.com/CVE-2020-27980/): Cross-site scripting in genexis:platinum-4410 firmware (medium 5.4)
- [CVE-2020-2798](https://insights.sbomify.com/CVE-2020-2798/): Other in WebLogic Server (high 7.2)
- [CVE-2020-27978](https://insights.sbomify.com/CVE-2020-27978/): Denial of service in shibboleth:identity provider (high 7.5)
- [CVE-2020-27977](https://insights.sbomify.com/CVE-2020-27977/): Privilege escalation in capasystems:capainstaller (high 7.8)
- [CVE-2020-27976](https://insights.sbomify.com/CVE-2020-27976/): Command injection in oscommerce:oscommerce (critical 9.8)
- [CVE-2020-27975](https://insights.sbomify.com/CVE-2020-27975/): Cross-site request forgery in oscommerce:oscommerce (high 8.8)
- [CVE-2020-27974](https://insights.sbomify.com/CVE-2020-27974/): Cross-site scripting in quadient:mail accounting (medium 6.1)
- [CVE-2020-27970](https://insights.sbomify.com/CVE-2020-27970/): Security feature bypass in Yandex Browser Lite for Android (medium 5.3)
- [CVE-2020-2797](https://insights.sbomify.com/CVE-2020-2797/): Cross-site scripting in PeopleSoft Enterprise PT PeopleTools (medium 6.1)
- [CVE-2020-27969](https://insights.sbomify.com/CVE-2020-27969/): Security feature bypass in Yandex Browser for Android (high 7.3)
- [CVE-2020-2796](https://insights.sbomify.com/CVE-2020-2796/): Other in Email Center (high 8.2)
- [CVE-2020-27958](https://insights.sbomify.com/CVE-2020-27958/): Other in osu:ohio supercomputer center open ondemand (medium 4.3)
- [CVE-2020-27957](https://insights.sbomify.com/CVE-2020-27957/): Cross-site scripting in mediawiki:mediawiki (medium 5.4)
- [CVE-2020-27956](https://insights.sbomify.com/CVE-2020-27956/): File upload in car rental management system project:car rental management system (critical 9.8)
- [CVE-2020-27955](https://insights.sbomify.com/CVE-2020-27955/): Git LFS can execute a Git binary from the current directory (critical 9.8)
- [CVE-2020-27952](https://insights.sbomify.com/CVE-2020-27952/): Memory corruption in macOS (high 7.8)
- [CVE-2020-27951](https://insights.sbomify.com/CVE-2020-27951/): Security feature bypass in iOS (high 7.8)
- [CVE-2020-27950](https://insights.sbomify.com/CVE-2020-27950/): Apple Multiple Products Memory Initialization (medium 5.5, exploited in the wild)
- [CVE-2020-2795](https://insights.sbomify.com/CVE-2020-2795/): Other in Knowledge (medium 6.3)
- [CVE-2020-27949](https://insights.sbomify.com/CVE-2020-27949/): Memory corruption in macOS (medium 5.5)
- [CVE-2020-27948](https://insights.sbomify.com/CVE-2020-27948/): Memory corruption in iOS and iPadOS (high 7.8)
- [CVE-2020-27947](https://insights.sbomify.com/CVE-2020-27947/): Memory corruption in macOS (high 7.8)
- [CVE-2020-27946](https://insights.sbomify.com/CVE-2020-27946/): Information disclosure in iOS and iPadOS (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/98/