CVE-2020-13134

Tufin SecureChange prior to R19.3 HF3 and R20-1 HF1 are vulnerable to stored XSS. The successful exploitation requires admin privileges (for storing the XSS payload itself), and can exploit (be triggered by) admin users. All TOS versions with SecureChange deployments prior to R19.3 HF3 and R20-1 HF1 are affected. Vulnerabilities were fixed in R19.3 HF3 and R20-1 HF1.

• CWE-79

• https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.mdThird Party Advisory
• https://portal.tufin.com/aspx/SecurityAdvisoriesPermissions Required
• https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.mdThird Party Advisory
• https://portal.tufin.com/aspx/SecurityAdvisoriesPermissions Required

Published

Jan 20, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-13128An issue was discovered in Manolo GWTUpload 1.0.3. server/Up…7.5
• CVE-2020-13129An issue was discovered in the stashcat app through 3.9.1 fo…7.2
• CVE-2020-1313An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-13131An issue was discovered in Yubico libykpiv before 2.1.0. lib…4.3
• CVE-2020-13132An issue was discovered in Yubico libykpiv before 2.1.0. An …4.6
• CVE-2020-13133Tufin SecureChange prior to R19.3 HF3 and R20-1 HF1 are vuln…6.1
• CVE-2020-13135D-Link DSP-W215 1.26b03 devices allow information disclosure…6.5
• CVE-2020-13136D-Link DSP-W215 1.26b03 devices send an obfuscated hash that…7.5
• CVE-2020-1314An elevation of privilege vulnerability exists in Windows Te…7.8
• CVE-2020-13143gadget_dev_desc_UDC_store in drivers/usb/gadget/configfs.c i…6.5
• CVE-2020-13144Studio in Open edX Ironwood 2.5, when CodeJail is not used, …8.8
• CVE-2020-13145Studio in Open edX Ironwood 2.5 allows users to upload SVG f…5.4