https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2020-13462.htmlhttps://patchthecve.com/cve/CVE-2020-13462.htmlWed, 17 Jun 2026 02:53:10 +0000MEDIUM 5.7: Insecure Direct Object Reference (IDOR) exists in Tufin SecureChange, affecting all versions prior to R20-2 GA. Fixed in version R20-2 GA.https://patchthecve.com/cve/CVE-2020-13461.htmlhttps://patchthecve.com/cve/CVE-2020-13461.htmlWed, 17 Jun 2026 02:53:10 +0000MEDIUM 4.3: Username enumeration in present in Tufin SecureTrack. It's affecting all versions of SecureTrack. The vendor has decided not to fix this vulnerability. Vendor's response: "This attack requires access to the internal network. If an attacker is part of the internal network, they do not require access https://patchthecve.com/cve/CVE-2020-13460.htmlhttps://patchthecve.com/cve/CVE-2020-13460.htmlWed, 17 Jun 2026 02:53:10 +0000HIGH 8.8: Multiple Cross-Site Request Forgery (CSRF) vulnerabilities were present in Tufin SecureTrack, affecting all versions prior to R20-2 GA.https://patchthecve.com/cve/CVE-2020-13409.htmlhttps://patchthecve.com/cve/CVE-2020-13409.htmlWed, 17 Jun 2026 02:53:05 +0000MEDIUM 5.9: Tufin SecureTrack < R20-2 GA contains reflected + stored XSS (as in, the value is reflected back to the user, but is also stored within the DB and can be later triggered again by the same victim, or also later by different users). Both stored, and reflected payloads are triggerable by admin, so malihttps://patchthecve.com/cve/CVE-2020-13408.htmlhttps://patchthecve.com/cve/CVE-2020-13408.htmlWed, 17 Jun 2026 02:53:05 +0000MEDIUM 5.9: Tufin SecureTrack < R20-2 GA contains reflected + stored XSS (as in, the value is reflected back to the user, but is also stored within the DB and can be later triggered again by the same victim, or also later by different users). Both stored, and reflected payloads are triggerable by admin, so malihttps://patchthecve.com/cve/CVE-2020-13407.htmlhttps://patchthecve.com/cve/CVE-2020-13407.htmlWed, 17 Jun 2026 02:53:05 +0000MEDIUM 5.9: Tufin SecureTrack < R20-2 GA contains reflected + stored XSS (as in, the value is reflected back to the user, but is also stored within the DB and can be later triggered again by the same victim, or also later by different users). Both stored, and reflected payloads are triggerable by admin, so mali