CVE-2020-20136

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

QuantConnect Lean versions from 2.3.0.0 to 2.4.0.1 are affected by an insecure deserialization vulnerability due to insecure configuration of TypeNameHandling property in Json.NET library.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published: Dec 14, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-201386.1Cross Site Scripting (XSS) vulnerability in the Showtime2 Slideshow module in CMS Made Simple (CMSMS) 2.2.4.CVE-2020-201396.1Cross Site Scripting (XSS) vulnerability in the Remote JSON component Under the Connect menu in Flexmonster Pivot Table & Charts 2.7.17.CVE-2020-20148.8An OS Command Injection vulnerability in PAN-OS management server allows authenticated users to inject and execute arbitrary shell commands CVE-2020-201406.1Cross Site Scripting (XSS) vulnerability in Remote Report component under the Open menu in Flexmonster Pivot Table & Charts 2.7.17.CVE-2020-201416.1Cross Site Scripting (XSS) vulnerability in the To OLAP (XMLA) component Under the Connect menu in Flexmonster Pivot Table & Charts 2.7.17.CVE-2020-201426.1Cross Site Scripting (XSS) vulnerability in the "To Remote CSV" component under "Open" Menu in Flexmonster Pivot Table & Charts 2.7.17.CVE-2020-20158.8A buffer overflow vulnerability in the PAN-OS management server allows authenticated users to crash system processes or potentially execute CVE-2020-20167.0A race condition due to insecure creation of a file in a temporary directory vulnerability in PAN-OS allows for root privilege escalation fr CVE-2020-20176.1A DOM-Based Cross Site Scripting Vulnerability exists in PAN-OS and Panorama Management Web Interfaces. A remote attacker able to convince a CVE-2020-201787.5Ethereum 0xe933c0cd9784414d5f278c114904f5a84b396919#code.sol latest version is affected by a denial of service vulnerability in the affected CVE-2020-20189.0An authentication bypass vulnerability in the Panorama context switching feature allows an attacker with network access to a Panorama's mana CVE-2020-201837.5Insecure direct object reference vulnerability in Zyxel’s P1302-T10 v3 with firmware version 2.00(ABBX.3) and earlier allows attackers to ga