Vulnerabilities published in 2020
21,460 vulnerabilities were published in 2020: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 39 of 215.
- CVE-2020-7566 Weak cryptography in Modicon M221, all references, all versions
- CVE-2020-7565 Weak cryptography in Modicon M221, all references, all versions
- CVE-2020-7564 Memory corruption in Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details)
- CVE-2020-7563 Memory corruption in Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details)
- CVE-2020-7562 Memory corruption in Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details)
- CVE-2020-7561 Auth bypass in Easergy T300 with firmware 2.7 and older
- CVE-2020-7560 Memory corruption in EcoStruxure™ Control Expert (all versions) and Unity Pro (former name of EcoStruxure™ Control Expert) (all versions)
- CVE-2020-7559 Memory corruption in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions)
- CVE-2020-7558 Memory corruption in IGSS Definition (Def.exe) version 14.0.0.20247 and prior
- CVE-2020-7557 Memory corruption in IGSS Definition (Def.exe) version 14.0.0.20247 and prior
- CVE-2020-7556 Memory corruption in IGSS Definition (Def.exe) version 14.0.0.20247 and prior
- CVE-2020-7555 Memory corruption in IGSS Definition (Def.exe) version 14.0.0.20247 and prior
- CVE-2020-7554 Memory corruption in IGSS Definition (Def.exe) version 14.0.0.20247 and prior
- CVE-2020-7553 Memory corruption in IGSS Definition (Def.exe) version 14.0.0.20247 and prior
- CVE-2020-7552 Memory corruption in IGSS Definition (Def.exe) version 14.0.0.20247
- CVE-2020-7551 Memory corruption in IGSS Definition (Def.exe) version 14.0.0.20247
- CVE-2020-7550 Memory corruption in IGSS Definition (Def.exe) version 14.0.0.20247 and prior
- CVE-2020-7549 Denial of service in Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules (see security notification for affected versions)
- CVE-2020-7548 Weak cryptography in Smartlink, PowerTag, and Wiser Series Gateways (see security notification for version information)
- CVE-2020-7547 Privilege escalation in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for version information)
- CVE-2020-7546 Cross-site scripting in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for version information)
- CVE-2020-7545 Missing authorization in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for version information)
- CVE-2020-7544 Privilege escalation in EcoStruxureª Operator Terminal Expert runtime (Vijeo XD)
- CVE-2020-7543 Denial of service in Modicon M580, Modicon M340, Legacy Controllers Modicon Quantum & Modicon Premium (see security notifications for affected versions)
- CVE-2020-7542 Denial of service in Modicon M580, Modicon M340, Legacy Controllers Modicon Quantum & Modicon Premium (see security notifications for affected versions)
- CVE-2020-7541 Information disclosure in Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules (see security notification for affected versions)
- CVE-2020-7540 Auth bypass in Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules (see security notification for affected versions)
- CVE-2020-7539 Denial of service in Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules (see security notification for affected versions)
- CVE-2020-7538 Denial of service in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions)
- CVE-2020-7537 Denial of service in Modicon M580, Modicon M340, Legacy Controllers Modicon Quantum & Modicon Premium (see security notifications for affected versions)
- CVE-2020-7536 Denial of service in Modicon M340 CPUs (BMXP34* versions prior to V3.30) and Modicon M340 Communication Ethernet modules (BMXNOE0100 (H) versions prior to V3.4, BMXNOE0110 (H) versions prior to V6.6, and BMXNOR0200H all versions)
- CVE-2020-7535 Path traversal in Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules (see security notification for affected versions)
- CVE-2020-7534 Cross-site request forgery in Modicon M340 CPUs: BMXP34 (All Versions), Modicon Quantum CPUs with integrated Ethernet (Copro): 140CPU65 (All Versions), Modicon Premium CPUs with integrated Ethernet (Copro): TSXP57 (All Versions), Modicon M340 ethernet modules: (BMXNOC0401, BMXNOE01, BMXNOR0200H) (All Versions), Modicon Quantum and Premium factory cast communication modules: (140NOE77111, 140NOC78*00, TSXETY5103, TSXETY4103)
- CVE-2020-7533 Auth bypass in Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see security notification for version information)
- CVE-2020-7532 Deserialization in SCADAPack x70 Security Administrator V1.2.0 and prior.
- CVE-2020-7531 Privilege escalation in SCADAPack 7x Remote Connect V3.6.3.574 and prior.
- CVE-2020-7530 Missing authorization in SCADAPack 7x Remote Connect V3.6.3.574 and prior.
- CVE-2020-7529 Path traversal in SCADAPack 7x Remote Connect V3.6.3.574 and prior.
- CVE-2020-7528 Deserialization in SCADAPack 7x Remote Connect V3.6.3.574 and prior.
- CVE-2020-7527 Misconfiguration in SoMove V2.8.1 and prior
- CVE-2020-7526 Code injection in PowerChute Business Edition software V9.0.x and earlier
- CVE-2020-7525 Auth bypass in All hardware versions of spaceLYnk and Wiser for KNX (formerly homeLYnk)
- CVE-2020-7524 Memory corruption in Modicon M218 Logic Controller V5.0.0.7 and prior
- CVE-2020-7523 Privilege escalation in Schneider Electric Modbus Serial Driver (64 bits) versions prior to V3.20 IE 30, Schneider Electric Modbus Serial Driver (32 bits) versions prior to V2.20 IE 30, and Schneider Electric Modbus Driver Suite versions prior to V14.15.0.0
- CVE-2020-7522 Path traversal in SFAPV9601 - APC Easy UPS On-Line Software V2.0 and earlier
- CVE-2020-7521 Path traversal in SFAPV9601 - APC Easy UPS On-Line Software V2.0 and earlier
- CVE-2020-7520 Open redirect in Schneider Electric Software Update (SESU) V2.4.0 and prior.
- CVE-2020-7519 Weak cryptography in Easergy Builder (Version 1.4.7.2 and older)
- CVE-2020-7518 Other in Easergy Builder (Version 1.4.7.2 and older)
- CVE-2020-7517 Information disclosure in Easergy Builder (Version 1.4.7.2 and older)
- CVE-2020-7516 Information disclosure in Easergy Builder V1.4.7.2 and prior
- CVE-2020-7515 Hardcoded credentials in Easergy Builder V1.4.7.2 and prior
- CVE-2020-7514 Weak cryptography in Easergy Builder (Version 1.4.7.2 and older)
- CVE-2020-7513 Information disclosure in Easergy T300 (Firmware version 1.5.2 and older)
- CVE-2020-7512 Supply chain in Easergy T300 (Firmware version 1.5.2 and older)
- CVE-2020-7511 Weak cryptography in Easergy T300 (Firmware version 1.5.2 and older)
- CVE-2020-7510 Information disclosure in Easergy T300 (Firmware version 1.5.2 and older)
- CVE-2020-7509 Privilege escalation in Easergy T300 (Firmware version 1.5.2 and older)
- CVE-2020-7508 Auth bypass in Easergy T300 (Firmware version 1.5.2 and older)
- CVE-2020-7507 Denial of service in Easergy T300 (Firmware version 1.5.2 and older)
- CVE-2020-7506 Information disclosure in Easergy T300 Firmware V1.5.2 and prior
- CVE-2020-7505 Supply chain in Easergy T300 (Firmware version 1.5.2 and older)
- CVE-2020-7504 Denial of service in Easergy T300 (Firmware version 1.5.2 and older)
- CVE-2020-7503 Cross-site request forgery in Easergy T300 (Firmware version 1.5.2 and older)
- CVE-2020-7502 Memory corruption in Modicon M218 Logic Controller (Firmware version 4.3 and prior)
- CVE-2020-7501 Hardcoded credentials in Vijeo Designer Basic (V1.1 HotFix 16 and prior) and Vijeo Designer (V6.2 SP9 and prior)
- CVE-2020-7500 SQL injection in U.motion Servers and Touch Panels (affected versions listed in the security notification)
- CVE-2020-7499 Missing authorization in U.motion Servers and Touch Panels (affected versions listed in the security notification)
- CVE-2020-7498 Hardcoded credentials in Unity Loader and OS Loader Software (All versions)
- CVE-2020-7497 Path traversal in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior (formerly known as Vijeo XD)
- CVE-2020-7496 Command injection in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior (formerly known as Vijeo XD)
- CVE-2020-7495 Path traversal in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior (formerly known as Vijeo XD)
- CVE-2020-7494 Path traversal in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior (formerly known as Vijeo XD)
- CVE-2020-7493 SQL injection in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior (formerly known as Vijeo XD)
- CVE-2020-7492 Information disclosure in GP-Pro EX V1.00 to V4.09.100
- CVE-2020-7491 Misconfiguration in Tricon system versions 10.2.0 through 10.5.3
- CVE-2020-7490 Other in Vijeo Designer Basic (V1.1 HotFix 15 and prior) and Vijeo Designer (V6.9 SP9 and prior)
- CVE-2020-7489 Code injection in SoMachine Basic (all versions)EcoStruxure Machine Expert – Basic (all versions)Modicon M100 Logic Controller (all versions)Modicon M200 Logic Controller (all versions)Modicon M221 Logic Controller (all versions)
- CVE-2020-7488 Information disclosure in EcoStruxure Machine Expert (all versions)SoMachine, SoMachine Motion (all versions)Modicon M218 Logic Controller (all versions)Modicon M241 Logic Controller (all versions)Modicon M251 Logic Controller (all versions)Modicon M258 Logic Controller (all versions)
- CVE-2020-7487 Security feature bypass in EcoStruxure Machine Expert (all versions)SoMachine, SoMachine Motion (all versions)Modicon M218 Logic Controller (all versions)Modicon M241 Logic Controller (all versions)Modicon M251 Logic Controller (all versions)Modicon M258 Logic Controller (all versions)
- CVE-2020-7486 Denial of service in Tricon TCM Model 4351, 4352, 4351A/B, 4352A/B (v10.3.x, v10.4.x)
- CVE-2020-7485 Hardcoded credentials in TriStation TS1131 (v4.0.0 to v4.9.0, v4.10.0)
- CVE-2020-7484 Denial of service in TriStation TS1131 (v4.0.0 to v4.9.0, v4.10.0)
- CVE-2020-7483 Information disclosure in TriStation TS1131 (v4.0.0 to v4.9.0, v4.10.0)
- CVE-2020-7482 Cross-site scripting in Andover Continuum (All versions)
- CVE-2020-7481 Cross-site scripting in Andover Continuum (All versions)
- CVE-2020-7480 Code injection in Andover Continuum (All versions)
- CVE-2020-7479 Missing authorization in IGSS (Interactive Graphical SCADA System) (IGSS Version prior to 14.0.0.20009)
- CVE-2020-7478 Path traversal in IGSS (Interactive Graphical SCADA System) (IGSS Version prior to 14.0.0.20009)
- CVE-2020-7477 Denial of service in Modicon Quantum Ethernet Network module and Quantum / Premium COPRO (Quantum Ethernet Network module 140NOE771x1, versions 7.0 and prior, Quantum processors with integrated Ethernet – 140CPU65xxxxx, all versions, Premium processors with integrated Ethernet, all versions)
- CVE-2020-7476 Other in ZigBee Installation Toolkit (Versions prior to 1.0.1)
- CVE-2020-7475 Code injection in EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all versions prior to V3.20), Modicon M580 (all versions prior to V3.10)
- CVE-2020-7474 Other in ProSoft Configurator v1.002 and prior, for the PMEPXM0100 (H) module
- CVE-2020-7473 Path traversal in citrix:sharefile storagezones controller
- CVE-2020-7472 Code injection in sugarcrm:sugarcrm
- CVE-2020-7471 SQL injection in Django
- CVE-2020-7470 Cross-site scripting in sonoff:th10 firmware
- CVE-2020-7469 Use after free in FreeBSD
- CVE-2020-7468 Privilege escalation in FreeBSD
- CVE-2020-7467 Privilege escalation in FreeBSD