# Vulnerabilities published in 2020


- [CVE-2020-7566](https://insights.sbomify.com/CVE-2020-7566/): Weak cryptography in Modicon M221, all references, all versions (high 7.1)
- [CVE-2020-7565](https://insights.sbomify.com/CVE-2020-7565/): Weak cryptography in Modicon M221, all references, all versions (high 7.1)
- [CVE-2020-7564](https://insights.sbomify.com/CVE-2020-7564/): Memory corruption in Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) (medium 6.3)
- [CVE-2020-7563](https://insights.sbomify.com/CVE-2020-7563/): Memory corruption in Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) (medium 6.3)
- [CVE-2020-7562](https://insights.sbomify.com/CVE-2020-7562/): Memory corruption in Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) (medium 6.3)
- [CVE-2020-7561](https://insights.sbomify.com/CVE-2020-7561/): Auth bypass in Easergy T300 with firmware 2.7 and older (critical 9.8)
- [CVE-2020-7560](https://insights.sbomify.com/CVE-2020-7560/): Memory corruption in EcoStruxure™ Control Expert (all versions) and Unity Pro (former name of EcoStruxure™ Control Expert) (all versions) (high 8.6)
- [CVE-2020-7559](https://insights.sbomify.com/CVE-2020-7559/): Memory corruption in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) (high 7.5)
- [CVE-2020-7558](https://insights.sbomify.com/CVE-2020-7558/): Memory corruption in IGSS Definition (Def.exe) version 14.0.0.20247 and prior (high 7.8)
- [CVE-2020-7557](https://insights.sbomify.com/CVE-2020-7557/): Memory corruption in IGSS Definition (Def.exe) version 14.0.0.20247 and prior (high 7.8)
- [CVE-2020-7556](https://insights.sbomify.com/CVE-2020-7556/): Memory corruption in IGSS Definition (Def.exe) version 14.0.0.20247 and prior (high 7.8)
- [CVE-2020-7555](https://insights.sbomify.com/CVE-2020-7555/): Memory corruption in IGSS Definition (Def.exe) version 14.0.0.20247 and prior (high 7.8)
- [CVE-2020-7554](https://insights.sbomify.com/CVE-2020-7554/): Memory corruption in IGSS Definition (Def.exe) version 14.0.0.20247 and prior (high 7.8)
- [CVE-2020-7553](https://insights.sbomify.com/CVE-2020-7553/): Memory corruption in IGSS Definition (Def.exe) version 14.0.0.20247 and prior (high 7.8)
- [CVE-2020-7552](https://insights.sbomify.com/CVE-2020-7552/): Memory corruption in IGSS Definition (Def.exe) version 14.0.0.20247 (high 7.8)
- [CVE-2020-7551](https://insights.sbomify.com/CVE-2020-7551/): Memory corruption in IGSS Definition (Def.exe) version 14.0.0.20247 (high 7.8)
- [CVE-2020-7550](https://insights.sbomify.com/CVE-2020-7550/): Memory corruption in IGSS Definition (Def.exe) version 14.0.0.20247 and prior (high 7.8)
- [CVE-2020-7549](https://insights.sbomify.com/CVE-2020-7549/): Denial of service in Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules (see security notification for affected versions) (high 7.5)
- [CVE-2020-7548](https://insights.sbomify.com/CVE-2020-7548/): Weak cryptography in Smartlink, PowerTag, and Wiser Series Gateways (see security notification for version information) (critical 9.8)
- [CVE-2020-7547](https://insights.sbomify.com/CVE-2020-7547/): Privilege escalation in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for version information) (high 8.8)
- [CVE-2020-7546](https://insights.sbomify.com/CVE-2020-7546/): Cross-site scripting in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for version information) (medium 5.4)
- [CVE-2020-7545](https://insights.sbomify.com/CVE-2020-7545/): Missing authorization in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for version information) (high 7.2)
- [CVE-2020-7544](https://insights.sbomify.com/CVE-2020-7544/): Privilege escalation in EcoStruxureª Operator Terminal Expert runtime (Vijeo XD) (high 7.8)
- [CVE-2020-7543](https://insights.sbomify.com/CVE-2020-7543/): Denial of service in Modicon M580, Modicon M340, Legacy Controllers Modicon Quantum & Modicon Premium (see security notifications for affected versions) (high 7.5)
- [CVE-2020-7542](https://insights.sbomify.com/CVE-2020-7542/): Denial of service in Modicon M580, Modicon M340, Legacy Controllers Modicon Quantum & Modicon Premium (see security notifications for affected versions) (high 7.5)
- [CVE-2020-7541](https://insights.sbomify.com/CVE-2020-7541/): Information disclosure in Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules (see security notification for affected versions) (medium 5.3)
- [CVE-2020-7540](https://insights.sbomify.com/CVE-2020-7540/): Auth bypass in Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules (see security notification for affected versions) (critical 9.8)
- [CVE-2020-7539](https://insights.sbomify.com/CVE-2020-7539/): Denial of service in Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules (see security notification for affected versions) (high 7.5)
- [CVE-2020-7538](https://insights.sbomify.com/CVE-2020-7538/): Denial of service in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) (high 7.5)
- [CVE-2020-7537](https://insights.sbomify.com/CVE-2020-7537/): Denial of service in Modicon M580, Modicon M340, Legacy Controllers Modicon Quantum & Modicon Premium (see security notifications for affected versions) (high 7.5)
- [CVE-2020-7536](https://insights.sbomify.com/CVE-2020-7536/): Denial of service in Modicon M340 CPUs (BMXP34* versions prior to V3.30) and Modicon M340 Communication Ethernet modules (BMXNOE0100 (H) versions prior to V3.4, BMXNOE0110 (H) versions prior to V6.6, and BMXNOR0200H all versions) (high 7.5)
- [CVE-2020-7535](https://insights.sbomify.com/CVE-2020-7535/): Path traversal in Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules (see security notification for affected versions) (high 7.5)
- [CVE-2020-7534](https://insights.sbomify.com/CVE-2020-7534/): Cross-site request forgery in Modicon M340 CPUs: BMXP34 (All Versions), Modicon Quantum CPUs with integrated Ethernet (Copro): 140CPU65 (All Versions), Modicon Premium CPUs with integrated Ethernet (Copro): TSXP57 (All Versions), Modicon M340 ethernet modules: (BMXNOC0401, BMXNOE01, BMXNOR0200H) (All Versions), Modicon Quantum and Premium factory cast communication modules: (140NOE77111, 140NOC78*00, TSXETY5103, TSXETY4103) (high 7.1)
- [CVE-2020-7533](https://insights.sbomify.com/CVE-2020-7533/): Auth bypass in Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see security notification for version information) (critical 9.8)
- [CVE-2020-7532](https://insights.sbomify.com/CVE-2020-7532/): Deserialization in SCADAPack x70 Security Administrator V1.2.0 and prior. (high 7.8)
- [CVE-2020-7531](https://insights.sbomify.com/CVE-2020-7531/): Privilege escalation in SCADAPack 7x Remote Connect V3.6.3.574 and prior. (high 7.8)
- [CVE-2020-7530](https://insights.sbomify.com/CVE-2020-7530/): Missing authorization in SCADAPack 7x Remote Connect V3.6.3.574 and prior. (high 8.8)
- [CVE-2020-7529](https://insights.sbomify.com/CVE-2020-7529/): Path traversal in SCADAPack 7x Remote Connect V3.6.3.574 and prior. (medium 5.5)
- [CVE-2020-7528](https://insights.sbomify.com/CVE-2020-7528/): Deserialization in SCADAPack 7x Remote Connect V3.6.3.574 and prior. (high 7.8)
- [CVE-2020-7527](https://insights.sbomify.com/CVE-2020-7527/): Misconfiguration in SoMove V2.8.1 and prior (high 7.8)
- [CVE-2020-7526](https://insights.sbomify.com/CVE-2020-7526/): Code injection in PowerChute Business Edition software V9.0.x and earlier (high 8.8)
- [CVE-2020-7525](https://insights.sbomify.com/CVE-2020-7525/): Auth bypass in All hardware versions of spaceLYnk and Wiser for KNX (formerly homeLYnk) (high 7.5)
- [CVE-2020-7524](https://insights.sbomify.com/CVE-2020-7524/): Memory corruption in Modicon M218 Logic Controller V5.0.0.7 and prior (high 7.5)
- [CVE-2020-7523](https://insights.sbomify.com/CVE-2020-7523/): Privilege escalation in Schneider Electric Modbus Serial Driver (64 bits) versions prior to V3.20 IE 30, Schneider Electric Modbus Serial Driver (32 bits) versions prior to V2.20 IE 30, and Schneider Electric Modbus Driver Suite versions prior to V14.15.0.0 (high 7.8)
- [CVE-2020-7522](https://insights.sbomify.com/CVE-2020-7522/): Path traversal in SFAPV9601 - APC Easy UPS On-Line Software V2.0 and earlier (critical 9.8)
- [CVE-2020-7521](https://insights.sbomify.com/CVE-2020-7521/): Path traversal in SFAPV9601 - APC Easy UPS On-Line Software V2.0 and earlier (critical 9.8)
- [CVE-2020-7520](https://insights.sbomify.com/CVE-2020-7520/): Open redirect in Schneider Electric Software Update (SESU) V2.4.0 and prior. (medium 4.7)
- [CVE-2020-7519](https://insights.sbomify.com/CVE-2020-7519/): Weak cryptography in Easergy Builder (Version 1.4.7.2 and older) (high 7.5)
- [CVE-2020-7518](https://insights.sbomify.com/CVE-2020-7518/): Other in Easergy Builder (Version 1.4.7.2 and older) (high 7.5)
- [CVE-2020-7517](https://insights.sbomify.com/CVE-2020-7517/): Information disclosure in Easergy Builder (Version 1.4.7.2 and older) (medium 5.5)
- [CVE-2020-7516](https://insights.sbomify.com/CVE-2020-7516/): Information disclosure in Easergy Builder V1.4.7.2 and prior (high 7.8)
- [CVE-2020-7515](https://insights.sbomify.com/CVE-2020-7515/): Hardcoded credentials in Easergy Builder V1.4.7.2 and prior (high 7.8)
- [CVE-2020-7514](https://insights.sbomify.com/CVE-2020-7514/): Weak cryptography in Easergy Builder (Version 1.4.7.2 and older) (high 7.8)
- [CVE-2020-7513](https://insights.sbomify.com/CVE-2020-7513/): Information disclosure in Easergy T300 (Firmware version 1.5.2 and older) (high 7.5)
- [CVE-2020-7512](https://insights.sbomify.com/CVE-2020-7512/): Supply chain in Easergy T300 (Firmware version 1.5.2 and older) (critical 9.8)
- [CVE-2020-7511](https://insights.sbomify.com/CVE-2020-7511/): Weak cryptography in Easergy T300 (Firmware version 1.5.2 and older) (high 7.5)
- [CVE-2020-7510](https://insights.sbomify.com/CVE-2020-7510/): Information disclosure in Easergy T300 (Firmware version 1.5.2 and older) (high 7.5)
- [CVE-2020-7509](https://insights.sbomify.com/CVE-2020-7509/): Privilege escalation in Easergy T300 (Firmware version 1.5.2 and older) (high 7.2)
- [CVE-2020-7508](https://insights.sbomify.com/CVE-2020-7508/): Auth bypass in Easergy T300 (Firmware version 1.5.2 and older) (critical 9.8)
- [CVE-2020-7507](https://insights.sbomify.com/CVE-2020-7507/): Denial of service in Easergy T300 (Firmware version 1.5.2 and older) (high 7.5)
- [CVE-2020-7506](https://insights.sbomify.com/CVE-2020-7506/): Information disclosure in Easergy T300 Firmware V1.5.2 and prior (high 7.5)
- [CVE-2020-7505](https://insights.sbomify.com/CVE-2020-7505/): Supply chain in Easergy T300 (Firmware version 1.5.2 and older) (high 7.2)
- [CVE-2020-7504](https://insights.sbomify.com/CVE-2020-7504/): Denial of service in Easergy T300 (Firmware version 1.5.2 and older) (medium 5.3)
- [CVE-2020-7503](https://insights.sbomify.com/CVE-2020-7503/): Cross-site request forgery in Easergy T300 (Firmware version 1.5.2 and older) (high 8.8)
- [CVE-2020-7502](https://insights.sbomify.com/CVE-2020-7502/): Memory corruption in Modicon M218 Logic Controller (Firmware version 4.3 and prior) (high 7.5)
- [CVE-2020-7501](https://insights.sbomify.com/CVE-2020-7501/): Hardcoded credentials in Vijeo Designer Basic (V1.1 HotFix 16 and prior) and Vijeo Designer (V6.2 SP9 and prior) (high 8.8)
- [CVE-2020-7500](https://insights.sbomify.com/CVE-2020-7500/): SQL injection in U.motion Servers and Touch Panels (affected versions listed in the security notification) (critical 9.8)
- [CVE-2020-7499](https://insights.sbomify.com/CVE-2020-7499/): Missing authorization in U.motion Servers and Touch Panels (affected versions listed in the security notification) (medium 6.5)
- [CVE-2020-7498](https://insights.sbomify.com/CVE-2020-7498/): Hardcoded credentials in Unity Loader and OS Loader Software (All versions) (critical 9.8)
- [CVE-2020-7497](https://insights.sbomify.com/CVE-2020-7497/): Path traversal in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior (formerly known as Vijeo XD) (critical 9.8)
- [CVE-2020-7496](https://insights.sbomify.com/CVE-2020-7496/): Command injection in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior (formerly known as Vijeo XD) (high 7.8)
- [CVE-2020-7495](https://insights.sbomify.com/CVE-2020-7495/): Path traversal in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior (formerly known as Vijeo XD) (medium 5.5)
- [CVE-2020-7494](https://insights.sbomify.com/CVE-2020-7494/): Path traversal in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior (formerly known as Vijeo XD) (high 7.8)
- [CVE-2020-7493](https://insights.sbomify.com/CVE-2020-7493/): SQL injection in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior (formerly known as Vijeo XD) (high 7.8)
- [CVE-2020-7492](https://insights.sbomify.com/CVE-2020-7492/): Information disclosure in GP-Pro EX V1.00 to V4.09.100 (medium 6.5)
- [CVE-2020-7491](https://insights.sbomify.com/CVE-2020-7491/): Misconfiguration in Tricon system versions 10.2.0 through 10.5.3 (high 7.5)
- [CVE-2020-7490](https://insights.sbomify.com/CVE-2020-7490/): Other in Vijeo Designer Basic (V1.1 HotFix 15 and prior) and Vijeo Designer (V6.9 SP9 and prior) (high 7.8)
- [CVE-2020-7489](https://insights.sbomify.com/CVE-2020-7489/): Code injection in SoMachine Basic (all versions)EcoStruxure Machine Expert – Basic (all versions)Modicon M100 Logic Controller (all versions)Modicon M200 Logic Controller (all versions)Modicon M221 Logic Controller (all versions) (critical 9.8)
- [CVE-2020-7488](https://insights.sbomify.com/CVE-2020-7488/): Information disclosure in EcoStruxure Machine Expert (all versions)SoMachine, SoMachine Motion (all versions)Modicon M218 Logic Controller (all versions)Modicon M241 Logic Controller (all versions)Modicon M251 Logic Controller (all versions)Modicon M258 Logic Controller (all versions) (high 7.5)
- [CVE-2020-7487](https://insights.sbomify.com/CVE-2020-7487/): Security feature bypass in EcoStruxure Machine Expert (all versions)SoMachine, SoMachine Motion (all versions)Modicon M218 Logic Controller (all versions)Modicon M241 Logic Controller (all versions)Modicon M251 Logic Controller (all versions)Modicon M258 Logic Controller (all versions) (critical 9.8)
- [CVE-2020-7486](https://insights.sbomify.com/CVE-2020-7486/): Denial of service in Tricon TCM Model 4351, 4352, 4351A/B, 4352A/B (v10.3.x, v10.4.x) (high 7.5)
- [CVE-2020-7485](https://insights.sbomify.com/CVE-2020-7485/): Hardcoded credentials in TriStation TS1131 (v4.0.0 to v4.9.0, v4.10.0) (critical 9.8)
- [CVE-2020-7484](https://insights.sbomify.com/CVE-2020-7484/): Denial of service in TriStation TS1131 (v4.0.0 to v4.9.0, v4.10.0) (high 7.5)
- [CVE-2020-7483](https://insights.sbomify.com/CVE-2020-7483/): Information disclosure in TriStation TS1131 (v4.0.0 to v4.9.0, v4.10.0) (high 7.5)
- [CVE-2020-7482](https://insights.sbomify.com/CVE-2020-7482/): Cross-site scripting in Andover Continuum (All versions) (medium 6.1)
- [CVE-2020-7481](https://insights.sbomify.com/CVE-2020-7481/): Cross-site scripting in Andover Continuum (All versions) (medium 6.1)
- [CVE-2020-7480](https://insights.sbomify.com/CVE-2020-7480/): Code injection in Andover Continuum (All versions) (critical 9.8)
- [CVE-2020-7479](https://insights.sbomify.com/CVE-2020-7479/): Missing authorization in IGSS (Interactive Graphical SCADA System) (IGSS Version prior to 14.0.0.20009) (high 7.8)
- [CVE-2020-7478](https://insights.sbomify.com/CVE-2020-7478/): Path traversal in IGSS (Interactive Graphical SCADA System) (IGSS Version prior to 14.0.0.20009) (high 7.5)
- [CVE-2020-7477](https://insights.sbomify.com/CVE-2020-7477/): Denial of service in Modicon Quantum Ethernet Network module and Quantum / Premium COPRO (Quantum Ethernet Network module 140NOE771x1, versions 7.0 and prior, Quantum processors with integrated Ethernet – 140CPU65xxxxx, all versions, Premium processors with integrated Ethernet, all versions) (high 7.5)
- [CVE-2020-7476](https://insights.sbomify.com/CVE-2020-7476/): Other in ZigBee Installation Toolkit (Versions prior to 1.0.1) (high 7.8)
- [CVE-2020-7475](https://insights.sbomify.com/CVE-2020-7475/): Code injection in EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all versions prior to V3.20), Modicon M580 (all versions prior to V3.10) (critical 9.8)
- [CVE-2020-7474](https://insights.sbomify.com/CVE-2020-7474/): Other in ProSoft Configurator v1.002 and prior, for the PMEPXM0100 (H) module (high 7.8)
- [CVE-2020-7473](https://insights.sbomify.com/CVE-2020-7473/): Path traversal in citrix:sharefile storagezones controller (high 7.5)
- [CVE-2020-7472](https://insights.sbomify.com/CVE-2020-7472/): Code injection in sugarcrm:sugarcrm (critical 9.8)
- [CVE-2020-7471](https://insights.sbomify.com/CVE-2020-7471/): SQL injection in Django (critical 9.8)
- [CVE-2020-7470](https://insights.sbomify.com/CVE-2020-7470/): Cross-site scripting in sonoff:th10 firmware (medium 4.8)
- [CVE-2020-7469](https://insights.sbomify.com/CVE-2020-7469/): Use after free in FreeBSD (high 7.5)
- [CVE-2020-7468](https://insights.sbomify.com/CVE-2020-7468/): Privilege escalation in FreeBSD (high 8.8)
- [CVE-2020-7467](https://insights.sbomify.com/CVE-2020-7467/): Privilege escalation in FreeBSD (high 7.6)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/39/