# CVEs published 2020-12-11

120 CVEs were published on December 11, 2020: 10 critical, 9 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2020-29563](https://cve.now/CVE-2020-29563.md): An issue was discovered on Western Digital My Cloud OS 5 devices before 5.07.118. (no CVSS)
- [CVE-2020-29654](https://cve.now/CVE-2020-29654.md): Western Digital Dashboard before 3.2.2.9 allows DLL Hijacking that leads to compromise of the SYSTEM account. (no CVSS)
- [CVE-2020-35176](https://cve.now/CVE-2020-35176.md): In AWStats through 7.8, cgi-bin/awstats.pl?config= accepts a partial absolute pathname (omitting the initial /etc), even though it was inten (no CVSS)
- [CVE-2020-25112](https://cve.now/CVE-2020-25112.md): An issue was discovered in the IPv6 stack in Contiki through 3.0. (no CVSS)
- [CVE-2020-25111](https://cve.now/CVE-2020-25111.md): An issue was discovered in the IPv6 stack in Contiki through 3.0. (no CVSS)
- [CVE-2020-25110](https://cve.now/CVE-2020-25110.md): An issue was discovered in the DNS implementation in Ethernut in Nut/OS 5.1. (no CVSS)
- [CVE-2020-25109](https://cve.now/CVE-2020-25109.md): An issue was discovered in the DNS implementation in Ethernut in Nut/OS 5.1. (no CVSS)
- [CVE-2020-25108](https://cve.now/CVE-2020-25108.md): An issue was discovered in the DNS implementation in Ethernut in Nut/OS 5.1. (no CVSS)
- [CVE-2020-25107](https://cve.now/CVE-2020-25107.md): An issue was discovered in the DNS implementation in Ethernut in Nut/OS 5.1. (no CVSS)
- [CVE-2020-24383](https://cve.now/CVE-2020-24383.md): An issue was discovered in FNET through 4.6.4. (no CVSS)
- [CVE-2020-24341](https://cve.now/CVE-2020-24341.md): An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. (no CVSS)
- [CVE-2020-24340](https://cve.now/CVE-2020-24340.md): An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. (no CVSS)
- [CVE-2020-24339](https://cve.now/CVE-2020-24339.md): An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. (no CVSS)
- [CVE-2020-24338](https://cve.now/CVE-2020-24338.md): An issue was discovered in picoTCP through 1.7.0. (no CVSS)
- [CVE-2020-24337](https://cve.now/CVE-2020-24337.md): An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. (no CVSS)
- [CVE-2020-24336](https://cve.now/CVE-2020-24336.md): An issue was discovered in Contiki through 3.0 and Contiki-NG through 4.5. (no CVSS)
- [CVE-2020-24334](https://cve.now/CVE-2020-24334.md): The code that processes DNS responses in uIP through 1.0, as used in Contiki and Contiki-NG, does not check whether the number of responses (no CVSS)
- [CVE-2020-17470](https://cve.now/CVE-2020-17470.md): An issue was discovered in FNET through 4.6.4. (no CVSS)
- [CVE-2020-17469](https://cve.now/CVE-2020-17469.md): An issue was discovered in FNET through 4.6.4. (no CVSS)
- [CVE-2020-17468](https://cve.now/CVE-2020-17468.md): An issue was discovered in FNET through 4.6.4. (no CVSS)
- [CVE-2020-17467](https://cve.now/CVE-2020-17467.md): An issue was discovered in FNET through 4.6.4. (no CVSS)
- [CVE-2020-17445](https://cve.now/CVE-2020-17445.md): An issue was discovered in picoTCP 1.7.0. (no CVSS)
- [CVE-2020-17444](https://cve.now/CVE-2020-17444.md): An issue was discovered in picoTCP 1.7.0. (no CVSS)
- [CVE-2020-17443](https://cve.now/CVE-2020-17443.md): An issue was discovered in picoTCP 1.7.0. (no CVSS)
- [CVE-2020-17442](https://cve.now/CVE-2020-17442.md): An issue was discovered in picoTCP 1.7.0. (no CVSS)
- [CVE-2020-17441](https://cve.now/CVE-2020-17441.md): An issue was discovered in picoTCP 1.7.0. (no CVSS)
- [CVE-2020-17440](https://cve.now/CVE-2020-17440.md): An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. (no CVSS)
- [CVE-2020-17439](https://cve.now/CVE-2020-17439.md): An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. (no CVSS)
- [CVE-2020-17438](https://cve.now/CVE-2020-17438.md): An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. (no CVSS)
- [CVE-2020-17437](https://cve.now/CVE-2020-17437.md): An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. (no CVSS)
- [CVE-2020-35175](https://cve.now/CVE-2020-35175.md): Frappe Framework 12 and 13 does not properly validate the HTTP method for the frappe.client API. (no CVSS)
- [CVE-2020-13988](https://cve.now/CVE-2020-13988.md): An issue was discovered in Contiki through 3.0. (no CVSS)
- [CVE-2020-13987](https://cve.now/CVE-2020-13987.md): An issue was discovered in Contiki through 3.0. (no CVSS)
- [CVE-2020-13986](https://cve.now/CVE-2020-13986.md): An issue was discovered in Contiki through 3.0. (no CVSS)
- [CVE-2020-13985](https://cve.now/CVE-2020-13985.md): An issue was discovered in Contiki through 3.0. (no CVSS)
- [CVE-2020-13984](https://cve.now/CVE-2020-13984.md): An issue was discovered in Contiki through 3.0. (no CVSS)
- [CVE-2020-15375](https://cve.now/CVE-2020-15375.md): Brocade Fabric OS versions before v9.0.0, v8.2.2c, v8.2.1e, v8.1.2k, v8.2.0\_CBN3, v7.4.2g contain an improper input validation weakness in t (no CVSS, Brocade Fabric OS)
- [CVE-2020-15376](https://cve.now/CVE-2020-15376.md): Brocade Fabric OS versions before v9.0.0 and after version v8.1.0, configured in Virtual Fabric mode contain a weakness in the ldap implemen (no CVSS, Brocade Fabric OS)
- [CVE-2020-29455](https://cve.now/CVE-2020-29455.md): A cross-Site Scripting (XSS) vulnerability in this.showInvalid and this.showInvalidCountry in SmartyStreets liveAddressPlugin.js 3.2 allows (no CVSS)
- [CVE-2020-27730](https://cve.now/CVE-2020-27730.md): In versions 3.0.0-3.9.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller Agent does not use absolute paths when calling system utilities. (no CVSS, NGINX Controller)
- [CVE-2020-19165](https://cve.now/CVE-2020-19165.md): PHPSHE 1.7 has SQL injection via the admin.php?mod=user&userlevel\_id=1 userlevel\_id\[\] parameter. (no CVSS)
- [CVE-2020-5949](https://cve.now/CVE-2020-5949.md): On BIG-IP versions 14.0.0-14.0.1 and 13.1.0-13.1.3.4, certain traffic pattern sent to a virtual server configured with an FTP profile can ca (no CVSS, BIG-IP)
- [CVE-2020-27713](https://cve.now/CVE-2020-27713.md): In certain configurations on version 13.1.3.4, when a BIG-IP AFM HTTP security profile is applied to a virtual server and the BIG-IP system (no CVSS, BIG-IP)
- [CVE-2020-35149](https://cve.now/CVE-2020-35149.md): lib/utils.js in mquery before 3.2.3 allows a pollution attack because a special property (e.g., \_\_proto\_\_) can be copied during a merge or c (no CVSS, mquery)
- [CVE-2020-5950](https://cve.now/CVE-2020-5950.md): On BIG-IP 14.1.0-14.1.2.6, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromis (no CVSS, BIG-IP)
- [CVE-2020-5948](https://cve.now/CVE-2020-5948.md): On BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, undisclosed end (no CVSS, BIG-IP)
- [CVE-2020-26418](https://cve.now/CVE-2020-26418.md): Memory leak in Kafka protocol dissector in Wireshark 3.4.0 and 3.2.0 to 3.2.8 allows denial of service via packet injection or crafted captu (CVSS 3.1, The Wireshark Foundation Wireshark)
- [CVE-2020-26421](https://cve.now/CVE-2020-26421.md): Crash in USB HID protocol dissector and possibly other dissectors in Wireshark 3.4.0 and 3.2.0 to 3.2.8 allows denial of service via packet (CVSS 4.2, The Wireshark Foundation Wireshark)
- [CVE-2020-26420](https://cve.now/CVE-2020-26420.md): Memory leak in RTPS protocol dissector in Wireshark 3.4.0 and 3.2.0 to 3.2.8 allows denial of service via packet injection or crafted captur (CVSS 3.1, The Wireshark Foundation Wireshark)
- [CVE-2020-26419](https://cve.now/CVE-2020-26419.md): Memory leak in the dissection engine in Wireshark 3.4.0 allows denial of service via packet injection or crafted capture file. (CVSS 3.1, The Wireshark Foundation Wireshark)
- [CVE-2020-27825](https://cve.now/CVE-2020-27825.md): A use-after-free flaw was found in kernel/trace/ring\_buffer.c in Linux kernel (before 5.10-rc1). (no CVSS, kernel)
- [CVE-2020-28439](https://cve.now/CVE-2020-28439.md): Command Injection (CVSS 9.8, corenlp-js-prefab)
- [CVE-2020-28440](https://cve.now/CVE-2020-28440.md): Command Injection (CVSS 9.8, corenlp-js-interface)
- [CVE-2020-7791](https://cve.now/CVE-2020-7791.md): Denial of Service (DoS) (CVSS 7.5, i18n)
- [CVE-2020-26264](https://cve.now/CVE-2020-26264.md): LES Server DoS via GetProofsV2 (CVSS 6.5, go-ethereum · github.com/ethereum/go-ethereum)
- [CVE-2020-26265](https://cve.now/CVE-2020-26265.md): Consensus flaw during block processing (CVSS 5.3, go-ethereum · github.com/ethereum/go-ethereum)
- [CVE-2020-27134](https://cve.now/CVE-2020-27134.md): Cisco Jabber Desktop and Mobile Client Software Vulnerabilities (CVSS 9.9, Cisco Jabber)
- [CVE-2020-27133](https://cve.now/CVE-2020-27133.md): Cisco Jabber Desktop and Mobile Client Software Vulnerabilities (CVSS 9.9, Cisco Jabber)
- [CVE-2020-27132](https://cve.now/CVE-2020-27132.md): Cisco Jabber Desktop and Mobile Client Software Vulnerabilities (CVSS 9.9, Cisco Jabber)
- [CVE-2020-27127](https://cve.now/CVE-2020-27127.md): Cisco Jabber Desktop and Mobile Client Software Vulnerabilities (CVSS 9.9, Cisco Jabber)
- [CVE-2020-29574](https://cve.now/CVE-2020-29574.md): An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL s (CVSS 9.8, KEV)
- [CVE-2020-12148](https://cve.now/CVE-2020-12148.md): OS Command Injection - nslookup API (CVSS 6.8, Silver Peak Systems ECOS)
- [CVE-2020-15023](https://cve.now/CVE-2020-15023.md): Askey AP5100W devices through AP5100W\_Dual\_SIG\_1.01.097 are affected by WPS PIN offline brute-force cracking. (no CVSS)
- [CVE-2020-12149](https://cve.now/CVE-2020-12149.md): OS Command Injection - Management File Upload (CVSS 6.8, Silver Peak Systems ECOS)
- [CVE-2020-15357](https://cve.now/CVE-2020-15357.md): Network Analysis functionality in Askey AP5100W\_Dual\_SIG\_1.01.097 and all prior versions allows remote attackers to execute arbitrary comman (no CVSS)
- [CVE-2020-27508](https://cve.now/CVE-2020-27508.md): In two-factor authentication, the system also sending 2fa secret key in response, which enables an intruder to breach the 2fa security. (no CVSS)
- [CVE-2020-29254](https://cve.now/CVE-2020-29254.md): TikiWiki 21.2 allows templates to be edited without CSRF protection. (no CVSS)
- [CVE-2020-29591](https://cve.now/CVE-2020-29591.md): Versions of the Official registry Docker images through 2.7.0 contain a blank password for the root user. (no CVSS)
- [CVE-2020-4633](https://cve.now/CVE-2020-4633.md): IBM Resilient SOAR V38.0 could allow a remote attacker to execute arbitrary code on the system, caused by formula injection due to improper (CVSS 6.8, IBM Resilient)
- [CVE-2020-28838](https://cve.now/CVE-2020-28838.md): Cross Site Request Forgery (CSRF) in CART option in OpenCart Ltd. (no CVSS, opencart/opencart)
- [CVE-2020-17515](https://cve.now/CVE-2020-17515.md): The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. (no CVSS, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2020-7793](https://cve.now/CVE-2020-7793.md): Regular Expression Denial of Service (ReDoS) (CVSS 7.5, ua-parser-js)
- [CVE-2020-7792](https://cve.now/CVE-2020-7792.md): Prototype Pollution (CVSS 7.5, mout)
- [CVE-2020-7790](https://cve.now/CVE-2020-7790.md): Arbitrary File Read (CVSS 5.3, spatie/browsershot)
- [CVE-2020-7788](https://cve.now/CVE-2020-7788.md): Prototype Pollution (CVSS 7.3, ini)
- [CVE-2020-7789](https://cve.now/CVE-2020-7789.md): Command Injection (CVSS 5.6, node-notifier)
- [CVE-2020-35135](https://cve.now/CVE-2020-35135.md): The ultimate-category-excluder plugin before 1.2 for WordPress allows ultimate-category-excluder.php CSRF. (no CVSS)
- [CVE-2020-35132](https://cve.now/CVE-2020-35132.md): An XSS issue has been discovered in phpLDAPadmin before 1.2.6.2 that allows users to store malicious values that may be executed by other us (no CVSS)
- [CVE-2020-26411](https://cve.now/CVE-2020-26411.md): A potential DOS vulnerability was discovered in all versions of Gitlab starting from 13.4.x (\>=13.4 to \<13.4.7, \>=13.5 to \<13.5.5, and \>=13. (CVSS 4.3, GitLab)
- [CVE-2020-35127](https://cve.now/CVE-2020-35127.md): Ignite Realtime Openfire 4.6.0 has plugins/bookmarks/create-bookmark.jsp Stored XSS. (no CVSS)
- [CVE-2020-27786](https://cve.now/CVE-2020-27786.md): A flaw was found in the Linux kernel’s implementation of MIDI, where an attacker with a local account and the permissions to issue ioctl com (no CVSS, kernel)
- [CVE-2020-26408](https://cve.now/CVE-2020-26408.md): A limited information disclosure vulnerability exists in Gitlab CE/EE from \>= 12.2 to \<13.4.7, \>=13.5 to \<13.5.5, and \>=13.6 to \<13.6.2 that (CVSS 5.3, GitLab CE/EE)
- [CVE-2020-35126](https://cve.now/CVE-2020-35126.md): Typesetter CMS 5.x through 5.1 allows admins to conduct Site Title persistent XSS attacks via an Admin/Configuration URI. (no CVSS)
- [CVE-2020-13357](https://cve.now/CVE-2020-13357.md): An issue was discovered in Gitlab CE/EE versions \>= 13.1 to \<13.4.7, \>= 13.5 to \<13.5.5, and \>= 13.6 to \<13.6.2 allowed an unauthorized user (CVSS 4.3, GitLab CE/EE)
- [CVE-2020-26412](https://cve.now/CVE-2020-26412.md): Removed group members were able to use the To-Do functionality to retrieve updated information on confidential epics starting in GitLab EE 1 (CVSS 3.1, GitLab EE)
- [CVE-2020-26413](https://cve.now/CVE-2020-26413.md): An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4 before 13.6.2. (CVSS 5.3, GitLab CE/EE)
- [CVE-2020-26417](https://cve.now/CVE-2020-26417.md): Information disclosure via GraphQL in GitLab CE/EE 13.1 and later exposes private group and project membership. (CVSS 5.3, GitLab CE/EE)
- [CVE-2020-26416](https://cve.now/CVE-2020-26416.md): Information disclosure in Advanced Search component of GitLab EE starting from 8.4 results in exposure of search terms via Rails logs. (CVSS 4.0, GitLab EE)
- [CVE-2020-26415](https://cve.now/CVE-2020-26415.md): Information about the starred projects for private user profiles was exposed via the GraphQL API starting from 12.2 via the REST API. (CVSS 4.3, GitLab)
- [CVE-2020-13520](https://cve.now/CVE-2020-13520.md): An out of bounds memory corruption vulnerability exists in the way Pixar OpenUSD 20.05 reconstructs paths from binary USD files. (CVSS 8.8, Pixar)
- [CVE-2020-13530](https://cve.now/CVE-2020-13530.md): A denial-of-service vulnerability exists in the Ethernet/IP server functionality of the EIP Stack Group OpENer 2.3 and development commit 8c (CVSS 7.5, EIP Stack Group)
- [CVE-2020-13556](https://cve.now/CVE-2020-13556.md): An out-of-bounds write vulnerability exists in the Ethernet/IP server functionality of EIP Stack Group OpENer 2.3 and development commit 8c7 (CVSS 9.8, EIP Stack Group)
- [CVE-2020-27828](https://cve.now/CVE-2020-27828.md): There's a flaw in jasper's jpc encoder in versions prior to 2.0.23. (no CVSS, jasper)
- [CVE-2020-24440](https://cve.now/CVE-2020-24440.md): Uncontrolled Search Path Element in Adobe Prelude for Windows (CVSS 7.0, Adobe Prelude)
- [CVE-2020-24447](https://cve.now/CVE-2020-24447.md): Uncontrolled Search Path Element vulnerability in Lightroom Classic 10.0 (CVSS 7.0, Adobe Lightroom)
- [CVE-2020-9301](https://cve.now/CVE-2020-9301.md): Nolan Ray from Apple Information Security identified a security vulnerability in Spinnaker, all versions prior to version 1.23.4, 1.22.4 or (no CVSS, Netflix Spinnaker)
- [CVE-2020-25191](https://cve.now/CVE-2020-25191.md): Incorrect permissions are set by default for an API entry-point of a specific service, allowing a non-authenticated user to trigger a functi (no CVSS, CompactRIO)
- [CVE-2020-25838](https://cve.now/CVE-2020-25838.md): Unauthorized disclosure of sensitive information vulnerability in Micro Focus Filr product. (no CVSS, Filr)
- [CVE-2020-24637](https://cve.now/CVE-2020-24637.md): Two vulnerabilities in ArubaOS GRUB2 implementation allows for an attacker to bypass secureboot. (no CVSS, Aruba 9000 Gateway · Aruba 7000 Series Mobility Controll… +1)
- [CVE-2020-24633](https://cve.now/CVE-2020-24633.md): There are multiple buffer overflow vulnerabilities that could lead to unauthenticated remote code execution by sending especially crafted pa (no CVSS, Aruba 9000 Gateway · Aruba 7000 Series Mobility Controll… +1)
- [CVE-2020-24634](https://cve.now/CVE-2020-24634.md): An attacker is able to remotely inject arbitrary commands by sending especially crafted packets destined to the PAPI (Aruba Networks AP Mana (no CVSS, Aruba 9000 Gateway · Aruba 7000 Series Mobility Controll… +1)
- [CVE-2020-26409](https://cve.now/CVE-2020-26409.md): A DOS vulnerability exists in Gitlab CE/EE \>=10.3, \<13.4.7,\>=13.5, \<13.5.5,\>=13.6, \<13.6.2 that allows an attacker to trigger uncontrolled r (CVSS 4.3, GitLab CE/EE)
- [CVE-2020-17530](https://cve.now/CVE-2020-17530.md): Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. (CVSS 9.8, KEV, Apache Software Foundation Apache Struts · org.apache.strut…)
- [CVE-2020-7560](https://cve.now/CVE-2020-7560.md): A CWE-123: Write-what-where Condition vulnerability exists in EcoStruxure™ Control Expert (all versions) and Unity Pro (former name of EcoSt (no CVSS, EcoStruxure™ Control Expert (all versions) and Unity Pro (f…)
- [CVE-2020-7549](https://cve.now/CVE-2020-7549.md): A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modico (CVSS 7.5, Web Server on Modicon M340, Legacy Offers Modicon Quantum a…)
- [CVE-2020-7543](https://cve.now/CVE-2020-7543.md): A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Legacy Controllers Modic (no CVSS, Modicon M580, Modicon M340, Legacy Controllers Modicon Quan…)
- [CVE-2020-7542](https://cve.now/CVE-2020-7542.md): A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Legacy Controllers Modic (no CVSS, Modicon M580, Modicon M340, Legacy Controllers Modicon Quan…)
- [CVE-2020-7541](https://cve.now/CVE-2020-7541.md): A CWE-425: Direct Request ('Forced Browsing') vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modi (no CVSS, Web Server on Modicon M340, Legacy Offers Modicon Quantum a…)
- [CVE-2020-7540](https://cve.now/CVE-2020-7540.md): A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantu (no CVSS, Web Server on Modicon M340, Legacy Offers Modicon Quantum a…)
- [CVE-2020-7539](https://cve.now/CVE-2020-7539.md): A CWE-754 Improper Check for Unusual or Exceptional Conditions vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon (no CVSS, Web Server on Modicon M340, Legacy Offers Modicon Quantum a…)
- [CVE-2020-7537](https://cve.now/CVE-2020-7537.md): A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Legacy Controllers Modic (no CVSS, Modicon M580, Modicon M340, Legacy Controllers Modicon Quan…)
- [CVE-2020-7535](https://cve.now/CVE-2020-7535.md): A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal' Vulnerability Type) vulnerability exists in the Web (no CVSS, Web Server on Modicon M340, Legacy Offers Modicon Quantum a…)
- [CVE-2020-28220](https://cve.now/CVE-2020-28220.md): A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in Modicon M258 Firmware (All versio (CVSS 4.7, Modicon M258 Firmware (All versions prior to V5.0.4.11) and…)
- [CVE-2020-28219](https://cve.now/CVE-2020-28219.md): A CWE-522: Insufficiently Protected Credentials vulnerability exists in EcoStruxure Geo SCADA Expert 2019 (Original release and Monthly Upda (no CVSS, EcoStruxure Geo SCADA Expert 2019 (Original release and Mon…)
- [CVE-2020-28218](https://cve.now/CVE-2020-28218.md): A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists in Easergy T300 (firmware 2.7 and older), that would a (no CVSS, Easergy T300)
- [CVE-2020-28217](https://cve.now/CVE-2020-28217.md): A CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Easergy T300 (firmware 2.7 and older), that would allow an attacker (no CVSS, Easergy T300)
- [CVE-2020-28216](https://cve.now/CVE-2020-28216.md): A CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Easergy T300 (firmware 2.7 and older), that would allow an attacker (no CVSS, Easergy T300)
- [CVE-2020-28215](https://cve.now/CVE-2020-28215.md): A CWE-862: Missing Authorization vulnerability exists in Easergy T300 (firmware 2.7 and older), that could cause a wide range of problems, i (no CVSS, Easergy T300)
- [CVE-2020-28214](https://cve.now/CVE-2020-28214.md): A CWE-760: Use of a One-Way Hash with a Predictable Salt vulnerability exists in Modicon M221 (all references, all versions), that could all (CVSS 9.8, Modicon M221)
- [CVE-2020-7536](https://cve.now/CVE-2020-7536.md): A CWE-754:Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M340 CPUs (BMXP34\* versions prior to V3.30) M (no CVSS, Modicon M340 CPUs (BMXP34\* versions prior to V3.30) and Mod…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-12-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.