Skip to content
OpenAdvisories

Archive

15 July 2020

Vulnerabilities first published on this day (UTC), newest first.

← June 2020 2020 / July /15 August 2020 →
  1. 171
  2. 254
  3. 311
  4. 41
  5. 513
  6. 628
  7. 770
  8. 818
  9. 951
  10. 1024
  11. 11 
  12. 12 
  13. 1320
  14. 14194
  15. 15278
  16. 1663
  17. 1773
  18. 18 
  19. 19 
  20. 2036
  21. 2118
  22. 2274
  23. 2341
  24. 2428
  25. 255
  26. 26 
  27. 2725
  28. 2886
  29. 2962
  30. 3051
  31. 3133
All Critical High Medium Low Exploited only Public exploit

16 results · Clear filters · Feed

  • Critical 9.1
    CVE-2020-10287

    RVD#3326: Hardcoded default credentials on IRC 5 OPC Server

    The IRC5 family with UAS service enabled comes by default with credentials that can be found on publicly available manuals. ABB considers this a well documented functionality that helps customer set up however, out of our research, we found multiple productio…

    ABB IRB140 ICS / OT
  • Critical 9.8
    CVE-2020-10288

    RVD#3327: No authentication required for accesing ABB IRC5 FTP server

    IRC5 exposes an ftp server (port 21). Upon attempting to gain access you are challenged with a request of username and password, however you can input whatever you like. As long as the field isn't empty it will be accepted.

    ABB IRB140 ICS / OT
  • Critical 9.4
    CVE-2020-10286

    RVD#3323: Mismanaged permission implementation leads to privilege escalation, exfiltration of sensitive information, and DoS

    the main user account has restricted privileges but is in the sudoers group and there is not any mechanism in place to prevent sudo su or sudo -i to be run gaining unrestricted access to sensible files, encryption, or issue orders that disrupt robot operation.

    uFactory xArm 5 Lite, xArm 6 and xArm 7
  • Critical 9.4
    CVE-2020-10285

    RVD#3322: Weak authentication implementation make the system vulnerable to a brute-force attack over adjacent networks

    The authentication implementation on the xArm controller has very low entropy, making it vulnerable to a brute-force attack. There is no mechanism in place to mitigate or lockout automated attempts to gain access.

    uFactory xArm5 Lite, xArm 6 and xArm 7
  • Critical 9.1
    CVE-2020-10284

    RVD#3321: No Authentication required to exert manual control of the robot

    No authentication is required to control the robot inside the network, moreso the latest available user manual shows an option that lets the user to add a password to the robot but as in xarm_studio 1.3.0 the option is missing from the menu. Assuming manual c…

    uFactory xArm5 Lite, xArm 6 and xArm 7
  • Critical 9.6
    CVE-2020-14705

    Vulnerability in the Oracle GoldenGate product of Oracle GoldenGate (component: Process Management). The supported vers…

    Oracle GoldenGate
  • Critical 9.8
    CVE-2020-14687

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…

    Oracle WebLogic Server
  • Critical 10.0
    CVE-2020-14701

    Vulnerability in the Oracle SD-WAN Aware product of Oracle Communications Applications (component: User Interface). The…

    Oracle SD-WAN Aware
  • Critical 9.1
    CVE-2020-14665

    Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: Invoice). Supported version…

    Oracle Trade Management
  • Critical 9.1
    CVE-2020-14658

    Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). Support…

    Oracle Marketing
  • Critical 9.8
    CVE-2020-14644 Exploited Public exploit Scanner template EPSS 95%

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…

    Oracle WebLogic Server
    KEV Sep 18, 2024
  • Critical 9.8
    CVE-2020-14645 Public exploit EPSS 47%

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…

    Oracle WebLogic Server
  • Critical 9.8
    CVE-2020-14625

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions t…

    Oracle WebLogic Server
  • Critical 9.1
    CVE-2020-14598

    Vulnerability in the Oracle CRM Gateway for Mobile Devices product of Oracle E-Business Suite (component: Setup of Mobi…

    Oracle CRM Gateway for Mobile Devices
  • Critical 10.0
    CVE-2020-14606

    Vulnerability in the Oracle SD-WAN Edge product of Oracle Communications Applications (component: User Interface). Supp…

    Oracle SD-WAN Edge Browsers
  • Critical 9.1
    CVE-2020-14599

    Vulnerability in the Oracle CRM Gateway for Mobile Devices product of Oracle E-Business Suite (component: Setup of Mobi…

    Oracle CRM Gateway for Mobile Devices