CVE-2020-15806

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

CODESYS Control runtime system before 3.5.16.10 allows Uncontrolled Memory Allocation.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-401

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=13199&token=3e283c3e73fed61f7c181a7fa1169477efaf0c58&download=Mitigation, Vendor Advisory
https://www.codesys.comVendor Advisory
https://www.tenable.com/security/research/tra-2020-46Exploit, Third Party Advisory
https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=13199&token=3e283c3e73fed61f7c181a7fa1169477efaf0c58&download=Mitigation, Vendor Advisory
https://www.codesys.comVendor Advisory
https://www.tenable.com/security/research/tra-2020-46Exploit, Third Party Advisory

Timeline

Published: Jul 22, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-158076.5GNU LibreDWG before 0.11 allows NULL pointer dereferences via crafted input files.CVE-2020-158096.5spxmanage on certain SpinetiX devices allows requests that access unintended resources because of SSRF and Path Traversal. This affects HMP3 CVE-2020-15817.8An elevation of privilege vulnerability exists in the way that Microsoft Office Click-to-Run (C2R) components handle objects in memory. An a CVE-2020-158106.5An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Smuggling attacks may succ CVE-2020-158116.5An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Splitting attacks may succ CVE-2020-158138.1Graylog before 3.3.3 lacks SSL Certificate Validation for LDAP servers. It allows use of an external user/group database stored in LDAP. The CVE-2020-158168.8In Western Digital WD Discovery before 4.0.251.0, a malicious application running with standard user permissions could potentially execute c CVE-2020-158178.8In JetBrains YouTrack before 2020.1.1331, an external user could execute commands against arbitrary issues.CVE-2020-158185.3In JetBrains YouTrack before 2020.2.8527, the subtasks workflow could disclose issue existence.CVE-2020-158195.3JetBrains YouTrack before 2020.2.10643 was vulnerable to SSRF that allowed scanning internal ports.CVE-2020-15827.8A remote code execution vulnerability exists in Microsoft Access software when the software fails to properly handle objects in memory. An a CVE-2020-158205.3In JetBrains YouTrack before 2020.2.6881, the markdown parser could disclose hidden file existence.