Unauthorized access vulnerability in S-CMS enterprise website building system (CNVD-2021-00044)

S-CMS enterprise station building system is Zibo Shining Network Technology Co., Ltd. developed a specialized enterprise station building solutions for the product. There is an unauthorized access vulnerability in S-CMS, which can be exploited by an attacker to gain administrator privileges witho...

CVE-2020-24678

An authenticated user might execute malicious code under the user context and take control of the system. S+ Operations or S+ Historian database is affected by multiple vulnerabilities such as the possibility to allow remote authenticated users to gain high privileges...

CVE-2020-24680

In S+ Operations and S+ Historian, the passwords of internal users not Windows Users are encrypted but improperly stored in a database...

CVE-2020-24679

A S+ Operations and S+ Historian service is subject to a DoS by special crafted messages. An attacker might use this flaw to make it crash or even execute arbitrary code on the machine where the service is hosted...

CVE-2020-24674

In S+ Operations and S+ Historian, not all client commands correctly check user permission as expected. Authenticated but Unauthorized remote users could execute a Denial-of-Service DoS attack, execute arbitrary code, or obtain more privilege than intended on the machines...

CVE-2020-24677

Vulnerabilities in the S+ Operations and S+ Historian web applications can lead to a possible code execution and privilege escalation, redirect the user somewhere else or download unwanted data...

CVE-2020-24683

The affected versions of S+ Operations version 2.1 SP1 and earlier used an approach for user authentication which relies on validation at the client node client-side authentication. This is not as secure as having the server validate a client application before allowing a connection. Therefore, i...

CVE-2020-24677

Vulnerabilities in the S+ Operations and S+ Historian web applications can lead to a possible code execution and privilege escalation, redirect the user somewhere else or download unwanted data...

CVE-2020-24678

An authenticated user might execute malicious code under the user context and take control of the system. S+ Operations or S+ Historian database is affected by multiple vulnerabilities such as the possibility to allow remote authenticated users to gain high privileges...

CVE-2020-24679

A S+ Operations and S+ Historian service is subject to a DoS by special crafted messages. An attacker might use this flaw to make it crash or even execute arbitrary code on the machine where the service is hosted...

CVE-2020-24683

The affected versions of S+ Operations version 2.1 SP1 and earlier used an approach for user authentication which relies on validation at the client node client-side authentication. This is not as secure as having the server validate a client application before allowing a connection. Therefore, i...

CVE-2020-24675

In S+ Operations and S+ History, it is possible that an unauthenticated user could inject values to the Operations History server or standalone S+ History server and ultimately write values to the controlled process...

CVE-2020-24673

In S+ Operations and S+ Historian, a successful SQL injection exploit can read sensitive data from the database, modify database data Insert/Update/Delete, execute administration operations on the database such as shutdown the DBMS, recover the content of a given file present on the DBMS file...

Sql injection

In S+ Operations and S+ Historian, a successful SQL injection exploit can read sensitive data from the database, modify database data Insert/Update/Delete, execute administration operations on the database such as shutdown the DBMS, recover the content of a given file present on the DBMS file...

Command injection

In S+ Operations and S+ Historian, not all client commands correctly check user permission as expected. Authenticated but Unauthorized remote users could execute a Denial-of-Service DoS attack, execute arbitrary code, or obtain more privilege than intended on the machines...

Design/Logic Flaw

In S+ Operations and S+ History, it is possible that an unauthenticated user could inject values to the Operations History server or standalone S+ History server and ultimately write values to the controlled process...

Design/Logic Flaw

In S+ Operations and S+ Historian, the passwords of internal users not Windows Users are encrypted but improperly stored in a database...

Authentication flaw

The affected versions of S+ Operations version 2.1 SP1 and earlier used an approach for user authentication which relies on validation at the client node client-side authentication. This is not as secure as having the server validate a client application before allowing a connection. Therefore, i...

CVE-2020-24675

The CVE-2020-24675 entry concerns ABB S+ Operations and S+ History servers. The vulnerability allows an unauthenticated remote attacker to inject values into the Operations History server (or standalone S+ History server), enabling writes to the controlled process. This is evidenced by the NVD en...

CVE-2020-24673

CVE-2020-24673 affects S+ Operations and S+ Historian. The vulnerability is a SQL injection that can allow an attacker to read sensitive data, modify data (Insert/Update/Delete), perform database administration operations (e.g., shutdown the DBMS), recover files from the DBMS file system, and pot...