CVE-2020-24683

Summary: CVE-2020-24683 affects S+ Operations (version 2.1 SP1 and earlier). The root cause is client-side authentication, where the server does not validate a client application before allowing a connection. This can allow unauthorized actors to bypass authentication and establish unauthorized c...

CVE-2020-24680 Improper Credential Storage in Symphony Plus

In S+ Operations and S+ Historian, the passwords of internal users not Windows Users are encrypted but improperly stored in a database...

CVE-2020-24680

CVE-2020-24680 affects S+ Operations and S+ Historian. The issue is that internal-user passwords are encrypted but stored in a database inappropriately, enabling local access to sensitive credentials. CVSSv3.1 base score is 7.0 (HIGH) with Confidentiality, Integrity, and Availability impacts; att...

CVE-2020-24679

CVE-2020-24679 concerns the S+ Operations and S+ Historian service. Public sources describe a DoS with specially crafted messages that can crash the service and, in some wording, may allow arbitrary code execution on the host. The NVD entry lists impact including high confidentiality, integrity, ...

CVE-2020-24677

Technical details (affected products, vulnerable components, exact root cause, versions, exploitability) are not provided in the supplied documents. Monitor for updates from NVD/ABB and EU sources for concrete advisories.

CVE-2020-24677 Insecure Web Service in Symphony Plus

Vulnerabilities in the S+ Operations and S+ Historian web applications can lead to a possible code execution and privilege escalation, redirect the user somewhere else or download unwanted data...

CVE-2020-24678

CVE-2020-24678 affects S+ Operations or S+ Historian database. An authenticated user may execute malicious code under their user context and escalate privileges to take control of the system. Public details from NVD indicate CVSSv3.1 base score 8.8 (HIGH) with NETWORK attack vector, LOW attack co...

CVE-2020-24683: Client-Side Enforcement of Server-Side Security

The affected versions of S+ Operations version 2.1 SP1 and earlier used an approach for user authentication which relies on validation at the client node client-side authentication. This is not as secure as having the server validate a client application before allowing a connection. Therefore, i...

PT-2020-15803

Name of the Vulnerable Software and Affected Versions S+ Operations and S+ Historian affected versions not specified Description The issue affects the S+ Operations and S+ Historian web applications, potentially leading to code execution and privilege escalation. It can also redirect users to oth...

PT-2020-15806

Name of the Vulnerable Software and Affected Versions S+ Operations and S+ Historian affected versions not specified Description The issue concerns the improper storage of encrypted passwords for internal users, excluding Windows users, in a database within S+ Operations and S+ Historian...

PT-2020-15804

Name of the Vulnerable Software and Affected Versions S+ Operations versions affected versions not specified S+ Historian database versions affected versions not specified Description An authenticated user might execute malicious code under the user context and take control of the system. The S+...

PT-2020-15805

Name of the Vulnerable Software and Affected Versions S+ Operations and S+ Historian affected versions not specified Description The S+ Operations and S+ Historian service is susceptible to a Denial of Service DoS attack via specially crafted messages. An attacker could exploit this flaw to cause...

PT-2020-15801

Name of the Vulnerable Software and Affected Versions S+ Operations and S+ History affected versions not specified Description The issue allows an unauthenticated user to inject values to the Operations History server or a standalone S+ History server, potentially writing values to the controlled...

PT-2020-15799

Name of the Vulnerable Software and Affected Versions S+ Operations and S+ Historian affected versions not specified Description A successful SQL injection exploit can read sensitive data from the database, modify database data Insert/Update/Delete, execute administration operations on the databa...

CVE-2020-24674: Improper Authorization

In S+ Operations and S+ Historian, not all client commands correctly check user permission as expected. Authenticated but Unauthorized remote users could execute a Denial-of-Service DoS attack, execute arbitrary code, or obtain more privilege than intended on the machines...

CVE-2020-24680: Insufficiently Protected Credentials

In S+ Operations and S+ Historian, the passwords of internal users not Windows Users are encrypted but improperly stored in a database...

PT-2020-15800

Name of the Vulnerable Software and Affected Versions S+ Operations and S+ Historian affected versions not specified Description The issue arises from inadequate user permission checks for certain client commands. As a result, authenticated but unauthorized remote users could potentially execute ...

CVE-2020-24678: Improper Privilege Management

An authenticated user might execute malicious code under the user context and take control of the system. S+ Operations or S+ Historian database is affected by multiple vulnerabilities such as the possibility to allow remote authenticated users to gain high privileges...

CVE-2020-24679: Improper Input Validation

A S+ Operations and S+ Historian service is subject to a DoS by special crafted messages. An attacker might use this flaw to make it crash or even execute arbitrary code on the machine where the service is hosted...

CVE-2020-24675: Improper Authentication

In S+ Operations and S+ History, it is possible that an unauthenticated user could inject values to the Operations History server or standalone S+ History server and ultimately write values to the controlled process...