PT-2020-10043

Name of the Vulnerable Software and Affected Versions B&R Automation Studio versions 4.0.x through 4.8.0 Description A privilege escalation issue in the upgrade service allows authenticated users to delete arbitrary files via an exposed interface. Recommendations For versions 4.0.x through 4.8.0,...

CVE-2019-19101: Inadequate Encryption Strength

A missing secure communication definition and an incomplete TLS validation in the upgrade service in B&R Automation Studio versions 4.0.x, 4.1.x, 4.2.x, 4.3.11SP, 4.4.9SP, 4.5.5SP, 4.6.4 and 4.7.2 enable unauthenticated users to perform MITM attacks via the B&R upgrade server...

PT-2020-10045

Name of the Vulnerable Software and Affected Versions B&R Automation Studio versions 4.0.x through 4.2.x Description A directory traversal issue in SharpZipLib, used by the upgrade service, allows unauthenticated users to write to specific local directories. This issue is also referred to as zip...

CVE-2019-19102: Improper Limitation of a Pathname to a Restricted Directory

A directory traversal vulnerability in SharpZipLib used in the upgrade service in B&R Automation Studio versions 4.0.x, 4.1.x and 4.2.x allow unauthenticated users to write to certain local directories. The vulnerability is also known as zip slip...

CVE-2019-19108

An authentication weakness in the SNMP service in B&R Automation Runtime versions 2.96, 3.00, 3.01, 3.06 to 3.10, 4.00 to 4.63, 4.72 and above allows unauthenticated users to modify the configuration of B&R products via SNMP...

Authentication flaw

An authentication weakness in the SNMP service in B&R Automation Runtime versions 2.96, 3.00, 3.01, 3.06 to 3.10, 4.00 to 4.63, 4.72 and above allows unauthenticated users to modify the configuration of B&R products via SNMP...

CVE-2019-19108 B&R Automation Runtime SNMP Authentication and Authorization Weakness

An authentication weakness in the SNMP service in B&R Automation Runtime versions 2.96, 3.00, 3.01, 3.06 to 3.10, 4.00 to 4.63, 4.72 and above allows unauthenticated users to modify the configuration of B&R products via SNMP...

CVE-2019-19108

CVE-2019-19108 describes an authentication weakness in the SNMP service affecting B&R Automation Runtime (and Automation Studio) versions 2.96, 3.00, 3.01, 3.06–3.10, 4.00–4.63, 4.72 and above. The vulnerability allows unauthenticated users to modify device configuration via SNMP, with CVSS v3 ba...

PT-2020-10050

Name of the Vulnerable Software and Affected Versions B&R Automation Runtime versions 2.96, 3.00, 3.01, 3.06 through 3.10, 4.00 through 4.63, 4.72 and above Description An authentication weakness in the SNMP service allows unauthenticated users to modify the configuration of B&R products via SNMP...

CVE-2019-19108: Use of Hard-coded Credentials

An authentication weakness in the SNMP service in B&R Automation Runtime versions 2.96, 3.00, 3.01, 3.06 to 3.10, 4.00 to 4.63, 4.72 and above allows unauthenticated users to modify the configuration of B&R products via SNMP...

B&R Automation Automation Studio Path Traversal Vulnerability

B&R Automation Automation Studio is an automation control system. A path traversal vulnerability exists in B&R Automation Automation Studio, which can be exploited by an attacker to write to certain local directories...

B&R Automation Studio

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: B&R Automation Equipment: Automation Studio Vulnerabilities: Improper Privilege Management, Missing Required Cryptographic Step, Path Traversal 2. RISK EVALUATION Successful exploitation of these...

[ASA-202004-2] linux-hardened: privilege escalation

Arch Linux Security Advisory ASA-202004-2 ========================================= Severity: High Date : 2020-04-01 CVE-ID : CVE-2020-8835 Package : linux-hardened Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1120 Summary ======= The package linux-hardened...

b-c.pt Improper Access Control vulnerability

Open Bug Bounty ID: OBB-1129734 Security Researcher Gh05tPT Helped patch 6892 vulnerabilities Received 10 Coordinated Disclosure badges Received 48 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting b-c.pt website and its...

GitLab File Read Remote Code Execution

This module provides remote code execution against GitLab Community Edition CE and Enterprise Edition EE. It combines an arbitrary file read to extract the Rails "secretkeybase", and gains remote code execution with a deserialization vulnerability of a signed 'experimentationsubjectid' cookie tha...

WordPress sitepress-multilingual-cms cross-site request forgery vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. sitepress-multilingual-cms WPML plugin is a website multilingual support plugin used in it. A cross-site request forgery vulnerability...

CVE-2020-6980

Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001 and prior, If Simple Mail Transfer Protocol SMTP account data is saved in RSLogix 500, a local attacker with access to a...

CVE-2020-6984

Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001 and prior, The cryptographic function utilized to protect the password in MicroLogix is discoverable...

Rockwell Automation MicroLogix Controllers and RSLogix 500 Software

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Rockwell Automation Equipment: MicroLogix 1400 Controllers, MicroLogix 1100 Controllers, and RSLogix 500 Software Vulnerabilities: Use of Hard-coded Cryptographic Key, Use of a Broken or Risky...

b-and-b.be Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1114749 Security Researcher ratnadip1998 Helped patch 7 vulnerabilities Received 0 Coordinated Disclosure badges , found a security vulnerability affecting b-and-b.be website and its users. Following coordinated and responsible vulnerability disclosure guidelines of the IS...