Design/Logic Flaw

Insufficient protection of the inter-process communication functions in ABB System 800xA products OPC Server for AC 800M, MMS Server for AC 800M and Base Software for SoftControl all published versions enables an attacker authenticated on the local system to inject data, affecting the online view...

CVE-2020-8487

Insufficient protection of the inter-process communication functions in ABB System 800xA Base all published versions enables an attacker authenticated on the local system to inject data, affect node redundancy handling...

Design/Logic Flaw

Insufficient protection of the inter-process communication functions in ABB System 800xA Batch Management all published versions enables an attacker authenticated on the local system to inject data, affecting User Interface update during batch execution and/or compare/printing functionalities...

CVE-2019-19101

CVE-2019-19101 concerns a TLS validation flaw in the B&R Automation Studio upgrade service that allows unauthenticated users to perform MITM attacks via the upgrade server. Affected products: Automation Studio versions 4.0.x, 4.1.x, 4.2.x, and older builds prior to 4.3.11SP, 4.4.9SP, 4.5.5SP, 4.6...

CVE-2019-19101 Incomplete communication encryption and validation in B&R Automation Studio upgrade service

A missing secure communication definition and an incomplete TLS validation in the upgrade service in B&R Automation Studio versions 4.0.x, 4.1.x, 4.2.x, 4.3.11SP, 4.4.9SP, 4.5.5SP, 4.6.4 and 4.7.2 enable unauthenticated users to perform MITM attacks via the B&R upgrade server...

CVE-2020-8489 ABB System 800xA Inter process communication vulnerability - 800xA Information Management

Insufficient protection of the inter-process communication functions in ABB System 800xA Information Management all published versions enables an attacker authenticated on the local system to inject data, affecting the runtime values to be stored in the archive, or making Information Management...

CVE-2020-8488 ABB System 800xA Inter process communication vulnerability - 800xA Batch Management

Insufficient protection of the inter-process communication functions in ABB System 800xA Batch Management all published versions enables an attacker authenticated on the local system to inject data, affecting User Interface update during batch execution and/or compare/printing functionalities...

CVE-2020-8487

CVE-2020-8487 affects ABB System 800xA Base. The issue is insufficient protection of inter-process communication, allowing an attacker authenticated on the local system to inject data and affect node redundancy handling. Affected products include System 800xA Base (all published versions). Impact...

CVE-2020-8486 ABB System 800xA Inter process communication vulnerability - 800xA RNRP

Insufficient protection of the inter-process communication functions in ABB System 800xA RNRP all published versions enables an attacker authenticated on the local system to inject data, affect node redundancy handling...

CVE-2020-8486

The CVE-2020-8486 entry concerns ABB System 800xA RNRP (and related 800xA components) with insufficient protection of inter-process communication. The vulnerability arises from weak access control in IPC objects exchanged between System 800xA processes on the same machine, allowing an authenticat...

CVE-2020-8485 ABB System 800xA Inter process communication vulnerability - 800xA for Mod 300

Insufficient protection of the inter-process communication functions in ABB System 800xA for MOD 300 all published versions enables an attacker authenticated on the local system to inject data, allowing reads and writes to the controllers or cause windows processes to crash...

CVE-2020-8485

CVE-2020-8485 affects ABB System 800xA MOD 300; the inter-process communication protections are insufficient, allowing a locally authenticated attacker to inject data and enable reads/writes to controllers or crash Windows processes. Affected: System 800xA MOD 300 (all published versions). Impact...

CVE-2020-8484

ABB System 800xA for DCI contains an inter-process communication protection weakness that allows an authenticated local attacker to inject data, enabling reads/writes to controllers or causing Windows processes to crash. Affected products include System 800xA for DCI (all published versions). CVS...

CVE-2020-8484 ABB System 800xA Inter process communication vulnerability - 800xA for DCI

Insufficient protection of the inter-process communication functions in ABB System 800xA for DCI all published versions enables an attacker authenticated on the local system to inject data, allowing reads and writes to the controllers or cause windows processes to crash...

CVE-2020-8478

The CVE-2020-8478 issue affects ABB System 800xA components (OPC Server for AC 800M, MMS Server for AC 800M, and Base Software for SoftControl) where weak inter-process communication access controls allow an authenticated local attacker to inject data and tamper the online runtime data view in Co...

Microsoft SharePoint Server 2016 build < 16.0.4873.1000 Multiple Vulnerabilities

According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities : - An authentication bypass vulnerability exists in Windows Communication Foundation WCF and Windows Identity Foundation WIF, allowing signing of...

Microsoft SharePoint Server 2013 build < 15.0.5153.1000 Multiple Vulnerabilities

According to its self-reported version number, the Microsoft SharePoint application running on the remote host is affected by multiple vulnerabilities : - An authentication bypass vulnerability exists in Windows Communication Foundation WCF and Windows Identity Foundation WIF, allowing signing of...

SUSE SLES12 Security Update : webkit2gtk3 (SUSE-SU-2020:1135-1)

This update for webkit2gtk3 to version 2.28.1 fixes the following issues : Security issues fixed : CVE-2020-10018: Fixed a denial of service because the mdeferredFocusedNodeChange data structure was mishandled bsc1165528. CVE-2020-11793: Fixed a potential arbitrary code execution caused by a...

SUSE SLED15 / SLES15 Security Update : webkit2gtk3 (SUSE-SU-2020:1109-1)

This update for webkit2gtk3 to version 2.28.1 fixes the following issues : Security issues fixed : CVE-2020-10018: Fixed a denial of service because the mdeferredFocusedNodeChange data structure was mishandled bsc1165528. CVE-2020-11793: Fixed a potential arbitrary code execution caused by a...

Acronis: Local Privilege Escalation in anti_ransomware_service.exe via quarantine

antiransomwareservice.exe includes a functionality to quarantine files which will copy the suspected ransomware file from one directory to another using SYSTEM privileges. As any unprivileged user has write permissions in the quarantine folder, it is possible to control this privileged write with...