CVE-2020-11614: Cleartext Transmission of Sensitive Information

Mids' Reborn Hero Designer 2.6.0.7 downloads the update manifest, as well as update files, over cleartext HTTP. Additionally, the application does not perform file integrity validation for files after download. An attacker can perform a man-in-the-middle attack against this connection and replace...

CVE-2020-11613: Uncontrolled Search Path Element

Mids' Reborn Hero Designer 2.6.0.7 has an elevation of privilege vulnerability due to default and insecure permissions being set for the installation folder. By default, the Authenticated Users group has Modify permissions to the installation folder. Because of this, any user on the system can...

The vulnerability of the Web Based Report Designer component of the Oracle Hyperion Financial Reporting application allows a malicious individual to gain unauthorized access to protected information.

The vulnerability of the Web Based Report Designer component of the Oracle Hyperion Financial Reporting application for automating budget management processes is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protect...

Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU - Jan 2020 - Includes Oracle Jan 2020 CPU minus CVE-2020-2585, CVE-2020-2654, and CVE-2020-2590

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Versions 8 that are used by Rational Software Architect Designer and Rational Software Architect Designer for Websphere Software. These issues were disclosed as part of the IBM Java SDK updates in Jan 2020...

Race condition

Products that use EDS Subsystem: Version 28.0.1 and prior FactoryTalk Linx software Previously called RSLinx Enterprise: Versions 6.00, 6.10, and 6.11, RSLinx Classic: Version 4.11.00 and prior, RSNetWorx software: Version 28.00.00 and prior, Studio 5000 Logix Designer software: Version 32 and...

PT-2020-13001

Name of the Vulnerable Software and Affected Versions FactoryTalk Linx software versions 6.00 through 6.11 RSLinx Classic version 4.11.00 and prior RSNetWorx software version 28.00.00 and prior Studio 5000 Logix Designer software version 32 and prior EDS Subsystem version 28.0.1 and prior...

CVE-2020-12034: Improper Neutralization of Special Elements used in an SQL Command

Products that use EDS Subsystem: Version 28.0.1 and prior FactoryTalk Linx software Previously called RSLinx Enterprise: Versions 6.00, 6.10, and 6.11, RSLinx Classic: Version 4.11.00 and prior, RSNetWorx software: Version 28.00.00 and prior, Studio 5000 Logix Designer software: Version 32 and...

Memory corruption

Products that use EDS Subsystem: Version 28.0.1 and prior FactoryTalk Linx software Previously called RSLinx Enterprise: Versions 6.00, 6.10, and 6.11, RSLinx Classic: Version 4.11.00 and prior, RSNetWorx software: Version 28.00.00 and prior, Studio 5000 Logix Designer software: Version 32 and...

PT-2020-13005

Name of the Vulnerable Software and Affected Versions FactoryTalk Linx software versions 6.00 through 6.11 RSLinx Classic version 4.11.00 and prior RSNetWorx software version 28.00.00 and prior Studio 5000 Logix Designer software versions prior to 32 Products that use EDS Subsystem version 28.0.1...

CVE-2020-12038: Improper Restriction of Operations within the Bounds of a Memory Buffer

Products that use EDS Subsystem: Version 28.0.1 and prior FactoryTalk Linx software Previously called RSLinx Enterprise: Versions 6.00, 6.10, and 6.11, RSLinx Classic: Version 4.11.00 and prior, RSNetWorx software: Version 28.00.00 and prior, Studio 5000 Logix Designer software: Version 32 and...

PT-2020-6331

Name of the Vulnerable Software and Affected Versions Vijeo Designer Basic versions V1.1 HotFix 16 and prior Vijeo Designer versions V6.2 SP9 and prior Description The issue is related to the use of hard-coded credentials. Exploitation of this issue may allow a remote attacker to gain unauthorize...

The vulnerability of the Vijeo Designer Basic and Vijeo Designer software lies in errors during the validation of the paths for loading dynamic libraries. This allows a hacker to execute arbitrary code.

The vulnerability of the Vijeo Designer Basic and Vijeo Designer software lies in errors during the validation of the paths for loading dynamic libraries. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

Schneider Electric Vijeo Designer Basic and Vijeo Designer Code Issue Vulnerability

Schneider Electric Vijeo Designer Basic is a suite of programming and design software for HMIs Human Machine Interfaces from Schneider Electric, France. A code issue vulnerability exists in Schneider Electric Vijeo Designer Basic 1.1 HotFix 15 and earlier and Vijeo Designer 6.9 SP9 and earlier. T...

CVE-2020-7490

A CWE-426: Untrusted Search Path vulnerability exists in Vijeo Designer Basic V1.1 HotFix 15 and prior and Vijeo Designer V6.9 SP9 and prior, which could cause arbitrary code execution on the system running Vijeo Basic when a malicious DLL library is loaded by the Product...

CVE-2020-7490

A CWE-426: Untrusted Search Path vulnerability exists in Vijeo Designer Basic V1.1 HotFix 15 and prior and Vijeo Designer V6.9 SP9 and prior, which could cause arbitrary code execution on the system running Vijeo Basic when a malicious DLL library is loaded by the Product...

CVE-2020-7490

A CWE-426: Untrusted Search Path vulnerability exists in Vijeo Designer Basic V1.1 HotFix 15 and prior and Vijeo Designer V6.9 SP9 and prior, which could cause arbitrary code execution on the system running Vijeo Basic when a malicious DLL library is loaded by the Product...

CVE-2020-7490

Summary (CVE-2020-7490): The vulnerability is a CWE-426 Untrusted Search Path issue in Schneider Electric’s Vijeo Designer software. Affected products/versions include Vijeo Designer Basic (V1.1 HotFix 15 and prior) and Vijeo Designer (V6.9 SP9 and prior). The underlying issue is that loading a m...

CVE-2020-7490: Untrusted Search Path

A CWE-426: Untrusted Search Path vulnerability exists in Vijeo Designer Basic V1.1 HotFix 15 and prior and Vijeo Designer V6.9 SP9 and prior, which could cause arbitrary code execution on the system running Vijeo Basic when a malicious DLL library is loaded by the Product...

Design/Logic Flaw

Vulnerability in the Hyperion Financial Reporting product of Oracle Hyperion component: Web Based Report Designer. The supported version that is affected is 11.1.2.4. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Hyperion Financial...

CVE-2020-2769: Undefined Security Weakness

Vulnerability in the Hyperion Financial Reporting product of Oracle Hyperion component: Web Based Report Designer. The supported version that is affected is 11.1.2.4. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Hyperion Financial...