Design/Logic Flaw

Insertion of Sensitive Information into Log File vulnerability in ABB QCS 800xA, ABB QCS AC450, ABB Platform Engineering Tools. An attacker, who already has local access to the QCS nodes, could successfully obtain the password for a system user account. Using this information, the attacker could...

CVE-2022-0010 QCS 800xA Vulnerability identified in system log files

Insertion of Sensitive Information into Log File vulnerability in ABB QCS 800xA, ABB QCS AC450, ABB Platform Engineering Tools. An attacker, who already has local access to the QCS nodes, could successfully obtain the password for a system user account. Using this information, the attacker could...

CVE-2022-0010

Summary: CVE-2022-0010 affects ABB QCS 800xA, ABB QCS AC450, and ABB Platform Engineering Tools due to insertion of sensitive information into log files. An attacker with local access to QCS nodes could obtain a system user password and potentially take control of nodes. Affected versions: QCS 80...

PT-2023-9780 · Abb · Abb Platform Engineering Tools +2

Name of the Vulnerable Software and Affected Versions: ABB QCS 800xA versions 1.0;0 through 6.1SP2 ABB QCS AC450 versions 1.0;0 through 5.1SP2 ABB Platform Engineering Tools versions 1.0:0 through 2.3.0 Description: The issue is related to the insertion of sensitive information into log files in...

CVE-2022-0010: Insertion of Sensitive Information into Log File

Insertion of Sensitive Information into Log File vulnerability in ABB QCS 800xA, ABB QCS AC450, ABB Platform Engineering Tools. An attacker, who already has local access to the QCS nodes, could successfully obtain the password for a system user account. Using this information, the attacker could...

eBankIT 6 Arbitrary OTP Generation

CVE-2023-33291 Description In eBankIT 6, the public endpoints /public/token/Email/generate and /public/token/SMS/generate allow generation of OTP messages to any email address or phone number without validation. ------------------------------------------ Additional Information The cookies in the...

ABB多款产品日志信息泄露漏洞

ABB QCS and ABB Platform Engineering Tools are both products of ABB Switzerland.ABB QCS is a family of quality control systems.ABB Platform Engineering Tools is a platform tool. A security vulnerability exists in several ABB products, which can be exploited by an attacker who already has local...

Cyber Signals: Shifting tactics fuel surge in business email compromise

Today we released the fourth edition of Cyber Signals highlighting a surge in cybercriminal activity around business email compromise BEC. Microsoft has observed a 38 percent increase in cybercrime as a service CaaS targeting business email between 2019 and 2022.1 Successful BEC attacks cost...

OilAlpha: Emerging Houthi-linked Cyber Threat Targets Arabian Android Users

A hacking group dubbed OilAlpha with suspected ties to Yemen's Houthi movement has been linked to a cyber espionage campaign targeting development, humanitarian, media, and non-governmental organizations in the Arabian peninsula. "OilAlpha used encrypted chat messengers like WhatsApp to launch...

Authentication flaw

The OTP Login Woocommerce & Gravity Forms plugin for WordPress is vulnerable to authentication bypass. This is due to the fact that when generating OTP codes for users to use in order to login via phone number, the plugin returns these codes in an AJAX response. This makes it possible for...

CVE-2023-2706 OTP Login Woocommerce & Gravity Forms <= 2.2 - Authentication Bypass to Privilege Escalation

The OTP Login Woocommerce & Gravity Forms plugin for WordPress is vulnerable to authentication bypass. This is due to the fact that when generating OTP codes for users to use in order to login via phone number, the plugin returns these codes in an AJAX response. This makes it possible for...

Malicious code in next2ejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx a38f3ed2458e9188f19672ebadf7f1bf9aae21e644c654fb82d93cc4b55abed0 Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...

MAL-2023-622 Malicious code in next2ejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx a38f3ed2458e9188f19672ebadf7f1bf9aae21e644c654fb82d93cc4b55abed0 Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...

Schweitzer Engineering Laboratories RTAC Cross-site Scripting (CVE-2023-31160)

An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller SEL RTAC Web Interface could allow a remote authenticated attacker to inject and execute arbitrary script code. See SEL...

Schweitzer Engineering Laboratories RTAC Cross-site Scripting (CVE-2023-31159)

An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller SEL RTAC Web Interface could allow a remote authenticated attacker to inject and execute arbitrary script code. See SEL...

MAL-2023-950 Malicious code in vue2ejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 471c4327f895aee34fd25c781189cda3025f1a3d22c0bba59cd767f95a277194 Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...

Rockwell Automation FactoryTalk Vantagepoint

1. EXECUTIVE SUMMARY CVSS v3 7.1 ATTENTION: Exploitable remotely Vendor: Rockwell Automation Equipment: FactoryTalk Vantagepoint Vulnerabilities: Insufficient Verification of Data Authenticity 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to impersonate...

Jenkins WSO2 Oauth Plugin Session Fixation vulnerability

Jenkins WSO2 Oauth Plugin 1.0 and earlier does not invalidate the existing session on login. This allows attackers to use social engineering techniques to gain administrator access to Jenkins. As of publication of this advisory, there is no fix...

Jenkins CAS Plugin Session Fixation vulnerability

Jenkins CAS Plugin 1.6.2 and earlier does not invalidate the existing session on login. This allows attackers to use social engineering techniques to gain administrator access to Jenkins. CAS Plugin 1.6.3 invalidates the existing session on login...

GHSA-XXQ2-74HW-VG6M Jenkins WSO2 Oauth Plugin Session Fixation vulnerability

Jenkins WSO2 Oauth Plugin 1.0 and earlier does not invalidate the existing session on login. This allows attackers to use social engineering techniques to gain administrator access to Jenkins. As of publication of this advisory, there is no fix...