Rockwell Automation FactoryTalk Activation Local Elevation of Privilege Vulnerability

Rockwell Automation is a solutions provider for industrial automation, control and information technology. A local elevation of privilege vulnerability exists in Rockwell Automation FactoryTalk Activation. A local attacker can exploit the vulnerability to execute arbitrary code with SYSTEM...

Rockwell Automation FactoryTalk Activation

CVSS v3 8.8 REPOSTED INFORMATION This advisory was originally posted to the NCCIC Portal on February 16, 2017, and is being released to the ICS-CERT web site. AFFECTED PRODUCTS The following versions of FactoryTalk Activation, a component of FactoryTalk Services Platform, are affected: FactoryTal...

Rockwell Automation FactoryTalk EnergyMetrix Elevation of Privilege Vulnerability

Rockwell Automation FactoryTalk EnergyMetrix is a Web-based software management package for capturing, analyzing, storing and sharing energy data from Rockwell Automation. A security vulnerability exists in Rockwell Automation FactoryTalk EnergyMetrix versions prior to 2.20.00, which can be...

CVE-2016-4531

Rockwell Automation FactoryTalk EnergyMetrix before 2.20.00 does not invalidate credentials upon a logout action, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation...

CVE-2016-4522

SQL injection vulnerability in Rockwell Automation FactoryTalk EnergyMetrix before 2.20.00 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2016-4522

SQL injection vulnerability in Rockwell Automation FactoryTalk EnergyMetrix before 2.20.00 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

Design/Logic Flaw

Rockwell Automation FactoryTalk EnergyMetrix before 2.20.00 does not invalidate credentials upon a logout action, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation...

Sql injection

SQL injection vulnerability in Rockwell Automation FactoryTalk EnergyMetrix before 2.20.00 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

EUVD-2016-5518

Rockwell Automation FactoryTalk EnergyMetrix before 2.20.00 does not invalidate credentials upon a logout action, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation...

CVE-2016-4522

SQL injection vulnerability in Rockwell Automation FactoryTalk EnergyMetrix before 2.20.00 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2016-4522

Rockwell Automation FactoryTalk EnergyMetrix (web-based energy data management) is affected by a SQL Injection vulnerability (CVE-2016-4522) in versions prior to 2.20.00. An unauthenticated, remote attacker could execute arbitrary SQL commands via unspecified vectors. Mitigation: upgrade to Energ...

CVE-2016-4531

Rockwell Automation FactoryTalk EnergyMetrix before 2.20.00 does not invalidate credentials upon a logout action, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation...

CVE-2016-4531

Rockwell Automation FactoryTalk EnergyMetrix before 2.20.00 does not invalidate credentials upon logout, enabling potential reuse of active sessions by an unattended workstation (CWE-613). Affected product: FactoryTalk EnergyMetrix web application; root cause: insufficient session expiration. CVS...

Rockwell Automation FactoryTalk EnergyMetrix SQL Injection Vulnerability

Rockwell Automation FactoryTalk EnergyMetrix is a Web-based software management package for capturing, analyzing, storing and sharing energy data from Rockwell Automation. A SQL injection vulnerability exists in Rockwell Automation FactoryTalk EnergyMetrix versions prior to 2.20.00. A remote...

CVE-2016-4531: Improper Authorization

Rockwell Automation FactoryTalk EnergyMetrix before 2.20.00 does not invalidate credentials upon a logout action, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation...

CVE-2016-4522: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Rockwell Automation FactoryTalk EnergyMetrix before 2.20.00 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

PT-2016-6005

Name of the Vulnerable Software and Affected Versions Rockwell Automation FactoryTalk EnergyMetrix versions prior to 2.20.00 Description The issue allows remote attackers to gain access by exploiting an unattended workstation, as credentials are not invalidated upon logout. Recommendations For...

PT-2016-6000

Name of the Vulnerable Software and Affected Versions Rockwell Automation FactoryTalk EnergyMetrix versions prior to 2.20.00 Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands. Recommendations For versions prior to 2.20.00, update to version 2.20.00 or lat...

CVE-2014-9209

Untrusted search path vulnerability in the Clean Utility application in Rockwell Automation FactoryTalk Services Platform before 2.71.00 and FactoryTalk View Studio 8.00.00 and earlier allows local users to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2014-9209

Untrusted search path vulnerability in the Clean Utility application in Rockwell Automation FactoryTalk Services Platform before 2.71.00 and FactoryTalk View Studio 8.00.00 and earlier allows local users to gain privileges via a Trojan horse DLL in an unspecified directory...