CVE-2020-24678

An authenticated user might execute malicious code under the user context and take control of the system. S+ Operations or S+ Historian database is affected by multiple vulnerabilities such as the possibility to allow remote authenticated users to gain high privileges...

CVE-2020-24679

A S+ Operations and S+ Historian service is subject to a DoS by special crafted messages. An attacker might use this flaw to make it crash or even execute arbitrary code on the machine where the service is hosted...

CVE-2020-24676

In Symphony Plus Operations and Symphony Plus Historian, some services can be vulnerable to privilege escalation attacks. An unprivileged but authenticated user could execute arbitrary code and result in privilege escalation, depending on the user that the service runs as...

CVE-2020-24677

Vulnerabilities in the S+ Operations and S+ Historian web applications can lead to a possible code execution and privilege escalation, redirect the user somewhere else or download unwanted data...

Command injection

In S+ Operations and S+ Historian, not all client commands correctly check user permission as expected. Authenticated but Unauthorized remote users could execute a Denial-of-Service DoS attack, execute arbitrary code, or obtain more privilege than intended on the machines...

Design/Logic Flaw

In S+ Operations and S+ Historian, the passwords of internal users not Windows Users are encrypted but improperly stored in a database...

Sql injection

In S+ Operations and S+ Historian, a successful SQL injection exploit can read sensitive data from the database, modify database data Insert/Update/Delete, execute administration operations on the database such as shutdown the DBMS, recover the content of a given file present on the DBMS file...

CVE-2020-24673

CVE-2020-24673 affects S+ Operations and S+ Historian. The vulnerability is a SQL injection that can allow an attacker to read sensitive data, modify data (Insert/Update/Delete), perform database administration operations (e.g., shutdown the DBMS), recover files from the DBMS file system, and pot...

CVE-2020-24674

CVE-2020-24674 affects S+ Operations and S+ Historian. The issue is improper authorization where not all client commands properly enforce user permissions. Authenticated but Unauthorized remote users could trigger a Denial-of-Service, execute arbitrary code, or gain higher privileges on affected ...

CVE-2020-24674 Improper Authorization in Symphony Plus

In S+ Operations and S+ Historian, not all client commands correctly check user permission as expected. Authenticated but Unauthorized remote users could execute a Denial-of-Service DoS attack, execute arbitrary code, or obtain more privilege than intended on the machines...

CVE-2020-24680 Improper Credential Storage in Symphony Plus

In S+ Operations and S+ Historian, the passwords of internal users not Windows Users are encrypted but improperly stored in a database...

CVE-2020-24680

CVE-2020-24680 affects S+ Operations and S+ Historian. The issue is that internal-user passwords are encrypted but stored in a database inappropriately, enabling local access to sensitive credentials. CVSSv3.1 base score is 7.0 (HIGH) with Confidentiality, Integrity, and Availability impacts; att...

CVE-2020-24679

CVE-2020-24679 concerns the S+ Operations and S+ Historian service. Public sources describe a DoS with specially crafted messages that can crash the service and, in some wording, may allow arbitrary code execution on the host. The NVD entry lists impact including high confidentiality, integrity, ...

CVE-2020-24677

Technical details (affected products, vulnerable components, exact root cause, versions, exploitability) are not provided in the supplied documents. Monitor for updates from NVD/ABB and EU sources for concrete advisories.

CVE-2020-24677 Insecure Web Service in Symphony Plus

Vulnerabilities in the S+ Operations and S+ Historian web applications can lead to a possible code execution and privilege escalation, redirect the user somewhere else or download unwanted data...

CVE-2020-24676

The CVE-2020-24676 entry affects Symphony Plus Operations and Symphony Plus Historian : unprivileged but authenticated users can leverage vulnerable services to achieve arbitrary code execution with privilege escalation, depending on the account the service runs under. The documented impact is pr...

CVE-2020-24678

CVE-2020-24678 affects S+ Operations or S+ Historian database. An authenticated user may execute malicious code under their user context and escalate privileges to take control of the system. Public details from NVD indicate CVSSv3.1 base score 8.8 (HIGH) with NETWORK attack vector, LOW attack co...

ABB Symphony Plus Operations and ABB Symphony Plus Historian Authorization Issues Vulnerability

ABB Symphony Plus Operations and ABB Symphony Plus Historian are both products of ABB Switzerland.ABB Symphony Plus Operations is a management device used in industrial environments to improve operational efficiency. The device provides an easy-to-use human-machine interface that seamlessly...

ABB Symphony Plus Operations and ABB Symphony Plus Historian Authorization Issues Vulnerability

ABB Symphony Plus Operations and ABB Symphony Plus Historian are both products of ABB Switzerland.ABB Symphony Plus Operations is a management device used in industrial environments to improve operational efficiency. The device provides an easy-to-use human-machine interface that seamlessly...

ABB Symphony Plus Operations and ABB Symphony Plus Historian Authorization Issues Vulnerability

ABB Symphony Plus Operations and ABB Symphony Plus Historian are both products of ABB Switzerland.ABB Symphony Plus Operations is a management device used in industrial environments to improve operational efficiency. The device provides an easy-to-use human-machine interface that seamlessly...