EUVD-2021-14229

Malware in sbrugna...

CVE-2021-27475: Deserialization of Untrusted Data

Rockwell Automation Connected Components Workbench v12.00.00 and prior does not limit the objects that can be deserialized. This vulnerability allows attackers to craft a malicious serialized object that, if opened by a local user in Connected Components Workbench, may result in remote code...

CVE-2021-27471: Improper Limitation of a Pathname to a Restricted Directory

The parsing mechanism that processes certain file types does not provide input sanitization for file paths. This may allow an attacker to craft malicious files that, when opened by Rockwell Automation Connected Components Workbench v12.00.00 and prior, can traverse the file system. If successfull...

CVE-2021-27473: Improper Limitation of a Pathname to a Restricted Directory

Rockwell Automation Connected Components Workbench v12.00.00 and prior does not sanitize paths specified within the .ccwarc archive file during extraction. This type of vulnerability is also commonly referred to as a Zip Slip. A local, authenticated attacker can create a malicious .ccwarc archive...

PT-2021-7290

Name of the Vulnerable Software and Affected Versions Rockwell Automation Connected Components Workbench versions prior to 12.00.00 Description The issue is related to the parsing mechanism of certain file types, which lacks input sanitization for file paths. This could allow an attacker to creat...

PT-2021-6479

Name of the Vulnerable Software and Affected Versions Rockwell Automation Connected Components Workbench version 12.00.00 and prior Description The issue is related to the deserialization of objects, which can be exploited by attackers to craft malicious objects. If a local user opens such an...

Rockwell Automation Connected Components Workbench RA.ViewElements.Grid.1 Arbitrary Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Rockwell Automation Connected Components Workbench. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific...

CVE-2014-5424: Undefined Security Weakness

Rockwell Automation Connected Components Workbench CCW before 7.00.00 allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via an invalid property value to an ActiveX control that was built with an outdated compiler...