CVE-2020-24673: Improper Neutralization of Special Elements used in an SQL Command

In S+ Operations and S+ Historian, a successful SQL injection exploit can read sensitive data from the database, modify database data Insert/Update/Delete, execute administration operations on the database such as shutdown the DBMS, recover the content of a given file present on the DBMS file...

CVE-2020-24680: Insufficiently Protected Credentials

In S+ Operations and S+ Historian, the passwords of internal users not Windows Users are encrypted but improperly stored in a database...

CVE-2020-24678: Improper Privilege Management

An authenticated user might execute malicious code under the user context and take control of the system. S+ Operations or S+ Historian database is affected by multiple vulnerabilities such as the possibility to allow remote authenticated users to gain high privileges...

PT-2020-15803

Name of the Vulnerable Software and Affected Versions S+ Operations and S+ Historian affected versions not specified Description The issue affects the S+ Operations and S+ Historian web applications, potentially leading to code execution and privilege escalation. It can also redirect users to oth...

CVE-2020-24679: Improper Input Validation

A S+ Operations and S+ Historian service is subject to a DoS by special crafted messages. An attacker might use this flaw to make it crash or even execute arbitrary code on the machine where the service is hosted...

PT-2020-15807

Name of the Vulnerable Software and Affected Versions S+ Operations versions 2.1 SP1 and earlier Description The issue concerns the use of client-side authentication in the affected versions, which is less secure than server-side validation. This allows unauthorized actors to bypass authenticatio...

PT-2020-15804

Name of the Vulnerable Software and Affected Versions S+ Operations versions affected versions not specified S+ Historian database versions affected versions not specified Description An authenticated user might execute malicious code under the user context and take control of the system. The S+...

PT-2020-15800

Name of the Vulnerable Software and Affected Versions S+ Operations and S+ Historian affected versions not specified Description The issue arises from inadequate user permission checks for certain client commands. As a result, authenticated but unauthorized remote users could potentially execute ...

PT-2020-15805

Name of the Vulnerable Software and Affected Versions S+ Operations and S+ Historian affected versions not specified Description The S+ Operations and S+ Historian service is susceptible to a Denial of Service DoS attack via specially crafted messages. An attacker could exploit this flaw to cause...

PT-2020-15801

Name of the Vulnerable Software and Affected Versions S+ Operations and S+ History affected versions not specified Description The issue allows an unauthenticated user to inject values to the Operations History server or a standalone S+ History server, potentially writing values to the controlled...

PT-2020-15799

Name of the Vulnerable Software and Affected Versions S+ Operations and S+ Historian affected versions not specified Description A successful SQL injection exploit can read sensitive data from the database, modify database data Insert/Update/Delete, execute administration operations on the databa...

CVE-2020-8481 ABB Central Licensing System - Information disclosure

For ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0, 1.1 and 2.0, Symphony Plus -S+ Operations 3.0 to 3.2 Symphony Plus -S+ Engineering 1.1 to 2.2, Composer Harmony 5.1, 6.0 and 6.1, Melody...

CVE-2020-8471

CVE-2020-8471 affects ABB Central Licensing System (CLS) across multiple ABB products (800xA, Compact HMI, Symphony Plus, Harmony/Melody components, Knowledge Manager, etc.). The root issue is weak file permissions on the CLS, allowing an authenticated attacker to block license handling, escalate...

CVE-2020-8481: Exposure of Sensitive Information to an Unauthorized Actor

For ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0, 1.1 and 2.0, Symphony Plus -S+ Operations 3.0 to 3.2 Symphony Plus -S+ Engineering 1.1 to 2.2, Composer Harmony 5.1, 6.0 and 6.1, Melody...

PT-2020-20165

Name of the Vulnerable Software and Affected Versions ABB Ability System 800xA versions 5.1 through 6.1 Compact HMI versions 5.1 through 6.0 Control Builder Safe versions 1.0 through 2.0 Symphony Plus -S+ Operations versions 3.0 through 3.2 Symphony Plus -S+ Engineering versions 1.1 through 2.2...