CVE-2024-21915 Rockwell Automation FactoryTalk® Service Platform Elevated Privileges Vulnerability Through Web Service Functionality

A privilege escalation vulnerability exists in Rockwell Automation FactoryTalk® Service Platform FTSP. If exploited, a malicious user with basic user group privileges could potentially sign into the software and receive FTSP Administrator Group privileges. A threat actor could potentially read an...

CVE-2024-21915: Incorrect Permission Assignment for Critical Resource

A privilege escalation vulnerability exists in Rockwell Automation FactoryTalk® Service Platform FTSP. If exploited, a malicious user with basic user group privileges could potentially sign into the software and receive FTSP Administrator Group privileges. A threat actor could potentially read an...

Vulnerability fixed in Rockwell Automation FactoryTalk Service Platform

Rockwell Automation has fixed a vulnerability in FactoryTalk Service Platform FTSP. An authenticated malicious party could exploit the exploit the vulnerability to grant themselves elevated privileges and gain access to FTSP as an Administrator. For successful misuse, the malicious party must hav...

Rockwell Automation FactoryTalk Service Platform

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 9.0 ATTENTION : Exploitable remotely Vendor : Rockwell Automation Equipment : FactoryTalk Service Platform Vulnerability : Incorrect Execution-Assigned Permissions 2. RISK EVALUATION Successful exploitation of this vulnerability could allow malicious users...

PT-2024-1821 · Rockwell Automation · Rockwell Automation Factorytalk Service Platform

Name of the Vulnerable Software and Affected Versions: Rockwell Automation FactoryTalk Service Platform FTSP affected versions not specified Description: A privilege escalation vulnerability exists in the software. If exploited, a malicious user with basic user group privileges could potentially...

Vulnerability fixed in Rockwell Automation FactoryTalk

Rockwell Automation has fixed a vulnerability in FactoryTalk Service Platform. A malicious party could exploit the vulnerability to obtain the Service Token to gain unauthorized access gain unauthorized access to other FactoryTalk systems connected to the infrastructure. Once gained access, the...

CVE-2024-21917

A vulnerability exists in Rockwell Automation FactoryTalk® Service Platform that allows a malicious user to obtain the service token and use it for authentication on another FTSP directory. This is due to the lack of digital signing between the FTSP service token and directory. If exploited, a...

CVE-2024-21917

A vulnerability exists in Rockwell Automation FactoryTalk® Service Platform that allows a malicious user to obtain the service token and use it for authentication on another FTSP directory. This is due to the lack of digital signing between the FTSP service token and directory. If exploited, a...

CVE-2024-21917

A vulnerability exists in Rockwell Automation FactoryTalk® Service Platform that allows a malicious user to obtain the service token and use it for authentication on another FTSP directory. This is due to the lack of digital signing between the FTSP service token and directory. If exploited, a...

Authentication flaw

A vulnerability exists in Rockwell Automation FactoryTalk® Service Platform that allows a malicious user to obtain the service token and use it for authentication on another FTSP directory. This is due to the lack of digital signing between the FTSP service token and directory. If exploited, a...

CVE-2024-21917 Rockwell Automation FactoryTalk® Service Platform Service Token Vulnerability

A vulnerability exists in Rockwell Automation FactoryTalk® Service Platform that allows a malicious user to obtain the service token and use it for authentication on another FTSP directory. This is due to the lack of digital signing between the FTSP service token and directory. If exploited, a...

CVE-2024-21917 Rockwell Automation FactoryTalk® Service Platform Service Token Vulnerability

A vulnerability exists in Rockwell Automation FactoryTalk® Service Platform that allows a malicious user to obtain the service token and use it for authentication on another FTSP directory. This is due to the lack of digital signing between the FTSP service token and directory. If exploited, a...

CVE-2024-21917

CVE-2024-21917 affects Rockwell Automation’s FactoryTalk Service Platform. The root cause is improper verification of cryptographic signatures: FTSP service tokens are not digitally signed against the target directory, enabling a malicious user to obtain a service token and use it for authenticat...

CVE-2024-21917: Improper Verification of Cryptographic Signature

A vulnerability exists in Rockwell Automation FactoryTalk® Service Platform that allows a malicious user to obtain the service token and use it for authentication on another FTSP directory. This is due to the lack of digital signing between the FTSP service token and directory. If exploited, a...

Rockwell Automation FactoryTalk Service Platform

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION : Exploitable remotely/low attack complexity Vendor : Rockwell Automation Equipment : FactoryTalk Service Platform Vulnerability : Improper Verification of Cryptographic Signature 2. RISK EVALUATION Successful exploitation of this vulnerability...

CVE-2023-50609: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability in AVA teaching video application service platform version 3.1, allows remote attackers to execute arbitrary code via a crafted script to ajax.aspx...

PT-2024-13946

Name of the Vulnerable Software and Affected Versions AVA teaching video application service platform version 3.1 Description The issue allows remote attackers to execute arbitrary code via a crafted script to the "ajax.aspx" endpoint. This is a Cross Site Scripting XSS vulnerability, which enabl...

Tencent Search Live Help has Janus Android Signature Vulnerability

Tencent search live help is professional skills online simply service platform. Tencent search live help exist Janus Android signature vulnerability, attackers can use the vulnerability to obtain system root privileges...

Command Execution Vulnerability in User Self-Service Platform of Xinhua San Technologies Co.

Xinhua San Technology Co., Ltd. is committed to becoming a trusted partner for customers' business innovation and digital transformation. A command execution vulnerability exists in the user self-service platform of Xinhua San Technologies Co. An attacker can exploit this vulnerability to gain...

SQL Injection Vulnerability in Public Service Platform for Tenders and Bids

China Bidding Public Service Platform Co., Ltd. in the National Development and Reform Commission under the guidance and promotion of the China Bidding and Tendering Association, led by eight enterprises jointly invested in the establishment of public service enterprises. There is a SQL injection...