CVE-2021-27473

CVE-2021-27473 affects Rockwell Automation Connected Components Workbench (CCW) v12.00.00 and earlier. The root cause is improper sanitization of paths inside .ccwarc archives during extraction (Zip Slip), enabling a local, authenticated attacker to craft a malicious archive that, when opened, co...

CVE-2021-27475: Deserialization of Untrusted Data

Rockwell Automation Connected Components Workbench v12.00.00 and prior does not limit the objects that can be deserialized. This vulnerability allows attackers to craft a malicious serialized object that, if opened by a local user in Connected Components Workbench, may result in remote code...

CVE-2021-27471: Improper Limitation of a Pathname to a Restricted Directory

The parsing mechanism that processes certain file types does not provide input sanitization for file paths. This may allow an attacker to craft malicious files that, when opened by Rockwell Automation Connected Components Workbench v12.00.00 and prior, can traverse the file system. If successfull...

CVE-2021-27473: Improper Limitation of a Pathname to a Restricted Directory

Rockwell Automation Connected Components Workbench v12.00.00 and prior does not sanitize paths specified within the .ccwarc archive file during extraction. This type of vulnerability is also commonly referred to as a Zip Slip. A local, authenticated attacker can create a malicious .ccwarc archive...

CVE-2020-25178

ISaGRAF Workbench communicates with Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x using TCP/IP. This communication protocol provides various file system operations, as well as the uploading of applications. Data is transferred over this protocol unencrypted, which could allow a remote...

Design/Logic Flaw

ISaGRAF Workbench communicates with Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x using TCP/IP. This communication protocol provides various file system operations, as well as the uploading of applications. Data is transferred over this protocol unencrypted, which could allow a remote...

CVE-2020-25178

ISaGRAF CVE-2020-25178 affects Rockwell Automation ISaGRAF Runtime 4.x/5.x when interfaced with ISaGRAF Workbench over TCP/IP. The protocol transmits data unencrypted, enabling a remote unauthenticated attacker to upload, read, and delete files. Affected product details and mitigations are suppor...

CVE-2020-25178: Cleartext Transmission of Sensitive Information

ISaGRAF Workbench communicates with Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x using TCP/IP. This communication protocol provides various file system operations, as well as the uploading of applications. Data is transferred over this protocol unencrypted, which could allow a remote...

PT-2022-4135

Name of the Vulnerable Software and Affected Versions Connected Components Workbench CCW affected versions not specified Safety Instrumented Systems Workstation SISW affected versions not specified ISaGRAF Workbench affected versions not specified Description The issue is related to an XML extern...

Rockwell (CVE-2017-5176) (deprecated)

This plugin has been deprecated as Rockwell Automation Connected Components Workbench is not supported. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. @DEPRECATED@ Disabled...

Oracle MySQL Workbench < 8.0.28 (Jan 2022)

The version of Oracle MySQL Workbench installed on the remote Windows host is prior to 8.0.28. It is, therefore, affected by a vulnerability in the MySQL Workbench product of Oracle MySQL component: Workbench: libssh. Supported versions that are affected are 8.0.27 and prior. Easily exploitable...

Vulnerabilities fixed in Oracle MySQL

Oracle has fixed vulnerabilities in the following products: MySQL Workbench MySQL Server MySQL Cluster MySQL Connectors The vulnerabilities potentially enable a malicious party to execute attacks that result in the following categories of damage: Denial-of-Service DoS Remote code execution...

Security Bulletin: Rational Test Workbench bundles Rational Performance Tester which is vulnerable to arbitrary code execution due to Apache Log4j (CVE-2021-44228)

Summary Rational Test Workbench RTW bundles Rational Performance Tester RPT. The Apache Log4j vulnerability impacts RPT Apache JMeter™ Test Extension. This bulletin addresses the vulnerability by removing Apache Log4j. Vulnerability Details CVEID: CVE-2021-44228 DESCRIPTION: Apache Log4j could...

Oracle MySQL Workbench < 8.0.27 Multiple Vulnerabilities (Oct 2021)

The version of Oracle MySQL Workbench installed on the remote Windows host is prior to 8.0.27. It is, therefore, affected by multiple vulnerabilities as referenced in the advisory. - Vulnerability in the MySQL Workbench product of Oracle MySQL component: MySQL Workbench OpenSSL. Supported version...

PT-2021-6880

Name of the Vulnerable Software and Affected Versions Connected Components Workbench versions 13.00.00 and prior ISaGRAF Workbench versions 6.0 through 6.6.9 Safety Instrumented System Workstation versions 1.2 and prior Description The issue is related to the deserialization of objects, which...

Vulnerabilities fixed in Oracle MySQL

Oracle has fixed vulnerabilities in the following MySQL products: MySQL Workbench MySQL Server MySQL Cluster MySQL Enterprise Monitor MySQL Connectors The vulnerabilities potentially enable a malicious party to execute attacks that result in the following categories of damage: Denial-of-Service D...

Oracle MySQL Enterprise Monitor (Oct 2021 CPU)

The 8.0.25 versions of MySQL Enterprise Monitor installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2021 CPU advisory. - Vulnerability in the MySQL Enterprise Monitor product of Oracle MySQL component: Monitoring: General Spring Security. Supported...

Rockwellautomation Rslinx Improper Input Validation

FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ControlFLASH: Version 14 and later, ControlFLASH Plus: Version 1 and later, FactoryTalk Asset Centre: Version 9 and later, FactoryTalk Linx CommDTM: Version 1 an...

Oracle MySQL Workbench < 8.0.23 Multiple Vulnerabilities (Jan 2021)

The version of Oracle MySQL Workbench installed on the remote Windows host is prior to 8.0.23. It is, therefore, affected by multiple vulnerabilities as referenced in the advisory. - SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window...

PT-2021-7838

Name of the Vulnerable Software and Affected Versions ISaGRAF Workbench versions 4.x through 5.x Description The issue is related to the communication protocol used by ISaGRAF Workbench to interact with Rockwell Automation ISaGRAF Runtime. This protocol, which operates over TCP/IP, allows for...