CVE-2019-19107

The Configuration pages in ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway for user profiles and services transfer the password in plaintext although hidden when displayed...

CVE-2019-19104

The web server in ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway allows access to different endpoints of the application without authenticating by accessing a specific uniform resource locator URL , violating the access-control ACL rules. This issue allows obtaining...

Design/Logic Flaw

Weak Registry permissions in ABB System 800xA Base allow low privileged users to read and modify registry settings related to control system functionality, allowing an authenticated attacker to cause system functions to stop or malfunction...

Privilege escalation

The web server in ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway allows access to different endpoints of the application without authenticating by accessing a specific uniform resource locator URL , violating the access-control ACL rules. This issue allows obtaining...

Improper access control

Improper implementation of Access Control in ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway allows an unauthorized user to access data marked as restricted, such as viewing or editing user profiles and application settings...

Design/Logic Flaw

The Configuration pages in ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway for user profiles and services transfer the password in plaintext although hidden when displayed...

Design/Logic Flaw

The backup function in ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway saves the current settings and configuration of the application, including credentials of existing user accounts and other configuration's credentials in plaintext...

Cross site scripting

The installations for ABB System 800xA Information Manager versions 5.1, 6.0 to 6.0.3.2 and 6.1 wrongly contain an auxiliary component. An attacker is able to use this for an XSS-like attack to an authenticated local user, which might lead to execution of arbitrary code...

CVE-2020-8477 ABB System 800xA Information Manager Remote Code Execution

The installations for ABB System 800xA Information Manager versions 5.1, 6.0 to 6.0.3.2 and 6.1 wrongly contain an auxiliary component. An attacker is able to use this for an XSS-like attack to an authenticated local user, which might lead to execution of arbitrary code...

CVE-2020-8477

CVE-2020-8477 affects ABB System 800xA Information Manager (versions 5.1, 6.0–6.0.3.2, and 6.1). The flaw is in an auxiliary component incorporated into installations, enabling an XSS-like attack that could lead to arbitrary code execution on an authenticated local user. Technical details from mu...

CVE-2019-19107

CVE-2019-19107 affects ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway. Connected records describe that configuration pages for user profiles and services transfer the password in plaintext (hidden in the UI) during access, constituting an information-disclosure issue. Mul...

CVE-2019-19106 ABB/Busch-Jaeger Telephone Gateway TG/S 3.2 Access Control issues

Improper implementation of Access Control in ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway allows an unauthorized user to access data marked as restricted, such as viewing or editing user profiles and application settings...

CVE-2019-19106

The CVE-2019-19106 entry describes an improper access control vulnerability affecting the ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway. The issue allows an unauthorized user to access data marked as restricted, including viewing or editing user profiles and application ...

CVE-2019-19105

CVE-2019-19105 affects ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway. The backup feature stores the application’s current settings and credentials (including user accounts and other configuration credentials) in plaintext, exposing confidentiality. Exploitation details a...

CVE-2019-19105 ABB/Busch-Jaeger Telephone Gateway TG/S 3.2 Plaintext storing of credentials

The backup function in ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway saves the current settings and configuration of the application, including credentials of existing user accounts and other configuration's credentials in plaintext...

CVE-2019-19104 ABB/Busch-Jaeger Telephone Gateway TG/S 3.2 Improper Authentication and Access Control

The web server in ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway allows access to different endpoints of the application without authenticating by accessing a specific uniform resource locator URL , violating the access-control ACL rules. This issue allows obtaining...

CVE-2019-19104

CVE-2019-19104 affects ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway. The web server allows anonymous access to multiple endpoints by requesting a specific URL, violating ACL rules and potentially exposing sensitive data and enabling privilege escalation. The CVSS metric...

CVE-2020-8474 ABB System 800xA Weak Registry Permissions

Weak Registry permissions in ABB System 800xA Base allow low privileged users to read and modify registry settings related to control system functionality, allowing an authenticated attacker to cause system functions to stop or malfunction...

CVE-2020-8474

CVE-2020-8474 concerns ABB System 800xA Base, where an incorrect permission assignment allows low-privilege users to read/modify registry settings that control system functionality. The vulnerability can be exploited by an authenticated user with local access to cause system functions to stop or ...

abb-holz.de Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1146632 Security Researcher Hchabik Helped patch 2357 vulnerabilities Received 5 Coordinated Disclosure badges Received 2 recommendations , a holder of 5 badges for responsible and coordinated disclosure, found a security vulnerability affecting abb-holz.de website and its...