Authentication flaw

ABB eSOMS versions 4.0 to 6.0.3 use ASP.NET Viewstate without Message Authentication Code MAC. Alterations to Viewstate might thus not be noticed...

CVE-2019-19002

For ABB eSOMS versions 4.0 to 6.0.2, the X-XSS-Protection HTTP response header is not set in responses from the web server. For older web browser not supporting Content Security Policy, this might increase the risk of Cross Site Scripting...

Design/Logic Flaw

For ABB eSOMS versions 4.0 to 6.0.3, HTTPS responses contain comments with sensitive information about the application. An attacker might use this detail information to specifically craft the attack...

Authentication flaw

For ABB eSOMS versions 4.0 to 6.0.2, the X-Frame-Options header is not configured in HTTP response. This can potentially allow 'ClickJacking' attacks where an attacker can frame parts of the application on a malicious web site, revealing sensitive user information such as authentication credentia...

Command injection

The Redis data structure component used in ABB eSOMS versions 6.0 to 6.0.2 stores credentials in clear text. If an attacker has file system access, this can potentially compromise the credentials' confidentiality...

Cross site scripting

For ABB eSOMS versions 4.0 to 6.0.2, the X-XSS-Protection HTTP response header is not set in responses from the web server. For older web browser not supporting Content Security Policy, this might increase the risk of Cross Site Scripting...

Cross site scripting

For ABB eSOMS versions 4.0 to 6.0.2, the HTTPOnly flag is not set. This can allow Javascript to access the cookie contents, which in turn might enable Cross Site Scripting...

Cross site scripting

Lack of adequate input/output validation for ABB eSOMS versions 4.0 to 6.0.2 might allow an attacker to attack such as stored cross-site scripting by storing malicious content in the database...

Design/Logic Flaw

For ABB eSOMS versions 4.0 to 6.0.2, the Secure Flag is not set in the HTTP response header. Unencrypted connections might access the cookie information, thus making it susceptible to eavesdropping...

CVE-2019-19002

ABB eSOMS CVE-2019-19002 affects versions 4.0–6.0.2 where the X-XSS-Protection header is not set in web server responses, potentially enabling cross-site scripting on older browsers without CSP support. Connected documents also describe related issues in the same ABB eSOMS family and correlate th...

CVE-2019-19002 ABB eSOMS X-XSS-Protection not enabled

For ABB eSOMS versions 4.0 to 6.0.2, the X-XSS-Protection HTTP response header is not set in responses from the web server. For older web browser not supporting Content Security Policy, this might increase the risk of Cross Site Scripting...

CVE-2019-19001

ABB eSOMS is affected by CVE-2019-19001 due to the absence of the X-Frame-Options header in HTTP responses for versions 4.0 to 6.0.2. This can enable ClickJacking by framing parts of the application on a malicious site, potentially exposing sensitive user credentials. Root cause: HTTP responses l...

CVE-2019-19000 eSOMS Cachecontrol (Pragma) HTTP Header

For ABB eSOMS 4.0 to 6.0.3, the Cache-Control and Pragma HTTP headers have not been properly configured within the application response. This can potentially allow browsers and proxies to cache sensitive information...

CVE-2019-19000

ABB eSOMS versions 4.0–6.0.3 are affected by CVE-2019-19000 due to improper configuration of Cache-Control and Pragma HTTP headers in application responses, which can allow browsers/proxies to cache sensitive information. The issue is documented in multiple sources (NVD entry for CVE-2019-19000 a...

CVE-2019-19097 ABB eSOMS: SSL medium strength Cipher Suites

ABB eSOMS versions 4.0 to 6.0.3 accept connections using medium strength ciphers. If a connection is enabled using such a cipher, an attacker might be able to eavesdrop and/or intercept the connection...

CVE-2019-19097

CVE-2019-19097 affects ABB eSOMS 4.0–6.0.3, where the product accepts connections using medium-strength ciphers, enabling potential eavesdropping or interception of traffic. Connected documents corroborate this cipher-related weakness and list eSOMS versions affected. Remediation recommended by s...

CVE-2019-19096 ABB eSOMS: REDIS clear text credentials

The Redis data structure component used in ABB eSOMS versions 6.0 to 6.0.2 stores credentials in clear text. If an attacker has file system access, this can potentially compromise the credentials' confidentiality...

CVE-2019-19096

ABB eSOMS CVE-2019-19096 affects Redis data structure component in ABB eSOMS versions 6.0–6.0.2, which stores credentials in clear text. The underlying issue is cleartext credential storage, exploitable if an attacker has local file-system access. The CVSSv3 base score is 6.1 (MEDIUM). Remediatio...

CVE-2019-19095 ABB eSOMS: Stored XSS vulnerability

Lack of adequate input/output validation for ABB eSOMS versions 4.0 to 6.0.2 might allow an attacker to attack such as stored cross-site scripting by storing malicious content in the database...

CVE-2019-19095

CVE-2019-19095 affects ABB eSOMS versions 4.0–6.0.2. The vulnerability stems from lack of adequate input/output validation, which can enable stored cross-site scripting by storing malicious content in the database. The Red Hat/Red Hat-adjacent and CVE lists corroborate this family of XSS-related ...