CVE-2019-19094 ABB eSOMS: SQL injection vulnerability

Lack of input checks for SQL queries in ABB eSOMS versions 3.9 to 6.0.3 might allow an attacker SQL injection attacks against the backend database...

CVE-2019-19094

CVE-2019-19094 affects ABB eSOMS versions 3.9 to 6.0.3 and is caused by lack of input validation for SQL queries in the backend, enabling potential SQL injection. The vulnerability has a high CVSS v3.1 base score of 7.6 (network, low attack complexity, privileges required: low; confidentiality im...

CVE-2019-19093 ABB eSOMS: Password complexity issue

eSOMS versions 4.0 to 6.0.3 do not enforce password complexity settings, potentially resulting in lower access security due to insecure user passwords...

CVE-2019-19092 ABB eSOMS: Viewstate without MAC Signature

ABB eSOMS versions 4.0 to 6.0.3 use ASP.NET Viewstate without Message Authentication Code MAC. Alterations to Viewstate might thus not be noticed...

CVE-2019-19092

CVE-2019-19092 affects ABB eSOMS versions 4.0 to 6.0.3, where the ASP.NET Viewstate is used without a MAC, allowing alterations to go unnoticed. The Red Hat, NVD, CVE lists consistently describe this external-state data issue; ENISA/EUVD entries also reference related ABB eSOMS risks. Public deta...

CVE-2019-19091

ABB eSOMS, versions 4.0–6.0.3, is affected by CVE-2019-19091 where HTTPS responses leak comments containing sensitive application information. Root cause: information disclosure in HTTP responses that may enable targeted attacks. Documented impact: partial disclosure of confidential data; no expl...

CVE-2019-19091 ABB eSOMS: HTTP response information leakage

For ABB eSOMS versions 4.0 to 6.0.3, HTTPS responses contain comments with sensitive information about the application. An attacker might use this detail information to specifically craft the attack...

CVE-2019-19090 ABB eSOMS: Secure Flag not set

For ABB eSOMS versions 4.0 to 6.0.2, the Secure Flag is not set in the HTTP response header. Unencrypted connections might access the cookie information, thus making it susceptible to eavesdropping...

CVE-2019-19090

CVE-2019-19090 affects ABB eSOMS 4.0–6.0.2 where the Secure flag is not set in HTTP response headers, allowing potential exposure of cookies over unencrypted connections. Impact is the eavesdropping of cookie data; CVSS v3 base score 3.5 (Low). Mitigation: upgrade to ABB eSOMS 6.0.3 or 6.1 where ...

CVE-2019-19089

ABB eSOMS versions 4.0–6.0.3 are affected by CVE-2019-19089 due to a missing X-Content-Type-Options header in HTTP responses. This can allow the response body to be interpreted as a different content type, with a possible attack scenario of unauthorized code execution via text interpreted as Java...

CVE-2019-19003 ABB eSOMS: HTTPOnly flag not set

For ABB eSOMS versions 4.0 to 6.0.2, the HTTPOnly flag is not set. This can allow Javascript to access the cookie contents, which in turn might enable Cross Site Scripting...

CVE-2019-19003

ABB eSOMS (Electronic Shift Operations Management System)

Unspecified Vulnerability in ABB eSOMS (CNVD-2020-19565)

ABB eSOMS Electronic Shift Operations Management System is a plant operations management system from ABB Switzerland. ABB eSOMS contains a security vulnerability that can be exploited by attackers to conduct cross-site scripting attacks...

ICSA-20-072-01_ABB eSOMS

1. EXECUTIVE SUMMARY CVSS v3 7.6 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: ABB Equipment: eSOMS Vulnerabilities: Use of Web Browser Cache Containing Sensitive Information, Improper Restriction of Rendered UI Layers or Frames, Improper Neutralization of HTTP Headers for...

ABB Asset Suite

1. EXECUTIVE SUMMARY CVSS v3 7.1 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: ABB Equipment: Asset Suite Vulnerability: Authorization Bypass Through User-Controlled Key 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker access to...

ABB IDAL HTTP Server Stack Buffer Overflow (CVE-2019-7232)

A stack buffer overflow vulnerability exists in ABB IDAL HTTP Server. A remote unauthenticated attacker could exploit this vulnerability by sending a crafted request to the vulnerable server. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on...

CVE-2019-18998

Insufficient access control in the web interface of ABB Asset Suite versions 9.0 to 9.3, 9.4 prior to 9.4.2.6, 9.5 prior to 9.5.3.2 and 9.6.0 enables full access to directly referenced objects. An attacker with knowledge of a resource's URL can access the resource directly...

CVE-2019-18998

Insufficient access control in the web interface of ABB Asset Suite versions 9.0 to 9.3, 9.4 prior to 9.4.2.6, 9.5 prior to 9.5.3.2 and 9.6.0 enables full access to directly referenced objects. An attacker with knowledge of a resource's URL can access the resource directly...

Improper access control

Insufficient access control in the web interface of ABB Asset Suite versions 9.0 to 9.3, 9.4 prior to 9.4.2.6, 9.5 prior to 9.5.3.2 and 9.6.0 enables full access to directly referenced objects. An attacker with knowledge of a resource's URL can access the resource directly...

CVE-2019-18998 Asset Suite Direct Object Reference Access

Insufficient access control in the web interface of ABB Asset Suite versions 9.0 to 9.3, 9.4 prior to 9.4.2.6, 9.5 prior to 9.5.3.2 and 9.6.0 enables full access to directly referenced objects. An attacker with knowledge of a resource's URL can access the resource directly...