CVE-2020-14509

CVE-2020-14509 concerns CodeMeter WebAdmin prior to 7.10a. The vulnerability is a memory corruption issue in the packet parser that does not verify length fields, allowing an attacker to send specially crafted packets to trigger the flaw. Public sources describe potential outcomes as remote code ...

CVE-2020-14509

Multiple memory corruption vulnerabilities exist in CodeMeter All versions prior to 7.10 where the packet parser mechanism does not verify length fields. An attacker could send specially crafted packets to exploit these vulnerabilities...

CVE-2020-14519: Origin Validation Error

This vulnerability allows an attacker to use the internal WebSockets API for CodeMeter All versions prior to 7.00 are affected, including Version 7.0 or newer with the affected WebSockets API still enabled. This is especially relevant for systems or devices where a web browser is used to access a...

CVE-2020-14517: Inadequate Encryption Strength

Protocol encryption can be easily broken for CodeMeter All versions prior to 6.90 are affected, including Version 6.90 or newer only if CodeMeter Runtime is running as server and the server accepts external connections, which may allow an attacker to remotely communicate with the CodeMeter API...

CVE-2020-14509: Buffer Access with Incorrect Length Value

Multiple memory corruption vulnerabilities exist in CodeMeter All versions prior to 7.10 where the packet parser mechanism does not verify length fields. An attacker could send specially crafted packets to exploit these vulnerabilities...

CVE-2020-14513: Improper Input Validation

CodeMeter All versions prior to 6.81 and the software using it may crash while processing a specifically crafted license file due to unverified length fields...

CVE-2020-14515: Improper Verification of Cryptographic Signature

CodeMeter All versions prior to 6.90 when using CmActLicense update files with CmActLicense Firm Code has an issue in the license-file signature checking mechanism, which allows attackers to build arbitrary license files, including forging a valid license file as if it were a valid license file o...

CVE-2020-16233: Improper Resource Shutdown or Release

An attacker could send a specially crafted packet that could have CodeMeter All versions prior to 7.10 send back packets containing data from the heap...

Critical Flaws in 3rd-Party Code Allow Takeover of Industrial Control Systems

Six critical vulnerabilities have been discovered in a third-party software component powering various industrial systems. Remote, unauthenticated attackers can exploit the flaws to launch various malicious attacks – including deploying ransomware, and shutting down or even taking over critical...

Multiple Siemens Products with Insufficient Encryption Strength Vulnerability

Siemens SIMATIC WinCC OA Open Architecture is a SCADA system from Siemens, Germany, and a component of the HMI series. The system is mainly used in industries such as rail transportation, building automation and public power supply.Information Server is used to report and visualize process data...

WIBU CodeMeter vulnerabilities discovered in several Sieens products

WIBU systems has published a number of vulnerabilities, which would allow an unauthenticated remote malicious person is able to Manipulate license files, execute arbitrary code with application privileges or to cause a Denial-of-Service cause. WIBU gives the vulnerability with attribute...

CodeMeter 6.60 Unquoted Service Path

Exploit Title: CodeMeter 6.60 - 'CodeMeter.exe' Unquoted Service Path Discovery by: Luis Martinez Discovery Date: 2020-08-05 Vendor Homepage: https://www.wibu.com/us/products/codemeter/runtime.html Tested Version: 6.60 Vulnerability Type: Unquoted Service Path Tested on OS: Windows 10 Pro x64 es...

CodeMeter 6.60 - (CodeMeter.exe) Unquoted Service Path Vulnerability

Exploit Title: CodeMeter 6.60 - 'CodeMeter.exe' Unquoted Service Path Discovery by: Luis Martinez Vendor Homepage: https://www.wibu.com/us/products/codemeter/runtime.html Tested Version: 6.60 Vulnerability Type: Unquoted Service Path Tested on OS: Windows 10 Pro x64 es Step to discover Unquoted...

CodeMeter 6.60 - 'CodeMeter.exe' Unquoted Service Path

Exploit Title: CodeMeter 6.60 - 'CodeMeter.exe' Unquoted Service Path Discovery by: Luis Martinez Discovery Date: 2020-08-05 Vendor Homepage: https://www.wibu.com/us/products/codemeter/runtime.html Tested Version: 6.60 Vulnerability Type: Unquoted Service Path Tested on OS: Windows 10 Pro x64 es...

KLA11658 Multiple vulnerabilities in FactoryTalk Activation Manager

Multiple vulnerabilities were found in FactoryTalk Activation Manager. Malicious users can exploit these vulnerabilities to perform cross-site scripting attack, execute arbitrary code. Below is a complete list of vulnerabilities: 1. Vulnerability in certain versions of Wibu-Systems CodeMeter can ...

WIBU-SYSTEMS CodeMeter Runtime Detection (Windows SMB Login)

SMB login-based detection of WIBU-SYSTEMS CodeMeter Runtime. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...

Wibu-Systems CodeMeter Cross-Site Scripting Vulnerability

Wibu-Systems CodeMeter is a suite of anti-piracy protection products from Wibu-Systems for software protection against piracy and unsecured software. The product uses encryption technology and a small USB hardware device, CmStick, which has a built-in SmartCard chip with 128KB of secure memory fo...

CVE-2017-13754

Cross-site scripting XSS vulnerability in the "advanced settings - time server" module in Wibu-Systems CodeMeter before 6.50b allows remote attackers to inject arbitrary web script or HTML via the "server name" field in actions/ChangeConfiguration.html...

CVE-2017-13754

Cross-site scripting XSS vulnerability in the "advanced settings - time server" module in Wibu-Systems CodeMeter before 6.50b allows remote attackers to inject arbitrary web script or HTML via the "server name" field in actions/ChangeConfiguration.html...

Cross site scripting

Cross-site scripting XSS vulnerability in the "advanced settings - time server" module in Wibu-Systems CodeMeter before 6.50b allows remote attackers to inject arbitrary web script or HTML via the "server name" field in actions/ChangeConfiguration.html...