CVE-2022-2789

CVE-2022-2789 affects Emerson Proficy Machine Edition (engineering workstation) versions 9.00 and earlier (commonly cited as 9.00 and prior; some sources reference 9.80 and prior). Root cause: insufficient verification of data authenticity, allowing the PLC logic display to differ from the compil...

CVE-2022-2789

Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulnerable to CWE-345 Insufficient Verification of Data Authenticity, and can display logic that is different than the compiled logic...

CVE-2022-2789

Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulnerable to CWE-345 Insufficient Verification of Data Authenticity, and can display logic that is different than the compiled logic...

CVE-2022-2790

CVE-2022-2790 affects Emerson Electric’s Proficy Machine Edition, version 9.00 and prior. The issue is an improper verification of cryptographic signatures (CWE-347) that leads to failure to properly verify compiled logic (PDT files) and data blocks data (BLD/BLK files). Reported by multiple sour...

CVE-2022-2790

Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-347 Improper Verification of Cryptographic Signature, and does not properly verify compiled logic PDT files and data blocks data BLD/BLK files...

CVE-2022-2790

Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-347 Improper Verification of Cryptographic Signature, and does not properly verify compiled logic PDT files and data blocks data BLD/BLK files...

CVE-2022-2792

Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-284 Improper Access Control, and stores project data in a directory with improper access control lists...

CVE-2022-2792

CVE-2022-2792 affects Emerson Electric’s Proficy Machine Edition, versions 9.00 and prior. The issue is CWE-284 Improper Access Control: project data is stored in a directory with improper access control lists, enabling unauthorized access to sensitive project data. The CVSSv3 base score is cited...

CVE-2022-2792

Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-284 Improper Access Control, and stores project data in a directory with improper access control lists...

CVE-2022-2788

Emerson Electric's Proficy Machine Edition Version 9.80 and prior is vulnerable to CWE-29 Path Traversal: '..\Filename', also known as a ZipSlip attack, through an upload procedure which enables attackers to implant a malicious .BLZ file on the PLC. The file can transfer through the engineering...

CVE-2022-2788

Emerson Electric's Proficy Machine Edition Version 9.80 and prior is vulnerable to CWE-29 Path Traversal: '..\Filename', also known as a ZipSlip attack, through an upload procedure which enables attackers to implant a malicious .BLZ file on the PLC. The file can transfer through the engineering...

Path traversal

Emerson Electric's Proficy Machine Edition Version 9.80 and prior is vulnerable to CWE-29 Path Traversal: '..\Filename', also known as a ZipSlip attack, through an upload procedure which enables attackers to implant a malicious .BLZ file on the PLC. The file can transfer through the engineering...

CVE-2022-2788

Emerson Electric's Proficy Machine Edition Version 9.80 and prior is vulnerable to CWE-29 Path Traversal: '..\Filename', also known as a ZipSlip attack, through an upload procedure which enables attackers to implant a malicious .BLZ file on the PLC. The file can transfer through the engineering...

CVE-2022-2788

Emerson Electric's Proficy Machine Edition Version 9.80 and prior is vulnerable to CWE-29 Path Traversal: '..\Filename', also known as a ZipSlip attack, through an upload procedure which enables attackers to implant a malicious .BLZ file on the PLC. The file can transfer through the engineering...

CVE-2022-2788

CVE-2022-2788 affects Emerson Proficy Machine Edition 9.80 and earlier. It is a ZipSlip-style path traversal via the upload procedure (..\Filename) that can plant a malicious .BLZ file on a PLC and potentially execute code when transferred to Windows. Mitigations discussed in connected sources in...

Security Bulletin: IBM Tivoli Storage Manager FastBack Mount Buffer Overflow (CVE-2015-0120)

Summary IBM Tivoli Storage Manager FastBack Mount might be vulnerable to buffer overflow from the network or local machine. Vulnerability Details CVEID: CVE-2015-0120 DESCRIPTION: The Mount from IBM Tivoli Storage Manager FastBack 6.1.11 and earlier versions might be vulnerable to buffer overflow...

Malicious code in wexack-node-externals (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 280fed3d8637aa96a9752d788f7ffb037922023a05290834a384a70021b85361 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tioredks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 82288406f42e0b41e971b9c88fd0ad2e804534b72a105b490c59b8848cae6035 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in seacpe-string-regexp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6ff0f30301cb0cb08946202fc53f1f20e2971d9a6034f12c3bd0f7200050eb14 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pplitu2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38f91f939544c8901433fd348d4b79123a3906986ac39f94771716b5c3b5814d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...