CVE-2020-5608: Improper Authentication

CAMS for HIS CENTUM CS 3000 includes CENTUM CS 3000 Small R3.08.10 to R3.09.50, CENTUM VP includes CENTUM VP Small, Basic R4.01.00 to R6.07.00, B/M9000CS R5.04.01 to R5.05.01, and B/M9000 VP R6.01.01 to R8.03.01 allows a remote unauthenticated attacker to bypass authentication and send altered...

PT-2020-3923

Name of the Vulnerable Software and Affected Versions: CAMS for HIS CENTUM CS 3000 versions R3.08.10 through R3.09.50 CENTUM VP versions R4.01.00 through R6.07.00 B/M9000CS versions R5.04.01 through R5.05.01 B/M9000 VP versions R6.01.01 through R8.03.01 Description: The issue allows a remote...

PT-2020-6608

Name of the Vulnerable Software and Affected Versions Yokogawa CENTUM VP affected versions not specified Description The issue is related to errors in the code of the SCADA system. Exploitation of this issue may allow an attacker to execute arbitrary code by modifying project files and injecting...

Google VP boycotts Black Hat 2020 because of its name

By Zara Khan Google VP withdraws from the Black Hat 2020 virtual... This is a post from HackRead.com Read the original post: Google VP boycotts Black Hat 2020 because of its name...

WS-2020-0048

The ""verifyVerifiableCredential"" https://github.com/rabobank-blockchain/vp-toolkit/blob/master/src/service/signers/verifiable-credential-signer.tsL57 method check the cryptographic integrity of the Verifiable Credential, but it does not check if the ""credential.issuer""...

WS-2020-0046

The ""verifyVerifiablePresentation"" https://github.com/rabobank-blockchain/vp-toolkit/blob/master/src/service/signers/verifiable-presentation-signer.tsL97 method check the cryptographic integrity of the Verifiable Presentation, but it does not check if the ""credentialSubject.id""...

Credentials Verification Bypass

vp-toolkit is vulnerable to credentials verification bypass. The verifyVerifiablePresentation function verifies the cryptographic integrity of the Verifiable Presentation but failure to check if the credentialSubject.id matches the signer of the VP proof allows to bypass the verification...

ula-vp-controller (0.1.0) potentially affected by unknown CVE via vp-toolkit (0.1.1)

vp-toolkit NPM version 0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on vp-toolkit and may be impacted: - ula-vp-controller 0.1.0 Source cves: unknown CVE Source advisory: OSV:GHSA-P94W-42G3-F7H4...

ula-vp-controller (0.1.0) potentially affected by unknown CVE via vp-toolkit (0.1.1)

vp-toolkit NPM version 0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on vp-toolkit and may be impacted: - ula-vp-controller 0.1.0 Source cves: unknown CVE Source advisory: OSV:GHSA-FF5X-W9WG-H275...

GHSA-FF5X-W9WG-H275 Holder can generate proof of ownership for credentials it does not control in vp-toolkit

Impact The verifyVerifiablePresentation method check the cryptographic integrity of the Verifiable Presentation, but it does not check if the credentialSubject.id DID matches the signer of the VP proof. The verifier is impacted by this vulnerability. Patches Patch will be available in version...

PT-2020-21433

Name of the Vulnerable Software and Affected Versions vp-toolkit versions prior to 0.2.2 Description The verifyVerifiableCredential method does not check if the credential.issuer DID matches the signer of the credential, which impacts the verifier. Recommendations For versions prior to 0.2.2,...

PT-2020-21272

Name of the Vulnerable Software and Affected Versions vp-toolkit versions prior to 0.2.2 Description The verifyVerifiablePresentation method does not check if the credentialSubject.id DID matches the signer of the VP proof, impacting the verifier. Recommendations For versions prior to 0.2.2, as a...

PT-2020-3889

Name of the Vulnerable Software and Affected Versions: Yokogawa CENTUM CS 1000 versions R3.08.70 and earlier Yokogawa CENTUM CS 3000 versions R3.09.50 and earlier Yokogawa CENTUM CS 3000 Entry versions R3.09.50 and earlier Yokogawa CENTUM VP versions R5.04.20 and earlier Yokogawa CENTUM VP Entry...

CVE-2015-5626: Out-of-bounds Write

Stack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier, CENTUM CS 3000 R3.09.50 and earlier, CENTUM CS 3000 Entry R3.09.50 and earlier, CENTUM VP R5.04.20 and earlier, CENTUM VP Entry R5.04.20 and earlier, ProSafe-RS R3.02.10 and earlier, Exaopc R3.72.00 and earlier, Exaquant...

CVE-2015-5627: Out-of-bounds Write

Stack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier, CENTUM CS 3000 R3.09.50 and earlier, CENTUM CS 3000 Entry R3.09.50 and earlier, CENTUM VP R5.04.20 and earlier, CENTUM VP Entry R5.04.20 and earlier, ProSafe-RS R3.02.10 and earlier, Exaopc R3.72.00 and earlier, Exaquant...

Yokogawa B\/m9000 Unspecified Vulnerability

A weakness in access controls in CENTUM CS 1000 all versions, CENTUM CS 3000 versions R3.09.50 and earlier, CENTUM CS 3000 Small versions R3.09.50 and earlier, CENTUM VP versions R6.03.10 and earlier, CENTUM VP Small versions R6.03.10 and earlier, CENTUM VP Basic versions R6.03.10 and earlier,...

Yokogawa Vnet/IP Open Communication Driver Denial-of-Service (ICSA-19-003-02)

Binary data 720286.prm...

The vulnerability of the virtio_pci_remove handler’s implementation in the Astra Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the virtiopciremove handler in the Astra Linux operating system’s kernel the loaded module drivers/virtio/virtiopci.ko is related to a memory release error. In the virtiopciprobe function, memory is allocated for vpdev, but the memory is not released in the virtiopciremove...

CVE-2019-5909

License Manager Service of YOKOGAWA products CENTUM VP R5.01.00 - R6.06.00, CENTUM VP Entry Class R5.01.00 - R6.06.00, ProSafe-RS R3.01.00 - R4.04.00, PRM R4.01.00 - R4.02.00, B/M9000 VPR7.01.01 - R8.02.03 allows remote attackers to bypass access restriction to send malicious files to the PC wher...

CVE-2019-5909

CVE-2019-5909 concerns Yokogawa License Manager Service across multiple products (CENTUM VP, CENTUM VP Entry Class, ProSafe-RS, PRM, B/M9000 VP). The vulnerability arises from improper access control that allows a remote attacker to upload arbitrary files to the PC running License Manager, enabli...