Abb
Page 3 of 3 — Abb CVEs from a corpus of 234, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-19107 | Medium | 6.2 | 2020-04-22 | The Configuration pages in ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway for user profiles and services transfer the password in plai… |
CVE-2019-19106 | Critical | 9.1 | 2020-04-22 | Improper implementation of Access Control in ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway allows an unauthorized user to access data… |
CVE-2019-19105 | Medium | 6.2 | 2020-04-22 | The backup function in ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway saves the current settings and configuration of the application… |
CVE-2019-19104 | Critical | 9.1 | 2020-04-22 | The web server in ABB Telephone Gateway TG/S 3.2 and Busch-Jaeger 6186/11 Telefon-Gateway allows access to different endpoints of the application without authe… |
CVE-2019-19097 | Medium | 5.9 | 2020-04-02 | ABB eSOMS versions 4.0 to 6.0.3 accept connections using medium strength ciphers. If a connection is enabled using such a cipher, an attacker might be able to… |
CVE-2019-19096 | Medium | 6.1 | 2020-04-02 | The Redis data structure component used in ABB eSOMS versions 6.0 to 6.0.2 stores credentials in clear text. If an attacker has file system access, this can po… |
CVE-2019-19095 | Medium | 5.4 | 2020-04-02 | Lack of adequate input/output validation for ABB eSOMS versions 4.0 to 6.0.2 might allow an attacker to attack such as stored cross-site scripting by storing m… |
CVE-2019-19094 | High | 7.6 | 2020-04-02 | Lack of input checks for SQL queries in ABB eSOMS versions 3.9 to 6.0.3 might allow an attacker SQL injection attacks against the backend database. |
CVE-2019-19093 | Medium | 6.5 | 2020-04-02 | eSOMS versions 4.0 to 6.0.3 do not enforce password complexity settings, potentially resulting in lower access security due to insecure user passwords. |
CVE-2019-19092 | Low | 3.5 | 2020-04-02 | ABB eSOMS versions 4.0 to 6.0.3 use ASP.NET Viewstate without Message Authentication Code (MAC). Alterations to Viewstate might thus not be noticed. |
CVE-2019-19091 | Medium | 4.3 | 2020-04-02 | For ABB eSOMS versions 4.0 to 6.0.3, HTTPS responses contain comments with sensitive information about the application. An attacker might use this detail infor… |
CVE-2019-19090 | Low | 3.5 | 2020-04-02 | For ABB eSOMS versions 4.0 to 6.0.2, the Secure Flag is not set in the HTTP response header. Unencrypted connections might access the cookie information, thus… |
CVE-2019-19089 | Medium | 6.1 | 2020-04-02 | For ABB eSOMS versions 4.0 to 6.0.3, the X-Content-Type-Options Header is missing in the HTTP response, potentially causing the response body to be interpreted… |
CVE-2019-19003 | Medium | 5.3 | 2020-04-02 | For ABB eSOMS versions 4.0 to 6.0.2, the HTTPOnly flag is not set. This can allow Javascript to access the cookie contents, which in turn might enable Cross Si… |
CVE-2019-19002 | Medium | 6.3 | 2020-04-02 | For ABB eSOMS versions 4.0 to 6.0.2, the X-XSS-Protection HTTP response header is not set in responses from the web server. For older web browser not supportin… |
CVE-2019-19001 | Medium | 6.5 | 2020-04-02 | For ABB eSOMS versions 4.0 to 6.0.2, the X-Frame-Options header is not configured in HTTP response. This can potentially allow 'ClickJacking' attacks where an… |
CVE-2019-19000 | Medium | 6.5 | 2020-04-02 | For ABB eSOMS 4.0 to 6.0.3, the Cache-Control and Pragma HTTP header(s) have not been properly configured within the application response. This can potentially… |
CVE-2019-18998 | High | 7.1 | 2020-02-17 | Insufficient access control in the web interface of ABB Asset Suite versions 9.0 to 9.3, 9.4 prior to 9.4.2.6, 9.5 prior to 9.5.3.2 and 9.6.0 enables full acce… |
CVE-2019-10995 | High | 8.8 | 2020-01-14 | ABB CP651 HMI products revision BSP UN30 v1.76 and prior implement hidden administrative accounts that are used during the provisioning phase of the HMI interf… |
CVE-2019-18997 | Medium | 4.3 | 2019-12-18 | The HMISimulator component of ABB PB610 Panel Builder 600 uses the readFile/writeFile interface to manipulate the work file. Path configuration in PB610 HMISim… |
CVE-2019-18996 | High | 7.1 | 2019-12-18 | Path settings in HMIStudio component of ABB PB610 Panel Builder 600 versions 2.8.0.424 and earlier accept DLLs outside of the program directory, potentially al… |
CVE-2019-18995 | Medium | 4.3 | 2019-12-18 | The HMISimulator component of ABB PB610 Panel Builder 600 versions 2.8.0.424 and earlier fails to validate the content-length field for HTTP requests, exposing… |
CVE-2019-18994 | Low | 3.9 | 2019-12-18 | Due to a lack of file length check, the HMIStudio component of ABB PB610 Panel Builder 600 versions 2.8.0.424 and earlier crashes when trying to load an empty… |
CVE-2019-18250 | Critical | 9.8 | 2019-11-26 | In all versions of ABB Power Generation Information Manager (PGIM) and Plant Connect, the affected product is vulnerable to authentication bypass, which may al… |
CVE-2019-7225 | High | 8.8 | 2019-06-27 | The ABB HMI components implement hidden administrative accounts that are used during the provisioning phase of the HMI interface. These credentials allow the p… |
CVE-2019-7227 | High | 7.3 | 2019-06-27 | In the ABB IDAL FTP server, an authenticated attacker can traverse to arbitrary directories on the hard disk with "CWD ../" and then use the FTP server functio… |
CVE-2019-7226 | High | 8.8 | 2019-06-27 | The ABB IDAL HTTP server CGI interface contains a URL that allows an unauthenticated attacker to bypass authentication and gain access to privileged functions… |
CVE-2019-7228 | High | 8.8 | 2019-06-27 | The ABB IDAL HTTP server mishandles format strings in a username or cookie during the authentication process. Attempting to authenticate with the username %25s… |
CVE-2019-7231 | Medium | 5.7 | 2019-06-24 | The ABB IDAL FTP server is vulnerable to a buffer overflow when a long string is sent by an authenticated attacker. This overflow is handled, but terminates th… |
CVE-2019-7229 | High | 8.3 | 2019-06-24 | The ABB CP635 HMI uses two different transmission methods to upgrade its firmware and its software components: "Utilization of USB/SD Card to flash the device"… |
CVE-2019-7232 | High | 8.8 | 2019-06-24 | The ABB IDAL HTTP server is vulnerable to a buffer overflow when a long Host header is sent in a web request. The Host header value overflows a buffer and over… |
CVE-2019-7230 | High | 8.8 | 2019-06-24 | The ABB IDAL FTP server mishandles format strings in a username during the authentication process. Attempting to authenticate with the username %s%p%x%d will c… |
CVE-2019-10953 | High | 7.5 | 2019-04-17 | ABB, Phoenix Contact, Schneider Electric, Siemens, WAGO - Programmable Logic Controllers, multiple versions. Researchers have found some controllers are suscep… |
CVE-2018-19008 | High | 7.8 | 2019-02-13 | The TextEditor 2.0 in ABB CP400 Panel Builder versions 2.0.7.05 and earlier contain a vulnerability in the file parser of the Text Editor wherein the applicati… |
CVE-2018-17928 | Medium | 6.5 | 2019-01-31 | The product CMS-770 (Software Versions 1.7.1 and prior)is vulnerable that an attacker can read sensitive configuration files by bypassing the user authenticati… |
CVE-2018-17926 | Medium | 4.3 | 2019-01-31 | The product M2M ETHERNET (FW Versions 2.22 and prior, ETH-FW Versions 1.01 and prior) is vulnerable in that an attacker can upload a malicious language file by… |
CVE-2018-18997 | Medium | 6.1 | 2019-01-03 | Pluto Safety PLC Gateway Ethernet devices in ABB GATE-E1 and GATE-E2 all versions allows an unauthenticated attacker using the administrative web interface to… |
CVE-2018-18995 | Critical | 9.8 | 2019-01-03 | Pluto Safety PLC Gateway Ethernet devices ABB GATE-E1 and GATE-E2 all versions do not allow authentication to be configured on administrative telnet or web int… |
CVE-2018-10616 | High | 7.8 | 2018-07-18 | ABB Panel Builder 800 all versions has an improper input validation vulnerability which may allow an attacker to insert and run arbitrary code on a computer wh… |
CVE-2017-7933 | Critical | 9.8 | 2018-06-06 | In ABB IP GATEWAY 3.39 and prior, some configuration files contain passwords stored in plain-text, which may allow an attacker to gain unauthorized access. |
CVE-2017-7931 | Critical | 9.8 | 2018-06-06 | In ABB IP GATEWAY 3.39 and prior, by accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to access the configuratio… |
CVE-2017-7906 | High | 8.8 | 2018-06-06 | In ABB IP GATEWAY 3.39 and prior, the web server does not sufficiently verify that a request was performed by the authenticated user, which may allow an attack… |
CVE-2017-9664 | Critical | 9.8 | 2018-05-24 | In ABB SREA-01 revisions A, B, C: application versions up to 3.31.5, and SREA-50 revision A: application versions up to 3.32.8, an attacker may access internal… |
CVE-2018-1168 | High | 7.8 | 2018-02-21 | This vulnerability allows local attackers to escalate privileges on vulnerable installations of ABB MicroSCADA 9.3 with FP 1-2-3. An attacker must first obtain… |
CVE-2018-5477 | Medium | 5.8 | 2018-02-20 | An Information Exposure issue was discovered in ABB netCADOPS Web Application Version 3.4 and prior, netCADOPS Web Application Version 7.1 and prior, netCADOPS… |
CVE-2017-7920 | High | 7.5 | 2017-08-07 | An Improper Authentication issue was discovered in ABB VSN300 WiFi Logger Card versions 1.8.15 and prior, and VSN300 WiFi Logger Card for React versions 2.1.3… |
CVE-2017-7916 | Medium | 6.5 | 2017-08-07 | A Permissions, Privileges, and Access Controls issue was discovered in ABB VSN300 WiFi Logger Card versions 1.8.15 and prior, and VSN300 WiFi Logger Card for R… |
CVE-2016-4527 | Low | 3.3 | 2016-06-10 | ABB PCM600 before 2.7 improperly stores PCM600 authentication credentials, which allows local users to obtain sensitive information via unspecified vectors. |
CVE-2016-4524 | Medium | 6.5 | 2016-06-10 | ABB PCM600 before 2.7 improperly stores OPC Server IEC61850 passwords in unspecified temporary circumstances, which allows local users to obtain sensitive info… |
CVE-2016-4516 | Low | 3.3 | 2016-06-10 | ABB PCM600 before 2.7 improperly stores the main application password after a password change, which allows local users to obtain sensitive information via uns… |
CVE-2016-4511 | Low | 2.8 | 2016-06-10 | ABB PCM600 before 2.7 uses an improper hash algorithm for the main application password, which makes it easier for local users to obtain sensitive cleartext in… |
CVE-2016-2281 | High | 7.2 | 2016-03-18 | Untrusted search path vulnerability in ABB Panel Builder 800 5.1 allows local users to gain privileges via a Trojan horse DLL in the current working directory. |
CVE-2014-5430 | | 2014-11-07 | Untrusted search path vulnerability in ABB RobotStudio 5.6x before 5.61.02 and Test Signal Viewer 1.5 allows local users to gain privileges via a Trojan horse… | |
CVE-2013-5021 | | 2013-08-06 | Multiple absolute path traversal vulnerabilities in National Instruments cwui.ocx, as used in National Instruments LabWindows/CVI 2012 SP1 and earlier, Nationa… | |
CVE-2012-1801 | | 2012-04-18 | Multiple stack-based buffer overflows in (1) COM and (2) ActiveX controls in ABB WebWare Server, WebWare SDK, Interlink Module, S4 OPC Server, QuickTeach, Robo… | |
CVE-2012-0245 | | 2012-03-09 | Multiple stack-based buffer overflows in RobNetScanHost.exe in ABB Robot Communications Runtime before 5.14.02, as used in ABB Interlink Module, IRC5 OPC Serve… | |
CVE-2008-2474 | | 2008-09-29 | Buffer overflow in x87 before 3.5.5 in ABB Process Communication Unit 400 (PCU400) 4.4 through 4.6 allows remote attackers to execute arbitrary code via a craf… |