Hitachienergy Esoms
19 CVEs affecting Hitachienergy Esoms. Latest disclosed: 2023-11-01. Critical: 1, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-14805 | Critical | 9.8 | 2018-08-29 | ABB eSOMS version 6.0.2 may allow unauthorized access to the system when LDAP is set to allow anonymous authentication, and specific key values within the eSOM… |
CVE-2019-19094 | High | 7.6 | 2020-04-02 | Lack of input checks for SQL queries in ABB eSOMS versions 3.9 to 6.0.3 might allow an attacker SQL injection attacks against the backend database. |
CVE-2021-35527 | High | 7.5 | 2021-07-14 | Password autocomplete vulnerability in the web application password field of Hitachi ABB Power Grids eSOMS allows attacker to gain access to user credentials t… |
CVE-2021-26845 | High | 7.5 | 2021-06-14 | Information Exposure vulnerability in Hitachi ABB Power Grids eSOMS allows unauthorized user to gain access to report data if the URL used to access the report… |
CVE-2019-19093 | Medium | 6.5 | 2020-04-02 | eSOMS versions 4.0 to 6.0.3 do not enforce password complexity settings, potentially resulting in lower access security due to insecure user passwords. |
CVE-2019-19001 | Medium | 6.5 | 2020-04-02 | For ABB eSOMS versions 4.0 to 6.0.2, the X-Frame-Options header is not configured in HTTP response. This can potentially allow 'ClickJacking' attacks where an… |
CVE-2019-19000 | Medium | 6.5 | 2020-04-02 | For ABB eSOMS 4.0 to 6.0.3, the Cache-Control and Pragma HTTP header(s) have not been properly configured within the application response. This can potentially… |
CVE-2019-19002 | Medium | 6.3 | 2020-04-02 | For ABB eSOMS versions 4.0 to 6.0.2, the X-XSS-Protection HTTP response header is not set in responses from the web server. For older web browser not supportin… |
CVE-2019-19096 | Medium | 6.1 | 2020-04-02 | The Redis data structure component used in ABB eSOMS versions 6.0 to 6.0.2 stores credentials in clear text. If an attacker has file system access, this can po… |
CVE-2019-19089 | Medium | 6.1 | 2020-04-02 | For ABB eSOMS versions 4.0 to 6.0.3, the X-Content-Type-Options Header is missing in the HTTP response, potentially causing the response body to be interpreted… |
CVE-2019-19097 | Medium | 5.9 | 2020-04-02 | ABB eSOMS versions 4.0 to 6.0.3 accept connections using medium strength ciphers. If a connection is enabled using such a cipher, an attacker might be able to… |
CVE-2019-19095 | Medium | 5.4 | 2020-04-02 | Lack of adequate input/output validation for ABB eSOMS versions 4.0 to 6.0.2 might allow an attacker to attack such as stored cross-site scripting by storing m… |
CVE-2023-5516 | Medium | 5.3 | 2023-11-01 | Poorly constructed webap requests and URI components with special characters trigger unhandled errors and exceptions, disclosing information about the underly… |
CVE-2023-5515 | Medium | 5.3 | 2023-11-01 | The responses for web queries with certain parameters disclose internal path of resources. This information can be used to learn internal structure of the app… |
CVE-2023-5514 | Medium | 5.3 | 2023-11-01 | The response messages received from the eSOMS report generation using certain parameter queries with full file path can be abused for enumerating the local fi… |
CVE-2019-19003 | Medium | 5.3 | 2020-04-02 | For ABB eSOMS versions 4.0 to 6.0.2, the HTTPOnly flag is not set. This can allow Javascript to access the cookie contents, which in turn might enable Cross Si… |
CVE-2019-19091 | Medium | 4.3 | 2020-04-02 | For ABB eSOMS versions 4.0 to 6.0.3, HTTPS responses contain comments with sensitive information about the application. An attacker might use this detail infor… |
CVE-2019-19092 | Low | 3.5 | 2020-04-02 | ABB eSOMS versions 4.0 to 6.0.3 use ASP.NET Viewstate without Message Authentication Code (MAC). Alterations to Viewstate might thus not be noticed. |
CVE-2019-19090 | Low | 3.5 | 2020-04-02 | For ABB eSOMS versions 4.0 to 6.0.2, the Secure Flag is not set in the HTTP response header. Unencrypted connections might access the cookie information, thus… |