Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-24658 State: PUBLISHED Published: 2020-12-24T17:21:20 Last Updated: 2024-08-04T15:19:08.915Z Vendors: n/a Products: n/a Problem Types: n/a Description: Arm Compiler 5 through 5.06u6 has an error in a stack protection feature designed to help spot stack-based buffer overflows in local arrays. When this feature is enabled, a protected function writes a guard value to the stack prior to (above) any vulnerable arrays in the stack. The guard value is checked for corruption on function return; corruption leads to an error-handler call. In certain circumstances, the reference value that is compared against the guard value is itself also written to the stack (after any vulnerable ar
he reference value that is compared against the guard value is itself also written to the stack (after any vulnerable arrays). The reference value is written to the stack when the function runs out of registers to use for other temporary data. If both the reference value and the guard value are written to the stack, then the stack protection will fail to spot corruption when both values are overwritten with the same value. For both the reference value and the guard value to be corrupted, there would need to be both a buffer overflow and a buffer underflow in the vulnerable arrays (or some other vulnerability that causes two separated stack entries to be corrupted). Additional Analyst Notes:
arrays (or some other vulnerability that causes two separated stack entries to be corrupted). Additional Analyst Notes: - CVE Program Container: References: - https://developer.arm.com/support/arm-security-updates/arm-compiler-5-stack-protection
CVE ID: CVE-2020-24659 State: PUBLISHED Published: 2020-09-04T14:03:36 Last Updated: 2024-08-04T15:19:08.542Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a no_renegotiation alert is sent with unexpected timing, and then an invalid second handshake occurs. The crash happens in the application's error handling path, where the gnutls_deinit function is called after detecting a handshake failure. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gnutls/gnutls/-/issues/1071 - https://www.gnutls.org/security-new.html#GNUTLS-SA-2020
: References: - https://gitlab.com/gnutls/gnutls/-/issues/1071 - https://www.gnutls.org/security-new.html#GNUTLS-SA-2020-09-04 - https://security.gentoo.org/glsa/202009-01 - https://security.netapp.com/advisory/ntap-20200911-0006/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62BUAI4FQQLG6VTKRT7SUZPGJJ4NASQ3/ - https://usn.ubuntu.com/4491-1/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AWN56FDLQQXT2D2YHNI4TYH432TDMQ7N/ - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00054.html - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00060.html
CVE ID: CVE-2020-24660 State: PUBLISHED Published: 2020-09-14T12:51:48 Last Updated: 2024-08-04T15:19:09.076Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used. An attacker may bypass URL-based access control to protected Virtual Hosts by submitting a non-normalized URI. This also affects versions before 0.5.2 of the "Lemonldap::NG handler for Node.js" package. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2290 - https://www.debian.org/security/2020/dsa-4762 - https://github.com/LemonLDAPNG/node-lemonldap-ng-handler/security/advisori
tps://www.debian.org/security/2020/dsa-4762 - https://github.com/LemonLDAPNG/node-lemonldap-ng-handler/security/advisories/GHSA-x44x-r84w-8v67 - https://github.com/LemonLDAPNG/node-lemonldap-ng-handler/releases/tag/0.5.2
CVE ID: CVE-2020-24661 State: PUBLISHED Published: 2020-08-26T15:06:03 Last Updated: 2024-08-04T15:19:09.066Z Vendors: n/a Products: n/a Problem Types: n/a Description: GNOME Geary before 3.36.3 mishandles pinned TLS certificate verification for IMAP and SMTP services using invalid TLS certificates (e.g., self-signed certificates) when the client system is not configured to use a system-provided PKCS#11 store. This allows a meddler in the middle to present a different invalid certificate to intercept incoming and outgoing mail. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.gnome.org/GNOME/geary/-/issues/866 - https://lists.fedoraproject.org/archives/list/pac
ner: References: - https://gitlab.gnome.org/GNOME/geary/-/issues/866 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NS6CSTOBVO5HSAR3X5CT6DS6QDHXDB26/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G7OTYTGND6EFOKNQJWCHKKXKSN7SM73Y/ - https://tools.cisco.com/security/center/content/CiscoSeg/message/NS6CSTOBVO5HSAR3X5CT6DS6QDHXDB26/
CVE ID: CVE-2020-24662 State: PUBLISHED Published: 2021-06-10T14:22:30 Last Updated: 2024-08-04T15:19:08.947Z Vendors: n/a Products: n/a Problem Types: n/a Description: SmartStream Transaction Lifecycle Management (TLM) Reconciliation Premium (RP) <3.1.0 allows XSS. This was fixed in TLM RP 3.1.0. Additional Analyst Notes: - CVE Program Container: References: - https://www.accenture.com - https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md
CVE ID: CVE-2020-24663 State: PUBLISHED Published: 2021-06-10T15:11:41 Last Updated: 2024-08-04T15:19:08.910Z Vendors: n/a Products: n/a Problem Types: n/a Description: Trace Financial CRESTBridge <6.3.0.02 contains a stored XSS vulnerability, which was fixed in 6.3.0.03. Additional Analyst Notes: - CVE Program Container: References: - https://www.accenture.com - https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md
CVE ID: CVE-2020-24664 State: PUBLISHED Published: 2021-01-29T18:56:43 Last Updated: 2024-08-04T15:19:09.289Z Vendors: n/a Products: n/a Problem Types: n/a Description: The dashboard Editor in Hitachi Vantara Pentaho through 7.x - 8.x contains a reflected Cross-site scripting vulnerability, which allows an authenticated remote users to execute arbitrary JavaScript code. Specifically, the vulnerability lies in the 'pho:title' attribute of 'dashboardXml' parameter. Remediated in >= 7.1.0.25, >= 8.2.0.6, and >= 8.3.0.0 GA. Additional Analyst Notes: - CVE Program Container: References: - https://www.accenture.com - https://support.pentaho.com/hc/en-us/articles/360050965992-hirt-sec-2020-601-Mult
erences: - https://www.accenture.com - https://support.pentaho.com/hc/en-us/articles/360050965992-hirt-sec-2020-601-Multiple-Vulnerabilities-in-Pentaho
CVE ID: CVE-2020-24665 State: PUBLISHED Published: 2021-01-29T18:41:03 Last Updated: 2024-08-04T15:19:09.243Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Dashboard Editor in Hitachi Vantara Pentaho through 7.x - 8.x contains an XML Entity Expansion injection vulnerability, which allows an authenticated remote users to trigger a denial of service (DoS) condition. Specifically, the vulnerability lies in the 'dashboardXml' parameter. Remediated in >= 7.1.0.25, >= 8.2.0.6, >= 8.3.0.0 GA Additional Analyst Notes: - CVE Program Container: References: - https://www.accenture.com - http://www.hitachi.com/hirt/hitachi-sec/2020/601.html
CVE ID: CVE-2020-24666 State: PUBLISHED Published: 2021-01-29T19:00:06 Last Updated: 2024-08-04T15:19:08.974Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Analysis Report in Hitachi Vantara Pentaho through 7.x - 8.x contains a stored Cross-site scripting vulnerability, which allows an authenticated remote users to execute arbitrary JavaScript code. Specifically, the vulnerability lies in the 'Display Name' parameter. Remediated in >= 9.1.0.1 Additional Analyst Notes: - CVE Program Container: References: - https://www.accenture.com - http://www.hitachi.com/hirt/hitachi-sec/2020/601.html
CVE ID: CVE-2020-24667 State: PUBLISHED Published: 2021-06-10T15:22:08 Last Updated: 2024-08-04T15:19:09.255Z Vendors: n/a Products: n/a Problem Types: n/a Description: Trace Financial CRESTBridge <6.3.0.02 contains an authenticated SQL injection vulnerability, which was fixed in 6.3.0.03. Additional Analyst Notes: - CVE Program Container: References: - https://www.accenture.com - https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md
CVE ID: CVE-2020-24668 State: PUBLISHED Published: 2021-06-10T15:09:01 Last Updated: 2024-08-04T15:19:09.131Z Vendors: n/a Products: n/a Problem Types: n/a Description: Trace Financial Crest Bridge <6.3.0.02 contains a stored XSS vulnerability, which was fixed in 6.3.0.03. Additional Analyst Notes: - CVE Program Container: References: - https://www.accenture.com - https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md
CVE ID: CVE-2020-24669 State: PUBLISHED Published: 2021-01-29T18:46:36 Last Updated: 2024-08-04T15:19:09.129Z Vendors: n/a Products: n/a Problem Types: n/a Description: The New Analysis Report in Hitachi Vantara Pentaho through 7.x - 8.x contains a DOM-based Cross-site scripting vulnerability, which allows an authenticated remote users to execute arbitrary JavaScript code. Specifically, the vulnerability lies in the 'Analysis Report Description' field in 'About this Report' section. Remediated in >= 8.3.0.9, >= 9.0.0.1, and >= 9.1.0.0 GA. Additional Analyst Notes: - CVE Program Container: References: - https://www.accenture.com - http://www.hitachi.com/hirt/hitachi-sec/2020/601.html
CVE ID: CVE-2020-24670 State: PUBLISHED Published: 2021-01-29T18:50:44 Last Updated: 2024-08-04T15:19:08.576Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Dashboard Editor in Hitachi Vantara Pentaho through 7.x - 8.x contains a reflected Cross-site scripting vulnerability, which allows an authenticated remote users to execute arbitrary JavaScript code. Specifically, the vulnerability lies in the 'type' attribute of 'dashboardXml' parameter. Remediated in >= 7.1.0.25, >= 8.2.0.6, and >= 8.3.0.0 GA. Additional Analyst Notes: - CVE Program Container: References: - https://www.accenture.com - http://www.hitachi.com/hirt/hitachi-sec/2020/601.html
CVE ID: CVE-2020-24671 State: PUBLISHED Published: 2021-06-10T15:17:03 Last Updated: 2024-08-04T15:19:09.117Z Vendors: n/a Products: n/a Problem Types: n/a Description: Trace Financial CRESTBridge <6.3.0.02 contains an authenticated SQL injection vulnerability, which was fixed in 6.3.0.03. Additional Analyst Notes: - CVE Program Container: References: - https://www.accenture.com - https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md
CVE ID: CVE-2020-24672 State: PUBLISHED Published: 2021-09-08T15:03:55.810948Z Last Updated: 2024-09-17T00:50:49.998Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ABB Products: Base Software for SoftControl Problem Types: CWE-862, CWE-345 Description: A vulnerability in Base Software for SoftControl allows an attacker to insert and run arbitrary code in a computer running the affected product. This issue affects: . Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=2PAA122974&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2020-24673 State: PUBLISHED Published: 2020-12-22T21:21:10.907659Z Last Updated: 2024-09-16T16:23:58.092Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ABB Products: ABB Ability™ Symphony® Plus Operations, ABB Ability™ Symphony® Plus Historian Problem Types: CWE-89 Description: In S+ Operations and S+ Historian, a successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database (such as shutdown the DBMS), recover the content of a given file present on the DBMS file system and in some cases issue commands to the operating system. This can
ntent of a given file present on the DBMS file system and in some cases issue commands to the operating system. This can lead to a loss of confidentiality and data integrity or even affect the product behavior and its availability. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch - https://search.abb.com/library/Download.aspx?DocumentID=2PAA123982&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2020-24674 State: PUBLISHED Published: 2020-12-22T21:20:16.269133Z Last Updated: 2024-09-16T16:54:08.113Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ABB Products: ABB Ability™ Symphony® Plus Operations, ABB Ability™ Symphony® Plus Historian Problem Types: CWE-285 Description: In S+ Operations and S+ Historian, not all client commands correctly check user permission as expected. Authenticated but Unauthorized remote users could execute a Denial-of-Service (DoS) attack, execute arbitrary code, or obtain more privilege than intended on the machines. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Do
nded on the machines. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch - https://search.abb.com/library/Download.aspx?DocumentID=2PAA123982&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2020-24675 State: PUBLISHED Published: 2020-12-22T21:22:05.808039Z Last Updated: 2024-09-16T22:36:05.721Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ABB Products: ABB Ability™ Symphony® Plus Operations, ABB Ability™ Symphony® Plus Historian Problem Types: CWE-287 Description: In S+ Operations and S+ History, it is possible that an unauthenticated user could inject values to the Operations History server (or standalone S+ History server) and ultimately write values to the controlled process. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&Doc
Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch - https://search.abb.com/library/Download.aspx?DocumentID=2PAA123982&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2020-24676 State: PUBLISHED Published: 2020-12-22T21:15:22.929934Z Last Updated: 2024-09-16T21:57:54.934Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ABB Products: ABB Ability™ Symphony® Plus Operations, ABB Ability™ Symphony® Plus Historian Problem Types: CWE-274 Description: In Symphony Plus Operations and Symphony Plus Historian, some services can be vulnerable to privilege escalation attacks. An unprivileged (but authenticated) user could execute arbitrary code and result in privilege escalation, depending on the user that the service runs as. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Do
the service runs as. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch - https://search.abb.com/library/Download.aspx?DocumentID=2PAA123982&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2020-24677 State: PUBLISHED Published: 2020-12-22T21:16:37.411681Z Last Updated: 2024-09-17T04:00:06.225Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ABB Products: ABB Ability™ Symphony® Plus Operations, ABB Ability™ Symphony® Plus Historian Problem Types: CWE-754 Description: Vulnerabilities in the S+ Operations and S+ Historian web applications can lead to a possible code execution and privilege escalation, redirect the user somewhere else or download unwanted data. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch -
es: - https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch - https://search.abb.com/library/Download.aspx?DocumentID=2PAA123982&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2020-24678 State: PUBLISHED Published: 2020-12-22T21:13:13.833879Z Last Updated: 2024-09-17T02:51:56.476Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ABB Products: ABB Ability™ Symphony® Plus Operations, ABB Ability™ Symphony® Plus Historian Problem Types: CWE-269 Description: An authenticated user might execute malicious code under the user context and take control of the system. S+ Operations or S+ Historian database is affected by multiple vulnerabilities such as the possibility to allow remote authenticated users to gain high privileges. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download
igh privileges. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch - https://search.abb.com/library/Download.aspx?DocumentID=2PAA123982&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2020-24679 State: PUBLISHED Published: 2020-12-22T21:17:12.753491Z Last Updated: 2024-09-17T01:20:53.487Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ABB Products: ABB Ability™ Symphony® Plus Operations, ABB Ability™ Symphony® Plus Historian Problem Types: CWE-20 Description: A S+ Operations and S+ Historian service is subject to a DoS by special crafted messages. An attacker might use this flaw to make it crash or even execute arbitrary code on the machine where the service is hosted. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartI
ontainer: References: - https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch - https://search.abb.com/library/Download.aspx?DocumentID=2PAA123982&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2020-24680 State: PUBLISHED Published: 2020-12-22T21:18:37.038625Z Last Updated: 2024-09-17T01:51:49.326Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ABB Products: ABB Ability™ Symphony® Plus Operations, ABB Ability™ Symphony® Plus Historian Problem Types: CWE-255 Description: In S+ Operations and S+ Historian, the passwords of internal users (not Windows Users) are encrypted but improperly stored in a database. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch - https://search.abb.com/library/Download.aspx?DocumentID=2P
ID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch - https://search.abb.com/library/Download.aspx?DocumentID=2PAA123982&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2020-24681 State: PUBLISHED Published: 2024-02-02T06:58:24.173Z Last Updated: 2025-05-09T17:52:17.145Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: B&R Industrial Automation Products: Automation Studio, NET/PVI Problem Types: CWE-732 Description: Incorrect Permission Assignment for Critical Resource vulnerability in B&R Industrial Automation Automation Studio allows Privilege Escalation.This issue affects Automation Studio: from 4.6.0 through 4.6.X, from 4.7.0 before 4.7.7 SP, from 4.8.0 before 4.8.6 SP, from 4.9.0 before 4.9.4 SP. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.br-automation
SP. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.br-automation.com/fileadmin/2021-14-BR-AS-NET-PVI-Service-Issues-c3710fbf.pdf
CVE ID: CVE-2020-24682 State: PUBLISHED Published: 2024-02-02T07:11:44.086Z Last Updated: 2025-06-17T21:29:22.845Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: B&R Industrial Automation Products: Automation Studio, NET/PVI Problem Types: CWE-428 Description: Unquoted Search Path or Element vulnerability in B&R Industrial Automation Automation Studio, B&R Industrial Automation NET/PVI allows Target Programs with Elevated Privileges.This issue affects Automation Studio: from 4.0 through 4.6, from 4.7.0 before 4.7.7 SP, from 4.8.0 before 4.8.6 SP, from 4.9.0 before 4.9.4 SP; NET/PVI: from 4.0 through 4.6, from 4.7.0 before 4.7.7, from 4.8.0 before 4.8.6, from
6 SP, from 4.9.0 before 4.9.4 SP; NET/PVI: from 4.0 through 4.6, from 4.7.0 before 4.7.7, from 4.8.0 before 4.8.6, from 4.9.0 before 4.9.4. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.br-automation.com/fileadmin/2021-14-BR-AS-NET-PVI-Service-Issues-c3710fbf.pdf
CVE ID: CVE-2020-24683 State: PUBLISHED Published: 2020-12-22T21:19:10.709309Z Last Updated: 2024-09-17T01:36:41.524Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ABB Products: ABB Ability™ Symphony® Plus Operations Problem Types: CWE-602, CWE-305 Description: The affected versions of S+ Operations (version 2.1 SP1 and earlier) used an approach for user authentication which relies on validation at the client node (client-side authentication). This is not as secure as having the server validate a client application before allowing a connection. Therefore, if the network communication or endpoints for these applications are not protected, unauthorized act
nection. Therefore, if the network communication or endpoints for these applications are not protected, unauthorized actors can bypass authentication and make unauthorized connections to the server application. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=2PAA123980&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2020-24685 State: PUBLISHED Published: 2021-02-09T03:57:16 Last Updated: 2024-08-04T15:19:09.311Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: ABB Products: AC500 V2 products with onboard Ethernet Problem Types: An unauthenticated specially crafted packet sent by an attacker over the network will cause a denial-of-service (DoS) vulnerability. Vulnerability allows attacker to stop the PLC. After stopping (ERR LED flashing red), physical access to the PLC is required in order to restart the application., CWE-789 Description: An unauthenticated specially crafted packet sent by an attacker over the network will cause a denial-of-service (DoS) vulner
nauthenticated specially crafted packet sent by an attacker over the network will cause a denial-of-service (DoS) vulnerability. Vulnerability allows attacker to stop the PLC. After stopping (ERR LED flashing red), physical access to the PLC is required in order to restart the application. This issue affects: ABB AC500 V2 products with onboard Ethernet version 2.8.4 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://search.abb.com/library/Download.aspx?DocumentID=3ADR010667&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2020-24686 State: PUBLISHED Published: 2021-02-26T15:10:58 Last Updated: 2024-08-04T15:19:09.305Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ABB Products: AC500 V2 products with onboard Ethernet Problem Types: CWE-400 Description: The vulnerabilities can be exploited to cause the web visualization component of the PLC to stop and not respond, leading to genuine users losing remote visibility of the PLC state. If a user attempts to login to the PLC while this vulnerability is exploited, the PLC will show an error state and refuse connections to Automation Builder. The execution of the PLC application is not affected by this vulnerability. This