rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-10595 
pam-krb5 before 4.9 has a buffer overflow that might cause remote code execution in situations involving supplemental prompting by a Kerberos library. It may overflow a buffer provided by the underlying Kerberos library by a single '\0' byte if an attacker responds to a prompt with an answer of a carefully chosen length. The effect may range from heap corruption to stack corruption depending on the structure of the underlying Kerberos library, with unknown effects but possibly including code execution. This code path is not used for normal authentication, but only when the Kerberos library does supplemental prompting, such as with PKINIT or when using the non-standard no_prompt PAM configuration option.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-31T12:36:10.000Z
CVE-2020-10596 
OpenCart 3.0.3.2 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upload section.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-17T14:42:30.000Z
CVE-2020-10597 
Delta Industrial Automation DOPSoft, Version 4.00.08.15 and prior. Multiple out-of-bounds read vulnerabilities may be exploited by processing specially crafted project files, which may allow an attacker to read information and/or crash the application.
Problem types: cwe_id: CWE-125
description: OUT-OF-BOUNDS READ CWE-125
Affected products: vendor: n/a
product: Delta Industrial Automation DOPSoft
Published: 2020-03-20T14:27:16.000Z
CVE-2020-10598 
In BD Pyxis MedStation ES System v1.6.1 and Pyxis Anesthesia (PAS) ES System v1.6.1, a restricted desktop environment escape vulnerability exists in the kiosk mode functionality of affected devices. Specially crafted inputs could allow the user to escape the restricted environment, resulting in access to sensitive data.
Problem types: cwe_id: CWE-693
description: PROTECTION MECHANISM FAILURE CWE-693
Affected products: vendor: Becton, Dickinson and Company (BD)
product: Pyxis MedStation ES System
vendor: Becton, Dickinson and Company (BD)
product: Pyxis Anesthesia (PAS) ES System
Published: 2020-04-01T20:59:36.000Z
CVE-2020-10599 
VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module may allow a vulnerable ActiveX component to be exploited resulting in a buffer overflow, which may lead to a denial-of-service condition and execution of arbitrary code.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: VISAM
product: VBASE Editor
vendor: VISAM
product: VBASE Web-Remote Module
Published: 2020-04-03T17:51:39.000Z
CVE-2020-10600 OSIsoft PI System
An authenticated remote attacker could crash PI Archive Subsystem when the subsystem is working under memory pressure. This can result in blocking queries to PI Data Archive (2018 SP2 and prior versions).
Problem types: cwe_id: CWE-476
description: NULL POINTER DEREFERENCE CWE-476
Affected products: vendor: OSIsoft
product: PI Data Archive
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
version: 3.1
Credits: lang: en
value: William Knowles, Senior Security Consultant at Applied Risk, reported these vulnerabilities to OSIsoft
Published: 2020-07-24T23:01:05.997Z
CVE-2020-10601 
VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module allow weak hashing algorithm and insecure permissions which may allow a local attacker to bypass the password-protected mechanism through brute-force attacks, cracking techniques, or overwriting the password hash.
Problem types: cwe_id: CWE-326
description: INADEQUATE ENCRYPTION STRENGTH CWE-326
Affected products: vendor: VISAM
product: VBASE Editor
vendor: VISAM
product: VBASE Web-Remote Module
Published: 2020-04-03T17:44:30.000Z
CVE-2020-10602 
In OSIsoft PI System multiple products and versions, an authenticated remote attacker could crash PI Network Manager due to a race condition. This can result in blocking connections and queries to PI Data Archive.
Problem types: cwe_id: CWE-476
description: NULL POINTER DEREFERENCE CWE-476
Affected products: vendor: n/a
product: OSIsoft PI System multiple products and versions
Published: 2020-07-24T22:58:44.000Z
CVE-2020-10603 
WebAccess/NMS (versions prior to 3.0.2) does not properly sanitize user input and may allow an attacker to inject system commands remotely.
Problem types: cwe_id: CWE-78
description: IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN AN OS COMMAND ('OS COMMAND INJECTION') CWE-78
Affected products: vendor: n/a
product: WebAccess/NMS
Published: 2020-04-09T13:10:53.000Z
CVE-2020-10604 
In OSIsoft PI System multiple products and versions, a remote, unauthenticated attacker could crash PI Network Manager service through specially crafted requests. This can result in blocking connections and queries to PI Data Archive.
Problem types: cwe_id: CWE-248
description: UNCAUGHT EXCEPTION CWE-248
Affected products: vendor: n/a
product: OSIsoft PI System multiple products and versions
Published: 2020-07-24T23:34:55.000Z
CVE-2020-10605 
Grundfos CIM 500 before v06.16.00 responds to unauthenticated requests for password storage files.
Problem types: cwe_id: CWE-306
description: MISSING AUTHENTICATION FOR CRITICAL FUNCTION CWE-306
Affected products: vendor: Grundfos
product: CIM 500
Published: 2020-07-17T21:55:36.534Z
CVE-2020-10606 
In OSIsoft PI System multiple products and versions, a local attacker can exploit incorrect permissions set by affected PI System software. This exploitation can result in unauthorized information disclosure, deletion, or modification if the local computer also processes PI System data from other users, such as from a shared workstation or terminal server deployment.
Problem types: cwe_id: CWE-276
description: INCORRECT DEFAULT PERMISSIONS CWE-276
Affected products: vendor: n/a
product: OSIsoft PI System multiple products and versions
Published: 2020-07-24T22:55:32.000Z
CVE-2020-10607 
In Advantech WebAccess, Versions 8.4.2 and prior. A stack-based buffer overflow vulnerability caused by a lack of proper validation of the length of user-supplied data may allow remote code execution.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: n/a
product: Advantech WebAccess
Published: 2020-03-27T13:27:24.000Z
CVE-2020-10608 
In OSIsoft PI System multiple products and versions, a local attacker can plant a binary and bypass a code integrity check for loading PI System libraries. This exploitation can target another local user of PI System software on the computer to escalate privilege and result in unauthorized information disclosure, deletion, or modification.
Problem types: cwe_id: CWE-347
description: IMPROPER VERIFICATION OF CRYPTOGRAPHIC SIGNATURE CWE-347
Affected products: vendor: n/a
product: OSIsoft PI System multiple products and versions
Published: 2020-07-24T22:46:02.000Z
CVE-2020-10609 
Grundfos CIM 500 v06.16.00 stores plaintext credentials, which may allow sensitive information to be read or allow modification to system settings by someone with access to the device.
Problem types: cwe_id: CWE-256
description: UNPROTECTED STORAGE OF CREDENTIALS CWE-256
Affected products: vendor: Grundfos
product: CIM 500
Published: 2020-07-27T18:57:42.479Z
CVE-2020-10610 
In OSIsoft PI System multiple products and versions, a local attacker can modify a search path and plant a binary to exploit the affected PI System software to take control of the local computer at Windows system privilege level, resulting in unauthorized information disclosure, deletion, or modification.
Problem types: cwe_id: CWE-427
description: UNCONTROLLED SEARCH PATH ELEMENT CWE-427
Affected products: vendor: n/a
product: OSIsoft PI System multiple products and versions
Published: 2020-07-24T22:42:39.000Z
CVE-2020-10611 
Triangle MicroWorks SCADA Data Gateway 3.02.0697 through 4.0.122, 2.41.0213 through 4.0.122 allows remote attackers to execute arbitrary code due to the lack of proper validation of user-supplied data, which can result in a type confusion condition. Authentication is not required to exploit this vulnerability. Only applicable to installations using DNP3 Data Sets.
Problem types: cwe_id: CWE-843
description: ACCESS OF RESOURCE USING INCOMPATIBLE TYPE ('TYPE CONFUSION') CWE-843
Affected products: vendor: n/a
product: Triangle MicroWorks SCADA Data Gateway 3.02.0697 through 4.0.122, 2.41.0213 through 4.0.122
Published: 2020-04-15T18:36:16.000Z
CVE-2020-10612 
Opto 22 SoftPAC Project Version 9.6 and prior. SoftPACAgent communicates with SoftPACMonitor over network Port 22000. However, this port is open without any restrictions. This allows an attacker with network access to control the SoftPACAgent service including updating SoftPAC firmware, starting or stopping service, or writing to certain registry values.
Problem types: cwe_id: CWE-284
description: IMPROPER ACCESS CONTROL CWE-284
Affected products: vendor: n/a
product: Opto 22 SoftPAC Project
Published: 2020-05-14T20:33:57.000Z
CVE-2020-10613 
Triangle MicroWorks SCADA Data Gateway 3.02.0697 through 4.0.122, 2.41.0213 through 4.0.122 allows remote attackers to disclose sensitive information due to the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated structure. Authentication is not required to exploit this vulnerability. Only applicable to installations using DNP3 Data Sets.
Problem types: cwe_id: CWE-125
description: OUT-OF-BOUNDS READ CWE-125
Affected products: vendor: n/a
product: Triangle MicroWorks SCADA Data Gateway 3.02.0697 through 4.0.122, 2.41.0213 through 4.0.122
Published: 2020-04-15T18:30:42.000Z
CVE-2020-10614 
In OSIsoft PI System multiple products and versions, an authenticated remote attacker with write access to PI Vision databases could inject code into a display. Unauthorized information disclosure, deletion, or modification is possible if a victim views the infected display.
Problem types: cwe_id: CWE-79
description: IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION ('CROSS-SITE SCRIPTING') CWE-79
Affected products: vendor: n/a
product: OSIsoft PI System multiple products and versions
Published: 2020-07-24T23:43:05.000Z
CVE-2020-10615 
Triangle MicroWorks SCADA Data Gateway 3.02.0697 through 4.0.122, 2.41.0213 through 4.0.122 allows remote attackers cause a denial-of-service condition due to a lack of proper validation of the length of user-supplied data, prior to copying it to a fixed-length stack-based buffer. Authentication is not required to exploit this vulnerability.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: n/a
product: Triangle MicroWorks SCADA Data Gateway 3.02.0697 through 4.0.122, 2.41.0213 through 4.0.122
Published: 2020-04-15T18:28:01.000Z
CVE-2020-10616 
Opto 22 SoftPAC Project Version 9.6 and prior. SoftPAC does not specify the path of multiple imported .dll files. Therefore, an attacker can replace them and execute code whenever the service starts.
Problem types: cwe_id: CWE-427
description: UNCONTROLLED SEARCH PATH ELEMENT CWE-427
Affected products: vendor: n/a
product: Opto 22 SoftPAC Project
Published: 2020-05-14T20:36:36.000Z
CVE-2020-10617 
There are multiple ways an unauthenticated attacker could perform SQL injection on WebAccess/NMS (versions prior to 3.0.2) to gain access to sensitive information.
Problem types: cwe_id: CWE-89
description: IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN AN SQL COMMAND ('SQL INJECTION') CWE-89
Affected products: vendor: n/a
product: WebAccess/NMS
Published: 2020-04-09T13:05:12.000Z
CVE-2020-10618 
LCDS LAquis SCADA Versions 4.3.1 and prior. The affected product is vulnerable to sensitive information exposure by unauthorized users.
Problem types: cwe_id: CWE-200
description: EXPOSURE OF SENSITIVE INFORMATION TO AN UNAUTHORIZED ACTOR CWE-200
Affected products: vendor: n/a
product: LCDS LAquis SCADA Versions 4.3.1 and prior
Published: 2020-05-04T18:24:38.000Z
CVE-2020-10619 
An attacker could use a specially crafted URL to delete files outside the WebAccess/NMS's (versions prior to 3.0.2) control.
Problem types: cwe_id: CWE-23
description: RELATIVE PATH TRAVERSAL CWE-23
Affected products: vendor: n/a
product: WebAccess/NMS
Published: 2020-04-09T13:13:42.000Z
CVE-2020-10620 
Opto 22 SoftPAC Project Version 9.6 and prior. SoftPAC communication does not include any credentials. This allows an attacker with network access to directly communicate with SoftPAC, including, for example, stopping the service remotely.
Problem types: cwe_id: CWE-285
description: IMPROPER AUTHORIZATION CWE-285
Affected products: vendor: n/a
product: Opto 22 SoftPAC Project
Published: 2020-05-14T20:39:13.000Z
CVE-2020-10621 
Multiple issues exist that allow files to be uploaded and executed on the WebAccess/NMS (versions prior to 3.0.2).
Problem types: cwe_id: CWE-434
description: UNRESTRICTED UPLOAD OF FILE WITH DANGEROUS TYPE CWE-434
Affected products: vendor: n/a
product: WebAccess/NMS
Published: 2020-04-09T13:01:26.000Z
CVE-2020-10622 
LCDS LAquis SCADA Versions 4.3.1 and prior. The affected product is vulnerable to arbitrary file creation by unauthorized users
Problem types: cwe_id: CWE-20
description: IMPROPER INPUT VALIDATION CWE-20
Affected products: vendor: n/a
product: LCDS LAquis SCADA Versions 4.3.1 and prior
Published: 2020-05-04T18:26:04.000Z
CVE-2020-10623 
Multiple vulnerabilities could allow an attacker with low privileges to perform SQL injection on WebAccess/NMS (versions prior to 3.0.2) to gain access to sensitive information.
Problem types: cwe_id: CWE-89
description: IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN AN SQL COMMAND ('SQL INJECTION') CWE-89
Affected products: vendor: n/a
product: WebAccess/NMS
Published: 2020-04-09T13:03:30.000Z
CVE-2020-10624 
ControlEdge PLC (R130.2, R140, R150, and R151) and RTU (R101, R110, R140, R150, and R151) exposes a session token on the network.
Problem types: cwe_id: CWE-319
description: CLEARTEXT TRANSMISSION OF SENSITIVE INFORMATION CWE-319
Affected products: vendor: n/a
product: ControlEdge PLC
vendor: n/a
product: ControlEdge RTU
Published: 2020-06-26T16:22:46.000Z
CVE-2020-10625 
WebAccess/NMS (versions prior to 3.0.2) allows an unauthenticated remote user to create a new admin account.
Problem types: cwe_id: CWE-306
description: MISSING AUTHENTICATION FOR CRITICAL FUNCTION CWE-306
Affected products: vendor: n/a
product: WebAccess/NMS
Published: 2020-04-09T13:06:59.000Z
CVE-2020-10626 
In Fazecast jSerialComm, Version 2.2.2 and prior, an uncontrolled search path element vulnerability could allow a malicious DLL file with the same name of any resident DLLs inside the software installation to execute arbitrary code.
Problem types: cwe_id: CWE-427
description: UNCONTROLLED SEARCH PATH ELEMENT CWE-427
Affected products: vendor: n/a
product: Fazecast jSerialComm, Version 2.2.2 and prior
Published: 2020-05-14T15:52:13.000Z
CVE-2020-10627 
Insulet Omnipod Insulin Management System insulin pump product ID 19191 and 40160 is designed to communicate using a wireless RF with an Insulet manufactured Personal Diabetes Manager device. This wireless RF communication protocol does not properly implement authentication or authorization. An attacker with access to one of the affected insulin pump models may be able to modify and/or intercept data. This vulnerability could also allow attackers to change pump settings and control insulin delivery.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Insulet
product: Omnipod Insulin Management System
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
version: 3.1
Credits: lang: en
value: Thirdwayv Inc. reported this vulnerability to Insulet
Published: 2021-12-01T15:38:31.000Z
CVE-2020-10628 
ControlEdge PLC (R130.2, R140, R150, and R151) and RTU (R101, R110, R140, R150, and R151) exposes unencrypted passwords on the network.
Problem types: cwe_id: CWE-319
description: CLEARTEXT TRANSMISSION OF SENSITIVE INFORMATION CWE-319
Affected products: vendor: n/a
product: ControlEdge PLC
vendor: n/a
product: ControlEdge RTU
Published: 2020-06-26T16:06:26.000Z
CVE-2020-10629 
WebAccess/NMS (versions prior to 3.0.2) does not sanitize XML input. Specially crafted XML input could allow an attacker to read sensitive files.
Problem types: cwe_id: CWE-611
description: IMPROPER RESTRICTION OF XML EXTERNAL ENTITY REFERENCE CWE-611
Affected products: vendor: n/a
product: WebAccess/NMS
Published: 2020-04-09T13:12:17.000Z
CVE-2020-10630 
SAE IT-systems FW-50 Remote Telemetry Unit (RTU). The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in the output used as a webpage that is served to other users.
Problem types: cwe_id: CWE-79
description: IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION ('CROSS-SITE SCRIPTING') CWE-79
Affected products: vendor: n/a
product: SAE IT-systems FW-50 Remote Telemetry Unit (RTU)
Published: 2020-05-05T20:08:18.000Z
CVE-2020-10631 
An attacker could use a specially crafted URL to delete or read files outside the WebAccess/NMS's (versions prior to 3.0.2) control.
Problem types: cwe_id: CWE-23
description: RELATIVE PATH TRAVERSAL CWE-23
Affected products: vendor: n/a
product: WebAccess/NMS
Published: 2020-04-09T13:08:55.000Z
CVE-2020-10632 ICSA-20-140-02 Emerson OpenEnterprise
Inadequate folder security permissions in Emerson OpenEnterprise versions through 3.3.4 may allow modification of important configuration files, which could cause the system to fail or behave in an unpredictable manner.
Problem types: cwe_id: CWE-282
description: CWE-282: Improper Ownership Management
Affected products: vendor: Emerson
product: OpenEnterprise SCADA Software
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Roman Lozko of Kaspersky reported these vulnerabilities to Emerson.
Published: 2022-02-24T18:50:14.000Z
CVE-2020-10633 
A non-persistent XSS (cross-site scripting) vulnerability exists in eWON Flexy and Cosy (all firmware versions prior to 14.1s0). An attacker could send a specially crafted URL to initiate a password change for the device. The target must introduce the credentials to the gateway before the attack can be successful.
Problem types: cwe_id: CWE-79
description: IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION ('CROSS-SITE SCRIPTING') CWE-79
Affected products: vendor: n/a
product: eWON Flexy and Cosy
Published: 2020-04-08T00:03:25.000Z
CVE-2020-10634 
SAE IT-systems FW-50 Remote Telemetry Unit (RTU). A specially crafted request could allow an attacker to view the file structure of the affected device and access files that should be inaccessible.
Problem types: cwe_id: CWE-22
description: IMPROPER LIMITATION OF A PATHNAME TO A RESTRICTED DIRECTORY ('PATH TRAVERSAL') CWE-22
Affected products: vendor: n/a
product: SAE IT-systems FW-50 Remote Telemetry Unit (RTU)
Published: 2020-05-05T20:10:07.000Z
CVE-2020-10635 ICSA-20-098-05 KUKA.Sim Pro Improper Enforcement of Message Integrity During Transmission in a Communication Channel
Simulation models for KUKA.Sim Pro version 3.1 are hosted by a server maintained by KUKA. When these devices request a model, the server transmits the model in plaintext.
Problem types: cwe_id: CWE-924
description: CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel
Affected products: vendor: KUKA
product: Sim Pro
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Federico Maggi of Trend Micro reported this vulnerability to CISA.
Published: 2022-02-24T18:27:18.000Z
CVE-2020-10636 ICSA-20-140-02 Emerson OpenEnterprise
Inadequate encryption may allow the passwords for Emerson OpenEnterprise versions through 3.3.4 user accounts to be obtained.
Problem types: cwe_id: CWE-326
description: CWE-326: Inadequate Encryption Strength
Affected products: vendor: Emerson
product: OpenEnterprise SCADA Software
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Roman Lozko of Kaspersky reported these vulnerabilities to Emerson.
Published: 2022-02-24T18:50:16.000Z
CVE-2020-10637 
Eaton HMiSoft VU3 (HMIVU3 runtime not impacted), Version 3.00.23 and prior, however, the HMIVU runtimes are not impacted by these issues. A specially crafted input file could trigger an out-of-bounds read when loaded by the affected product.
Problem types: cwe_id: CWE-125
description: OUT-OF-BOUNDS READ CWE-125
Affected products: vendor: n/a
product: Eaton HMiSoft VU3 (HMIVU3 runtime not impacted)
Published: 2020-04-15T16:44:02.000Z
CVE-2020-10638 
Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple heap-based buffer overflow vulnerabilities exist caused by a lack of proper validation of the length of user-supplied data, which may allow remote code execution.
Problem types: cwe_id: CWE-122
description: HEAP-BASED BUFFER OVERFLOW CWE-122
Affected products: vendor: n/a
product: Advantech WebAccess Node
Published: 2020-05-08T11:49:32.000Z
CVE-2020-10639 
Eaton HMiSoft VU3 (HMIVU3 runtime not impacted), Version 3.00.23 and prior, however, the HMIVU runtimes are not impacted by these issues. A specially crafted input file could cause a buffer overflow when loaded by the affected product.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: n/a
product: Eaton HMiSoft VU3 (HMIVU3 runtime not impacted)
Published: 2020-04-15T16:48:04.000Z
CVE-2020-10640 ICSA-20-140-02 Emerson OpenEnterprise
Emerson OpenEnterprise versions through 3.3.4 may allow an attacker to run an arbitrary commands with system privileges or perform remote code execution via a specific communication service.
Problem types: cwe_id: CWE-306
description: CWE-306: Missing Authentication for Critical Function
Affected products: vendor: Emerson
product: OpenEnterprise SCADA Software
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Roman Lozko of Kaspersky reported these vulnerabilities to Emerson.
Published: 2022-02-24T18:50:15.000Z
CVE-2020-10641 
An unprotected logging route may allow an attacker to write endless log statements into the database without space limits or authentication. This results in consuming the entire available hard-disk space on the Ignition 8 Gateway (versions prior to 8.0.10), causing a denial-of-service condition.
Problem types: cwe_id: CWE-284
description: IMPROPER ACCESS CONTROLS CWE-284
Affected products: vendor: n/a
product: Ignition 8 Gateway
Published: 2020-04-28T18:22:57.000Z