CVSS: 7.5EPSS: 1%CPEs: 2EXPL: 1CVE-2020-19419 – Emerson Smart Wireless Gateway 1420 4.6.59 Missing Authentication
https://notcve.org/view.php?id=CVE-2020-19419
Incorrect Access Control in Emerson Smart Wireless Gateway 1420 4.6.59 allows remote attackers to obtain sensitive device information from the administrator console without authentication. Un Control de Acceso Incorrecto en Emerson Smart Wireless Gateway 1420 versión 4.6.59, permite a atacantes remotos obtener información confidencial del dispositivo desde la consola del administrador sin autenticación Emerson Smart Wireless Gateway version 1420 4.6.59 suffers from a missing authentication vulnerability. • http://packetstormsecurity.com/files/161701/Emerson-Smart-Wireless-Gateway-1420-4.6.59-Missing-Authentication.html https://cwe.mitre.org/data/definitions/306.html • CWE-306: Missing Authentication for Critical Function •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1CVE-2020-19417 – Emerson Smart Wireless Gateway 1420 4.6.59 Privilege Escalation
https://notcve.org/view.php?id=CVE-2020-19417
Emerson Smart Wireless Gateway 1420 4.6.59 allows non-privileged users (such as the default account 'maint') to perform administrative tasks by sending specially crafted HTTP requests to the application. Emerson Smart Wireless Gateway versión 1420 4.6.59, permite a usuarios no privilegiados (como la cuenta predeterminada "maint") llevar a cabo tareas administrativas mediante el envío de peticiones HTTP especialmente diseñadas a la aplicación Emerson Smart Wireless Gateway version 1420 4.6.59 suffers from a privilege escalation vulnerability. • http://packetstormsecurity.com/files/161700/Emerson-Smart-Wireless-Gateway-1420-4.6.59-Privilege-Escalation.html •
CVSS: 7.8EPSS: 0%CPEs: 23EXPL: 0CVE-2020-12525 – WAGO/M&M Software Deserialization of untrusted data in fdtCONTAINER component
https://notcve.org/view.php?id=CVE-2020-12525
M&M Software fdtCONTAINER Component in versions below 3.5.20304.x and between 3.6 and 3.6.20304.x is vulnerable to deserialization of untrusted data in its project storage. El componente fdtCONTAINER de M&M Software en versiones por debajo de 3.5.20304.x y entre 3.6 y 3.6.20304.x, es vulnerable a una deserialización de datos que no son de confianza en el almacenamiento de su proyecto • https://cert.vde.com/en-us/advisories/vde-2020-038 https://us-cert.cisa.gov/ics/advisories/icsa-21-021-05 • CWE-502: Deserialization of Untrusted Data •
CVSS: 7.5EPSS: 0%CPEs: 8EXPL: 0CVE-2020-27254
https://notcve.org/view.php?id=CVE-2020-27254
Emerson Rosemount X-STREAM Gas AnalyzerX-STREAM enhanced XEGP, XEGK, XEFD, XEXF – all revisions, The affected products are vulnerable to improper authentication for accessing log and backup data, which could allow an attacker with a specially crafted URL to obtain access to sensitive information. Emerson Rosemount X-STREAM Gas AnalyzerX-STREAM mejorado XEGP, XEGK, XEFD, XEXF – todas las revisiones, Los productos afectados son vulnerables a una autenticación inapropiada para acceder a los datos de registro y respaldo, lo que podría permitir a un atacante con una URL especialmente diseñada obtener acceso a información confidencial • https://us-cert.cisa.gov/ics/advisories/icsa-20-352-01 • CWE-287: Improper Authentication •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-6971
https://notcve.org/view.php?id=CVE-2020-6971
In Emerson ValveLink v12.0.264 to v13.4.118, a vulnerability in the ValveLink software may allow a local, unprivileged, trusted insider to escalate privileges due to insecure configuration parameters. En Emerson ValveLink versiones 12.0.264 hasta 13.4.118, una vulnerabilidad en el software ValveLink puede permitir a un insider local, no privilegiado y de confianza, escalar privilegios debido a parámetros de configuración no seguros. • https://www.us-cert.gov/ics/advisories/icsa-20-063-01 • CWE-269: Improper Privilege Management CWE-284: Improper Access Control •