WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product symphony✕
Overview 18 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 5 public PoC · 0 EPSS ≥ 0.5
18matches 0in Waratek scope0.0% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 5public PoC27.8% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 18 100.0% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 18 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 18 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 5 27.8% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 13 72.2%
split by peak 6 / year
Not applicable: 18 High: 18 not blocked: 18 No public exploit: 13Working exploit published: 5
20082 Not applicable2 High2 not blocked2 Working exploit published2 20090 20102 Not applicable2 High2 not blocked2 Working exploit published2 20111 Not applicable1 High1 not blocked1 No public exploit1 20121 Not applicable1 High1 not blocked1 No public exploit1 20130 20141 Not applicable1 High1 not blocked1 No public exploit1 20150 20161 Not applicable1 High1 not blocked1 Working exploit published1 20171 Not applicable1 High1 not blocked1 No public exploit1 20182 Not applicable2 High2 not blocked2 No public exploit2 20190 20206 Not applicable6 High6 not blocked6 No public exploit6 20210 20220 20231 Not applicable1 High1 not blocked1 No public exploit1
20092011201320152017201920212023
18 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2023-0228 High 2023-03-02 Not applicable No public exploit Improper Authentication vulnerability in ABB Symphony Plus S+ Operations.This issue affects Symphony Plus S+ Operations: from 2.X through 2.1 SP2, 2.2, from 3.X through 3.3 SP1, 3.3 SP2.
CVE-2020-24680 High 2020-12-22 Not applicable No public exploit In S+ Operations and S+ Historian, the passwords of internal users (not Windows Users) are encrypted but improperly stored in a database.
CVE-2020-24678 High 2020-12-22 Not applicable No public exploit An authenticated user might execute malicious code under the user context and take control of the system. S+ Operations or S+ Historian database is affected by multiple vulnerabilities such as the possibility to allow remote authenticated users to gain high privileges.
CVE-2020-24677 High 2020-12-22 Not applicable No public exploit Vulnerabilities in the S+ Operations and S+ Historian web applications can lead to a possible code execution and privilege escalation, redirect the user somewhere else or download unwanted data.
CVE-2020-24676 High 2020-12-22 Not applicable No public exploit In Symphony Plus Operations and Symphony Plus Historian, some services can be vulnerable to privilege escalation attacks. An unprivileged (but authenticated) user could execute arbitrary code and result in privilege escalation, depending on the user that the service runs as.
CVE-2020-24674 High 2020-12-22 Not applicable No public exploit In S+ Operations and S+ Historian, not all client commands correctly check user permission as expected. Authenticated but Unauthorized remote users could execute a Denial-of-Service (DoS) attack, execute arbitrary code, or obtain more privilege than intended on the machines.
CVE-2020-17405 High 2020-09-01 Not applicable No public exploit This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Senstar Symphony 7.3.2.2. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SSOAuth process. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-10980.
CVE-2018-1702 High 2018-09-28 Not applicable No public exploit IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 are vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 146189.
CVE-2018-1595 High 2018-08-01 Not applicable No public exploit IBM Spectrum Symphony and Platform Symphony 7.1.2 and 7.2.0.2 could allow an authenticated user to execute arbitrary commands due to improper handling of user supplied input. IBM X-Force ID: 143622.
CVE-2017-7694 High 2017-04-11 Not applicable No public exploit Remote Code Execution vulnerability in symphony/content/content.blueprintsdatasources.php in Symphony CMS through 2.6.11 allows remote attackers to execute code and get a webshell from the back-end. The attacker must be authenticated and enter PHP code in the datasource editor or event editor.
CVE-2016-4309 High 2016-06-30 Not applicable Working exploit published Session fixation vulnerability in Symphony CMS 2.6.7, when session.use_only_cookies is disabled, allows remote attackers to hijack web sessions via the PHPSESSID parameter.
CVE-2013-5400 High 2014-02-14 Not applicable No public exploit An unspecified servlet in IBM Platform Symphony Developer Edition (DE) 5.2 and 6.1.x through 6.1.1 has hardcoded credentials, which allows remote attackers to bypass authentication and obtain "local environment" access via unknown vectors.
CVE-2012-0192 High 2012-01-23 Not applicable No public exploit Multiple integer overflows in vclmi.dll in the visual class library module in IBM Lotus Symphony before 3.0.1 might allow remote attackers to execute arbitrary code via an embedded (1) JPEG or (2) PNG image object in a Symphony document that triggers a heap-based buffer overflow, as demonstrated by a .doc file.
CVE-2011-2884 High 2011-07-27 Not applicable No public exploit Multiple unspecified vulnerabilities in IBM Lotus Symphony 3 before FP3 have unknown impact and attack vectors, related to "critical security vulnerability issues."
CVE-2010-3458 High 2010-09-17 Not applicable Working exploit published SQL injection vulnerability in lib/toolkit/events/event.section.php in Symphony CMS 2.0.7 and 2.1.1 allows remote attackers to execute arbitrary SQL commands via the send-email[recipient] parameter to about/. NOTE: some of these details are obtained from third party information.
CVE-2010-2143 High 2010-06-03 Not applicable Working exploit published Directory traversal vulnerability in index.php in Symphony CMS 2.0.7 allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the mode parameter.
CVE-2008-3592 High 2008-08-11 Not applicable Working exploit published Unrestricted file upload vulnerability in the File Manager in the admin panel in Twentyone Degrees Symphony 1.7.01 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension to a directory specified in the destination parameter, then accessing the uploaded file via a direct request, as demonstrated using workspace/masters/.
CVE-2008-3591 High 2008-08-11 Not applicable Working exploit published SQL injection vulnerability in lib/class.admin.php in Twentyone Degrees Symphony 1.7.01 and earlier allows remote attackers to execute arbitrary SQL commands via the sym_auth cookie in a /publish/filemanager/ request to index.php.