https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 19:43:39 +0000 https://cve.radiocsirt.org/vuln/bdu:2023-04014 bdu:2023-04014 https://cve.radiocsirt.org/vuln/bdu:2023-04014 https://cve.radiocsirt.org/vuln/euvd-2026-208762 EUVD-2026-208762 https://cve.radiocsirt.org/vuln/euvd-2026-208762 https://cve.radiocsirt.org/vuln/fkie_cve-2023-2637 <p>Rockwell Automation&#39;s FactoryTalk System Services uses a hard-coded cryptographic key to generate administrator cookies.  Hard-coded cryptographic key may lead to privilege escalation.  This vulnerability may allow a local, authenticated non-admin user to generate an invalid administrator cookie giving them administrative privileges to the FactoryTalk Policy Manger database. This may allow the threat actor to make malicious changes to the database that will be deployed when a legitimate FactoryTalk Policy Manager user deploys a security policy model. User interaction is required for this vulnerability to be successfully exploited.</p> <p>Rockwell Automation&#39;s FactoryTalk System Services uses a hard-coded cryptographic key to generate administrator cookies.  Hard-coded cryptographic key may lead to privilege escalation.  This vulnerability may allow a local, authenticated non-admin user to generate an invalid administrator cookie giving them administrative privileges to the FactoryTalk Policy Manger database. This may allow the threat actor to make malicious changes to the database that will be deployed when a legitimate FactoryTalk Policy Manager user deploys a security policy model. User interaction is required for this vulnerability to be successfully exploited.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-2637 https://cve.radiocsirt.org/vuln/ghsa-v84g-528v-42pp <p>Rockwell Automation&#39;s FactoryTalk System Services uses a hard-coded cryptographic key to generate administrator cookies.  Hard-coded cryptographic key may lead to privilege escalation.  This vulnerability may allow a local, authenticated non-admin user to generate an invalid administrator cookie giving them administrative privileges to the FactoryTalk Policy Manger database. This may allow the threat actor to make malicious changes to the database that will be deployed when a legitimate FactoryTalk Policy Manager user deploys a security policy model. User interaction is required for this vulnerability to be successfully exploited.</p> <p>Rockwell Automation&#39;s FactoryTalk System Services uses a hard-coded cryptographic key to generate administrator cookies.  Hard-coded cryptographic key may lead to privilege escalation.  This vulnerability may allow a local, authenticated non-admin user to generate an invalid administrator cookie giving them administrative privileges to the FactoryTalk Policy Manger database. This may allow the threat actor to make malicious changes to the database that will be deployed when a legitimate FactoryTalk Policy Manager user deploys a security policy model. User interaction is required for this vulnerability to be successfully exploited.</p> https://cve.radiocsirt.org/vuln/ghsa-v84g-528v-42pp https://cve.radiocsirt.org/vuln/gsd-2023-2637 gsd-2023-2637 https://cve.radiocsirt.org/vuln/gsd-2023-2637 https://cve.radiocsirt.org/vuln/icsa-23-164-02 <p>Hard-coded cryptographic key vulnerabilities could lead to privilege escalation. FactoryTalk System Services uses a hard-coded cryptographic key to generate administrator cookies. This vulnerability could allow a local authenticated non-admin user to generate an invalid administrator cookie giving them administrative privileges to the FactoryTalk Policy Manger database. The threat actor could make malicious changes to the database to be deployed when a legitimate FactoryTalk Policy Manager user deploys a security policy model. User interaction is required to successfully exploit this vulnerability. Improper authorization in FTSSBackupRestore.exe could lead to the loading of malicious configuration archives. FactoryTalk System Services does not verify that backup configuration archives are password protected. This vulnerability could allow a local authenticated non-admin user to craft a malicious backup archive without password protection to be loaded by FactoryTalk System Services as a valid backup when a restore procedure takes place. This vulnerability requires user interaction for successful exploitation. Origin validation errors could lead to information disclosure. The underlying feedback mechanism of FactoryTalk System Services that transfers the FactoryTalk Policy Manager rules to relevant devices on the network does not verify that the origin of the communication is from a legitimate local client device. This could allow a threat actor to craft a malicious website th…</p> <p>Hard-coded cryptographic key vulnerabilities could lead to privilege escalation. FactoryTalk System Services uses a hard-coded cryptographic key to generate administrator cookies. This vulnerability could allow a local authenticated non-admin user to generate an invalid administrator cookie giving them administrative privileges to the FactoryTalk Policy Manger database. The threat actor could make malicious changes to the database to be deployed when a legitimate FactoryTalk Policy Manager user deploys a security policy model. User interaction is required to successfully exploit this vulnerability. Improper authorization in FTSSBackupRestore.exe could lead to the loading of malicious configuration archives. FactoryTalk System Services does not verify that backup configuration archives are password protected. This vulnerability could allow a local authenticated non-admin user to craft a malicious backup archive without password protection to be loaded by FactoryTalk System Services as a valid backup when a restore procedure takes place. This vulnerability requires user interaction for successful exploitation. Origin validation errors could lead to information disclosure. The underlying feedback mechanism of FactoryTalk System Services that transfers the FactoryTalk Policy Manager rules to relevant devices on the network does not verify that the origin of the communication is from a legitimate local client device. This could allow a threat actor to craft a malicious website th…</p> https://cve.radiocsirt.org/vuln/icsa-23-164-02