The vulnerability of the AVEVA Enterprise Data Management Web (eDNA Web) software platform, related to the lack of measures taken to protect the SQL query structure, allows a hacker to execute arbitrary SQL commands.

The vulnerability of the AVEVA Enterprise Data Management Web eDNA Web software platform is related to the lack of security measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL commands remotely...

Aveva eDNA Enterprise SQL Injection (CVE-2020-13499; CVE-2020-13500; CVE-2020-13501)

An SQL injection vulnerability exists in Aveva eDNA Enterprise. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary SQL commands on the affected system...

Aveva eDNA Enterprise Data Historian Alias.asmx SQL injection Vulnerability

Talos Vulnerability Report TALOS-2020-1109 Aveva eDNA Enterprise Data Historian Alias.asmx SQL injection Vulnerability September 23, 2020 CVE Number CVE-2020-13507, CVE-2020-13508 Summary Multiple SQL injection vulnerabilities exist in the Alias.asmx Web Service functionality of eDNA Enterprise...

Aveva eDNA Enterprise Data Historian FavoritesService.asmx SQL injection Vulnerability

Talos Vulnerability Report TALOS-2020-1097 Aveva eDNA Enterprise Data Historian FavoritesService.asmx SQL injection Vulnerability September 23, 2020 CVE Number CVE-2020-6153 Summary An exploitable SQL injection vulnerability exists in the FavoritesService.asmx Web Service functionality of eDNA...

Aveva eDNA Enterprise data historian DNAPoints.asmx SQL injection vulnerability

Talos Vulnerability Report TALOS-2020-1107 Aveva eDNA Enterprise data historian DNAPoints.asmx SQL injection vulnerability September 23, 2020 CVE Number CVE-2020-13502 Summary An exploitable SQL injection vulnerability exists in the DNAPoints.asmx web Service functionality of eDNA Enterprise Data...

Aveva eDNA Enterprise data historian CHaD.asmx multiple SQL injection vulnerabilities

Talos Vulnerability Report TALOS-2020-1106 Aveva eDNA Enterprise data historian CHaD.asmx multiple SQL injection vulnerabilities September 23, 2020 CVE Number CVE-2020-13501,CVE-2020-13499,CVE-2020-13500 SUMMARY Multiple SQL injection vulnerabilities exists in the CHaD.asmx web service...

AVEVA eDNA Enterprise Data Historian SQL Injection Vulnerability (CNVD-2025-24160)

Aveva eDNA Enterprise Data Historian is a real-time historical data management software from AVEVA Aveva UK. The software collects, stores, processes, and presents asset-related information to provide better information for decision making this. A SQL injection vulnerability exists in AVEVA eDNA...

AVEVA Enterprise Data Management Web

1. EXECUTIVE SUMMARY CVSS v3 9.6 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: AVEVA Equipment: Enterprise Data Management Web Vulnerability: SQL Injection 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary SQL...

CVE-2019-13537

The IEC870IP driver for AVEVA’s Vijeo Citect and Citect SCADA and Schneider Electric’s Power SCADA Operation has a buffer overflow vulnerability that could result in a server-side crash...

CVE-2019-13537

The CVE-2019-13537 issue affects the IEC870IP driver used in AVEVA’s Vijeo Citect and Citect SCADA and Schneider Electric’s Power SCADA Operation. The vulnerability is a stack-based buffer overflow in the IEC870IP driver (versions 4.14.02 and earlier) that could lead to a server-side crash. Red H...

CVE-2019-13537

The IEC870IP driver for AVEVA’s Vijeo Citect and Citect SCADA and Schneider Electric’s Power SCADA Operation has a buffer overflow vulnerability that could result in a server-side crash...

Aveva Indusoft Web Studio Remote Code Execution (CVE-2018-10620)

A buffer overflow vulnerability exists in Aveva Indusoft Web Studio. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system or cause application crashes...

AVEVA IEC870IP Driver CVE-2019-13537 Stack Buffer Overflow Vulnerability

...

AVEVA Vijeo Citect and Citect SCADA Floating License Manager

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION : Exploitable remotely/low skill level to exploit Vendor : AVEVA Equipment : Vijeo Citect and Citect SCADA Floating License Manager Vulnerabilities : Improper Input Validation, Memory Corruption 2. RISK EVALUATION These vulnerabilities could allow an...

Schneider Electric Floating License Manager ICSA-19-192-07 Multiple Security Vulnerabilities

Description Schneider Electric Floating License Manager is prone to multiple security vulnerabilities Attackers can exploit these issues to shut down the affected device, denying service to legitimate users. Floating License Manager version 2.3.0.0 and prior are vulnerable. Technologies Affected...

AVEVA Vijeo Citect and CitectSCADA

1. EXECUTIVE SUMMARY CVSS v3 6.5 ATTENTION: Low skill level to exploit Vendor: AVEVA Equipment: Vijeo Citect and CitectSCADA Vulnerability: Insufficiently Protected Credentials 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a locally authenticated user to obtain...

Schneider Electric AVEVA Vijeo Citect and Schneider Electric AVEVA CitectSCADA Insecure Credential Storage Vulnerability

Schneider Electric AVEVA Vijeo Citect and Schneider Electric AVEVA CitectSCADA are both data acquisition and monitoring system SCADA software packages from Schneider Electric, France. A security vulnerability exists in Schneider Electric AVEVA Vijeo Citect and Schneider Electric AVEVA CitectSCADA...

CVE-2019-6525

AVEVA Wonderware System Platform 2017 Update 2 and prior uses an ArchestrA network user account for authentication of system processes and inter-node communications. A user with low privileges could make use of an API to obtain the credentials for this account...

Default credentials

AVEVA Wonderware System Platform 2017 Update 2 and prior uses an ArchestrA network user account for authentication of system processes and inter-node communications. A user with low privileges could make use of an API to obtain the credentials for this account...

CVE-2019-6525

CVE-2019-6525 affects AVEVA Wonderware System Platform 2017 Update 2 and earlier. The vulnerability arises because the system uses an ArchestrA network user account for authentication of system processes and inter-node communications, and a user with low privileges can call an API to obtain the c...