CVE-2014-0751

The GE Proficy HMI/SCADA - CIMPLICITY application (versions 4.01 to 8.2 ) and Proficy Process Systems with CIMPLICITY are vulnerable to a path traversal vulnerability (CWE-22) in the CimWebServer component (specifically CimWebServer.exe or the WebView component). Due to insufficient checks on the...

CVE-2014-0750: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in gefebt.exe in the WebView CimWeb components in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY through 8.2 SIM 24, and Proficy Process Systems with CIMPLICITY, allows remote attackers to execute arbitrary code via a crafted HTTP request, aka ZDI-CAN-16...

PT-2014-3814

Name of the Vulnerable Software and Affected Versions GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY versions prior to 8.2 SIM 24 Proficy Process Systems with CIMPLICITY versions prior to 8.2 SIM 24 Description The issue allows remote attackers to execute arbitrary code via a crafted...

CVE-2013-2811

The 1 Catapult DNP3 I/O driver before 7.2.0.60 and the 2 GE Intelligent Platforms Proficy DNP3 I/O driver before 7.20k, as used in DNPDrv.exe aka the DNP master station server in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY and iFIX, allow remote attackers to cause a denial of service...

CVE-2013-2811

CVE-2013-2811 describes an improper input validation in the Catapult DNP3 driver (Catapult v7.2.0.60 and earlier) and GE Proficy DNP3 I/O Driver (v7.20k and earlier), used by GE iFIX/CIMPLICITY DNP3 master stations (DNPDrv.exe). A crafted DNP3 TCP packet can trigger an unhandled exception or deni...

PT-2013-3945

Name of the Vulnerable Software and Affected Versions Catapult DNP3 I/O driver versions prior to 7.2.0.60 GE Intelligent Platforms Proficy DNP3 I/O driver versions prior to 7.20k Description The issue allows remote attackers to cause a denial of service, resulting in an infinite loop, by sending ...

CVE-2013-2811: Improper Input Validation

The 1 Catapult DNP3 I/O driver before 7.2.0.60 and the 2 GE Intelligent Platforms Proficy DNP3 I/O driver before 7.20k, as used in DNPDrv.exe aka the DNP master station server in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY and iFIX, allow remote attackers to cause a denial of service...

CVE-2013-2823: Improper Input Validation

The 1 Catapult DNP3 I/O driver before 7.2.0.60 and the 2 GE Intelligent Platforms Proficy DNP3 I/O driver before 7.20k, as used in DNPDrv.exe aka the DNP master station server in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY and iFIX, allow physically proximate attackers to cause a deni...

PT-2013-3952

Name of the Vulnerable Software and Affected Versions Catapult DNP3 I/O driver versions prior to 7.2.0.60 GE Intelligent Platforms Proficy DNP3 I/O driver versions prior to 7.20k Description The issue allows physically proximate attackers to cause a denial of service, resulting in an infinite loo...

CVE-2013-2785

Multiple buffer overflows in CimWebServer.exe in the WebView component in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY before 8.0 SIM 27, 8.1 before SIM 25, and 8.2 before SIM 19, and Proficy Process Systems with CIMPLICITY, allow remote attackers to execute arbitrary code via crafted...

Buffer overflow

Multiple buffer overflows in CimWebServer.exe in the WebView component in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY before 8.0 SIM 27, 8.1 before SIM 25, and 8.2 before SIM 19, and Proficy Process Systems with CIMPLICITY, allow remote attackers to execute arbitrary code via crafted...

CVE-2013-2785: Improper Restriction of Operations within the Bounds of a Memory Buffer

Multiple buffer overflows in CimWebServer.exe in the WebView component in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY before 8.0 SIM 27, 8.1 before SIM 25, and 8.2 before SIM 19, and Proficy Process Systems with CIMPLICITY, allow remote attackers to execute arbitrary code via crafted...

Directory traversal

Directory traversal vulnerability in substitute.bcl in the WebView CimWeb subsystem in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY 4.01 through 8.0, and Proficy Process Systems with CIMPLICITY, allows remote attackers to read arbitrary files via a crafted packet...

PT-2013-2504

Name of the Vulnerable Software and Affected Versions GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY versions 4.01 through 8.0 Proficy Process Systems with CIMPLICITY affected versions not specified Description The issue allows remote attackers to execute arbitrary commands or cause a...

CVE-2013-0652: Undefined Security Weakness

GE Intelligent Platforms Proficy Real-Time Information Portal does not restrict access to methods of an unspecified Java class, which allows remote attackers to obtain a username listing via an RMI call...

CVE-2013-0653: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in substitute.bcl in the WebView CimWeb subsystem in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY 4.01 through 8.0, and Proficy Process Systems with CIMPLICITY, allows remote attackers to read arbitrary files via a crafted packet...

CVE-2013-0651: Undefined Security Weakness

The Portal installation process in GE Intelligent Platforms Proficy Real-Time Information Portal stores sensitive information under the web root with insufficient access control, which allows remote attackers to read configuration files, and discover data-source credentials, via a direct request...

CVE-2013-0654: Improper Input Validation

CimWebServer in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY 4.01 through 8.0, and Proficy Process Systems with CIMPLICITY, allows remote attackers to execute arbitrary commands or cause a denial of service daemon crash via a crafted packet...

CVE-2012-4689: Undefined Security Weakness

Integer overflow in CimWebServer.exe in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY 4.01 through 8.0, and Proficy Process Systems with CIMPLICITY, allows remote attackers to cause a denial of service daemon crash via a malformed HTTP request...

CVE-2012-3010: Improper Input Validation

rifsrvd.exe in the Remote Interface Service in GE Intelligent Platforms Proficy Real-Time Information Portal 2.6 through 3.5 SP1 allows remote attackers to cause a denial of service memory corruption and service crash or possibly execute arbitrary code via long input data, a different vulnerabili...