PT-2023-21879 · Unknown · Conprosys Hmi System

Name of the Vulnerable Software and Affected Versions: CONPROSYS HMI System CHS versions prior to 3.5.3 Description: An issue exists due to improper access control, allowing a user of the PC where the affected product is installed to potentially gain administrative privileges. This could result i...

CVE-2023-28399

Incorrect permission assignment for critical resource exists in CONPROSYS HMI System CHS versions prior to 3.5.3. ACL Access Control List is not appropriately set to the local folder where the affected product is installed, therefore a wide range of privileges is permitted to a user of the PC whe...

CVE-2023-28713

The CVE-2023-28713 entry concerns CONPROSYS HMI System (CHS) prior to version 3.5.3, where account information for the database is stored in plaintext in a local file. This allows someone with access to the host PC to obtain sensitive data and potentially modify database contents. The vulnerabili...

CVE-2023-28824

Server-side request forgery vulnerability exists in CONPROSYS HMI System CHS versions prior to 3.5.3. A user who can access the affected product with an administrative privilege may bypass the database restriction set on the query setting page, and connect to a user unintended database...

CVE-2023-28713

Plaintext storage of a password exists in CONPROSYS HMI System CHS versions prior to 3.5.3. Because account information of the database is saved in a local file in plaintext, a user who can access the PC where the affected product is installed can obtain the information. As a result, information ...

CVE-2023-28651

Cross-site scripting vulnerability exists in CONPROSYS HMI System CHS versions prior to 3.5.3. If a user who can access the affected product with an administrative privilege configures specially crafted settings, an arbitrary script may be executed on the web browser of the other user who is...

CVE-2023-28713

Plaintext storage of a password exists in CONPROSYS HMI System CHS versions prior to 3.5.3. Because account information of the database is saved in a local file in plaintext, a user who can access the PC where the affected product is installed can obtain the information. As a result, information ...

CVE-2023-28651

CONPROSYS HMI System (CHS)

CVE-2023-28651

Cross-site scripting vulnerability exists in CONPROSYS HMI System CHS versions prior to 3.5.3. If a user who can access the affected product with an administrative privilege configures specially crafted settings, an arbitrary script may be executed on the web browser of the other user who is...

CVE-2023-28657

CVE-2023-28657 refers to an improper access control vulnerability in CONPROSYS HMI System (CHS) versions prior to 3.5.3. The affected product runs on CHS where a local PC user may gain administrative privileges, potentially exposing and modifying product information. The CVE is associated with CH...

CVE-2023-29154

SQL injection vulnerability exists in the CONPROSYS HMI System CHS versions prior to 3.5.3. A user who can access the affected product with an administrative privilege may execute an arbitrary SQL command via specially crafted input to the query setting page...

CVE-2023-29154

SQL injection vulnerability exists in the CONPROSYS HMI System CHS versions prior to 3.5.3. A user who can access the affected product with an administrative privilege may execute an arbitrary SQL command via specially crafted input to the query setting page...

CVE-2023-29154

CVE-2023-29154 affects Contec CONPROSYS HMI System (CHS) prior to version 3.5.3. The vulnerability is an SQL injection that allows a user with administrative privileges to execute arbitrary SQL commands through specially crafted input on the query setting page. Several sources (including CVE list...

CVE-2023-2758

A denial of service vulnerability exists in Contec CONPROSYS HMI System versions 3.5.2 and prior. When there is a time-zone mismatch in certain configuration files, a remote, unauthenticated attacker may deny logins for an extended period of time...

Denial of service

A denial of service vulnerability exists in Contec CONPROSYS HMI System versions 3.5.2 and prior. When there is a time-zone mismatch in certain configuration files, a remote, unauthenticated attacker may deny logins for an extended period of time...

CVE-2023-2758 Contec CONPROSYS HMI System (CHS) v3.5.2 Denial of Service

A denial of service vulnerability exists in Contec CONPROSYS HMI System versions 3.5.2 and prior. When there is a time-zone mismatch in certain configuration files, a remote, unauthenticated attacker may deny logins for an extended period of time...

CVE-2023-2758

Contec CONPROSYS HMI System (CHS) versions 3.5.2 and earlier are affected by CVE-2023-2758: a time-zone mismatch in certain configuration files allows a remote, unauthenticated attacker to deny logins for an extended period. A fix is available in Ver.3.5.3 as reported by the vendor/developer coor...

CVE-2023-2758 Contec CONPROSYS HMI System (CHS) v3.5.2 Denial of Service

A denial of service vulnerability exists in Contec CONPROSYS HMI System versions 3.5.2 and prior. When there is a time-zone mismatch in certain configuration files, a remote, unauthenticated attacker may deny logins for an extended period of time...

Contec CONPROSYS HMI System 安全漏洞

Contec CONPROSYS HMI System is an HTML5-based HMI Human Machine Interface/SCADA Supervisory Control and Data Acquisition software product from Contec Japan. A security vulnerability exists in Contec CONPROSYS HMI System version 3.5.2 and earlier, which stems from the presence of a denial of servi...

PT-2023-3009 · Unknown · Conprosys Hmi System

Name of the Vulnerable Software and Affected Versions: CONPROSYS HMI System CHS versions prior to 3.5.3 Description: A server-side request forgery issue exists, allowing an attacker with administrative privileges to bypass database restrictions and connect to unintended databases. The vulnerabili...