CVE-2023-35124

Open Automation Software OAS Platform v18.00.0072 is affected by CVE-2023-35124 in the Engine configuration management functionality. A specially crafted sequence of network requests can disclose sensitive information stored by the OAS Platform. Talos’ vulnerability report confirms the vulnerabil...

CVE-2023-34353

An authentication bypass vulnerability exists in the OAS Engine authentication functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted network sniffing can lead to decryption of sensitive information. An attacker can sniff network traffic to trigger this...

CVE-2023-35124: Generation of Error Message Containing Sensitive Information

An information disclosure vulnerability exists in the OAS Engine configuration management functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted series of network requests can lead to a disclosure of sensitive information. An attacker can send a sequence of reques...

CVE-2023-34994: Allocation of Resources Without Limits or Throttling

An improper resource allocation vulnerability exists in the OAS Engine configuration management functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted series of network requests can lead to creation of an arbitrary directory. An attacker can send a sequence of...

PT-2023-24834 · Open Automation · Open Automation Software Oas Platform

Name of the Vulnerable Software and Affected Versions: Open Automation Software OAS Platform version 18.00.0072 Description: An authentication bypass vulnerability exists in the OAS Engine authentication functionality. A specially crafted network sniffing can lead to decryption of sensitive...

CVE-2023-34317: Improper Input Validation

An improper input validation vulnerability exists in the OAS Engine User Creation functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted series of network requests can lead to unexpected data in the configuration. An attacker can send a sequence of requests to...

CVE-2023-34998: Cleartext Transmission of Sensitive Information

An authentication bypass vulnerability exists in the OAS Engine functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted series of network requests can lead to arbitrary authentication. An attacker can sniff network traffic to trigger this vulnerability...

CVE-2023-31242: Improper Access Control

An authentication bypass vulnerability exists in the OAS Engine functionality of Open Automation Software OAS Platform v18.00.0072. A specially-crafted series of network requests can lead to arbitrary authentication. An attacker can send a sequence of requests to trigger this vulnerability...

CVE-2023-32271: Exposure of Sensitive Information to an Unauthorized Actor

An information disclosure vulnerability exists in the OAS Engine configuration management functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted series of network requests can lead to a disclosure of sensitive information. An attacker can send a sequence of reques...

CVE-2023-34353: Use of Insufficiently Random Values

An authentication bypass vulnerability exists in the OAS Engine authentication functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted network sniffing can lead to decryption of sensitive information. An attacker can sniff network traffic to trigger this...

CVE-2023-32615: External Control of File Name or Path

A file write vulnerability exists in the OAS Engine configuration functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted series of network requests can lead to arbitrary file creation or overwrite. An attacker can send a sequence of requests to trigger this...

PT-2023-23692 · Open Automation · Open Automation Software Oas Platform

Name of the Vulnerable Software and Affected Versions: Open Automation Software OAS Platform version 18.00.0072 Description: An information disclosure issue exists in the OAS Engine configuration management functionality. A specially crafted series of network requests can lead to a disclosure of...

Open Automation Software OAS Platform Input Validation Error Vulnerability

Open Automation Software OAS Platform is an Industrial Internet of Things IoT suite from US-based Open Automation Software, Inc. Designed to help organizations connect data sources to the OAS Platform. An input validation error vulnerability exists in Open Automation Software OAS Platform version...

PT-2023-23263 · Open Automation · Open Automation Software Oas Platform

Name of the Vulnerable Software and Affected Versions: Open Automation Software OAS Platform version 18.00.0072 Description: An authentication bypass vulnerability exists in the OAS Engine functionality. A specially-crafted series of network requests can lead to arbitrary authentication. An...

Open Automation Software OAS Platform OAS Engine configuration file write vulnerability

Talos Vulnerability Report TALOS-2023-1771 Open Automation Software OAS Platform OAS Engine configuration file write vulnerability September 5, 2023 CVE Number CVE-2023-32615 SUMMARY A file write vulnerability exists in the OAS Engine configuration functionality of Open Automation Software OAS...

Open Automation Software OAS Platform OAS Engine User Creation improper input validation vulnerability

Talos Vulnerability Report TALOS-2023-1772 Open Automation Software OAS Platform OAS Engine User Creation improper input validation vulnerability September 5, 2023 CVE Number CVE-2023-34317 SUMMARY An improper input validation vulnerability exists in the OAS Engine User Creation functionality of...

Open Automation Software OAS Platform OAS Engine configuration management information disclosure vulnerability

Talos Vulnerability Report TALOS-2023-1774 Open Automation Software OAS Platform OAS Engine configuration management information disclosure vulnerability September 5, 2023 CVE Number CVE-2023-32271 SUMMARY An information disclosure vulnerability exists in the OAS Engine configuration management...

Open Automation Software OAS Platform OAS Engine configuration management information disclosure vulnerability

Talos Vulnerability Report TALOS-2023-1775 Open Automation Software OAS Platform OAS Engine configuration management information disclosure vulnerability September 5, 2023 CVE Number CVE-2023-35124 SUMMARY An information disclosure vulnerability exists in the OAS Engine configuration management...

Open Automation Software OAS Platform OAS Engine authentication bypass vulnerability

Talos Vulnerability Report TALOS-2023-1770 Open Automation Software OAS Platform OAS Engine authentication bypass vulnerability September 5, 2023 CVE Number CVE-2023-34998 SUMMARY An authentication bypass vulnerability exists in the OAS Engine functionality of Open Automation Software OAS Platfor...

Open Automation Software OAS Platform OAS Engine configuration management improper resource allocation vulnerability

Talos Vulnerability Report TALOS-2023-1773 Open Automation Software OAS Platform OAS Engine configuration management improper resource allocation vulnerability September 5, 2023 CVE Number CVE-2023-34994 SUMMARY An improper resource allocation vulnerability exists in the OAS Engine configuration...