CVE-2022-21208: Improper Validation of Specified Quantity in Input

The package node-opcua before 2.74.0 are vulnerable to Denial of Service DoS due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited number of huge chunks e.g. 2GB...

CVE-2022-25231: Allocation of Resources Without Limits or Throttling

The package node-opcua before 2.74.0 are vulnerable to Denial of Service DoS by sending a specifically crafted OPC UA message with a special OPC UA NodeID, when the requested memory allocation exceeds the v8’s memory limit...

CVE-2022-25888: Allocation of Resources Without Limits or Throttling

The package opcua from 0.0.0 are vulnerable to Denial of Service DoS due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited number of huge chunks e.g. 2GB each...

CVE-2022-25304: Allocation of Resources Without Limits or Throttling

All versions of package opcua; all versions of package asyncua are vulnerable to Denial of Service DoS due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited numb...

python-opcua 安全漏洞

python-opcua is an LGPL pure Python OPC-UA client and server from the Free OPC-UA Library open source. A security vulnerability exists in python-opcua that stems from the lack of a limit on the number of blocks received per session or total number of all concurrent sessions...

PT-2022-4448

Name of the Vulnerable Software and Affected Versions opcua versions all asyncua versions all Description The issue is related to an uncontrolled consumption of resources in the opcua and asyncua libraries. This can be exploited by a remote attacker to cause a denial of service. The vulnerability...

Denial of Service (DoS)

Overview opcua is an OPC UA server / client API implementation for Rust. Affected versions of this package are vulnerable to Denial of Service DoS via the ExtensionObjects and Variants objects, when it allows unlimited nesting levels, which could result in a stack overflow even if the message siz...

aristote-malo (1.9.5), biobridge (>=0.1.0, <=0.2.5) +30 more potentially affected by CVE-2022-25304 via opcua (>=0.98.3, <=0.98.13)

opcua PYPI version =0.98.3, =0.1.0, =5.1.0, =1.4.1b1, =0.7.0b1, =0.3.3, =1.0.1, =0.1.5, =0.4.0 and more Source cves: CVE-2022-25304 Source advisory: SNYK:PYTHON-OPCUA-2988730...

@frangoteam/fuxa (>=1.1.7, <=1.1.8), @hive-command/discovery-server (>=1.3.2-alpha.86, <=1.3.3-alpha.35) +19 more potentially affected by CVE-2022-24375 via node-opcua (>=2.1.9, <=2.73.1)

node-opcua NPM version =2.1.9, =1.1.7, =1.3.2-alpha.86, =1.3.6-alpha.36, =1.3.5, =0.0.3, =0.0.3, =0.0.2, =1.3.0-alpha.0, =0.8.0, =2.10.0, =2.10.0, =4.0.0, =1.0.0, =0.2.93, =0.2.286 and more Source cves: CVE-2022-24375 Source advisory: SNYK:JS-NODEOPCUA-2988725...

Denial of Service (DoS)

Overview node-opcua is an implementation of a OPC UA stack fully written in javascript and nodejs Affected versions of this package are vulnerable to Denial of Service DoS when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the...

@frangoteam/fuxa (>=1.1.7, <=1.1.8), @hive-command/discovery-server (>=1.3.2-alpha.86, <=1.3.3-alpha.35) +19 more potentially affected by CVE-2022-25231 via node-opcua (>=2.1.9, <=2.73.1)

node-opcua NPM version =2.1.9, =1.1.7, =1.3.2-alpha.86, =1.3.6-alpha.36, =1.3.5, =0.0.3, =0.0.3, =0.0.2, =1.3.0-alpha.0, =0.8.0, =2.10.0, =2.10.0, =4.0.0, =1.0.0, =0.2.93, =0.2.286 and more Source cves: CVE-2022-25231 Source advisory: SNYK:JS-NODEOPCUA-2988724...

Denial of Service (DoS)

Overview node-opcua is an implementation of a OPC UA stack fully written in javascript and nodejs Affected versions of this package are vulnerable to Denial of Service DoS by sending a specifically crafted OPC UA message with a special OPC UA NodeID, when the requested memory allocation exceeds t...

@frangoteam/fuxa (>=1.1.7, <=1.1.8), @hive-command/discovery-server (>=1.3.2-alpha.86, <=1.3.3-alpha.35) +19 more potentially affected by CVE-2022-21208 via node-opcua (>=2.1.9, <=2.73.1)

node-opcua NPM version =2.1.9, =1.1.7, =1.3.2-alpha.86, =1.3.6-alpha.36, =1.3.5, =0.0.3, =0.0.3, =0.0.2, =1.3.0-alpha.0, =0.8.0, =2.10.0, =2.10.0, =4.0.0, =1.0.0, =0.2.93, =0.2.286 and more Source cves: CVE-2022-21208 Source advisory: SNYK:JS-NODEOPCUA-2988723...

Denial of Service (DoS)

Overview node-opcua is an implementation of a OPC UA stack fully written in javascript and nodejs Affected versions of this package are vulnerable to Denial of Service DoS due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An...

PT-2022-4443 · Unknown · Node-Opcua

Name of the Vulnerable Software and Affected Versions: node-opcua versions prior to 2.74.0 Description: The issue is related to a missing limitation on the number of received chunks per single session or in total for all concurrent sessions, which can lead to a Denial of Service DoS. An attacker...

PT-2022-4441 · Unknown · Node-Opcua

Name of the Vulnerable Software and Affected Versions: node-opcua versions prior to 2.74.0 Description: The issue is related to a Denial of Service DoS condition that can be triggered by sending a specifically crafted OPC UA message with a special OPC UA NodeID. This occurs when the requested...

CVE-2021-23230

A SQL Injection vulnerability in the OPCUA interface of Gallagher Command Centre allows a remote unprivileged Command Centre Operator to modify Command Centre databases undetected. This issue affects: Gallagher Command Centre 8.40 versions prior to 8.40.1888 MR3; 8.30 versions prior to 8.30.1359...

Sql injection

A SQL Injection vulnerability in the OPCUA interface of Gallagher Command Centre allows a remote unprivileged Command Centre Operator to modify Command Centre databases undetected. This issue affects: Gallagher Command Centre 8.40 versions prior to 8.40.1888 MR3; 8.30 versions prior to 8.30.1359...

CVE-2021-23230

CVE-2021-23230 describes a SQL injection vulnerability in the Gallagher Command Centre’s OPCUA interface. The root cause is lack of validation of externally entered SQL statements, allowing a remote unprivileged Command Centre Operator to modify the command center databases undetected. Affected v...

CVE-2021-23230: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection vulnerability in the OPCUA interface of Gallagher Command Centre allows a remote unprivileged Command Centre Operator to modify Command Centre databases undetected. This issue affects: Gallagher Command Centre 8.40 versions prior to 8.40.1888 MR3; 8.30 versions prior to 8.30.1359...