3468 matches found
Siemens Spectrum Power Systems
1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Low attack complexity Vendor: Siemens Equipment: Spectrum Power Vulnerability: Use of Hard-coded Credentials 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to gain administrative privileges by using an account...
CVE-2021-32989
When a non-existent resource is requested, the LCDS LAquis SCADA application version 4.3.1.1011 and prior returns error messages which may allow reflected cross-site scripting...
CVE-2021-32989
When a non-existent resource is requested, the LCDS LAquis SCADA application version 4.3.1.1011 and prior returns error messages which may allow reflected cross-site scripting...
Cross site scripting
When a non-existent resource is requested, the LCDS LAquis SCADA application version 4.3.1.1011 and prior returns error messages which may allow reflected cross-site scripting...
CVE-2021-32989
The CVE-2021-32989 issue affects LCDS LAquis SCADA (Versions up to 4.3.1.1011). It is a Cross-Site Scripting vulnerability due to improper neutralization of input during web page generation, triggered when a non-existent resource is requested and error messages are returned. This can enable refle...
CVE-2021-32989 LCDS LAquis SCADA - Cross-site Scripting
When a non-existent resource is requested, the LCDS LAquis SCADA application version 4.3.1.1011 and prior returns error messages which may allow reflected cross-site scripting...
CVE-2021-32989 LCDS LAquis SCADA - Cross-site Scripting
When a non-existent resource is requested, the LCDS LAquis SCADA application version 4.3.1.1011 and prior returns error messages which may allow reflected cross-site scripting...
CVE-2022-1467
Windows OS can be configured to overlay a “language bar” on top of any application. When this OS functionality is enabled, the OS language bar UI will be viewable in the browser alongside the AVEVA InTouch Access Anywhere and Plant SCADA Access Anywhere applications. It is possible to manipulate...
Command injection
Windows OS can be configured to overlay a “language bar” on top of any application. When this OS functionality is enabled, the OS language bar UI will be viewable in the browser alongside the AVEVA InTouch Access Anywhere and Plant SCADA Access Anywhere applications. It is possible to manipulate...
CVE-2022-1467
CVE-2022-1467 affects AVEVA InTouch Access Anywhere and AVEVA Plant SCADA Access Anywhere (all versions). The root cause is a Windows language bar overlay that can be manipulated to launch an OS command prompt from within the browser, creating a context-escape from the hosted application to the O...
CVE-2022-1467 AVEVA InTouch Access Anywhere Exposure of Resource to Wrong Sphere
Windows OS can be configured to overlay a “language bar” on top of any application. When this OS functionality is enabled, the OS language bar UI will be viewable in the browser alongside the AVEVA InTouch Access Anywhere and Plant SCADA Access Anywhere applications. It is possible to manipulate...
CVE-2021-33025
xArrow SCADA versions 7.2 and prior permits unvalidated registry keys to be run with application-level privileges...
CVE-2021-33025
xArrow SCADA versions 7.2 and prior permits unvalidated registry keys to be run with application-level privileges...
CVE-2021-33021
xArrow SCADA versions 7.2 and prior is vulnerable to cross-site scripting due to parameter ‘edate’ of the resource xhisalarm.htm, which may allow an unauthorized attacker to execute arbitrary code...
CVE-2021-33001
xArrow SCADA versions 7.2 and prior is vulnerable to cross-site scripting due to parameter ‘bdate’ of the resource xhisvalue.htm, which may allow an unauthorized attacker to execute arbitrary code...
CVE-2021-33001
xArrow SCADA versions 7.2 and prior is vulnerable to cross-site scripting due to parameter ‘bdate’ of the resource xhisvalue.htm, which may allow an unauthorized attacker to execute arbitrary code...
Code injection
xArrow SCADA versions 7.2 and prior permits unvalidated registry keys to be run with application-level privileges...
Cross site scripting
xArrow SCADA versions 7.2 and prior is vulnerable to cross-site scripting due to parameter ‘bdate’ of the resource xhisvalue.htm, which may allow an unauthorized attacker to execute arbitrary code...
Cross site scripting
xArrow SCADA versions 7.2 and prior is vulnerable to cross-site scripting due to parameter ‘edate’ of the resource xhisalarm.htm, which may allow an unauthorized attacker to execute arbitrary code...