Advantech WebAccess/SCADA SQL Injection Vulnerability (CNVD-2019-03260)

Advantech WebAccess/SCADA is a set of SCADA software from Advantech based on browser architecture. The software supports dynamic graphical display and real-time data control, and provides remote control and management of automation equipment. A SQL injection vulnerability exists in Advantech...

Advantech WebAccess/SCADA

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Advantech Equipment: WebAccess/SCADA Vulnerabilities: Improper Authentication, Authentication Bypass, SQL Injection 2. RISK EVALUATION Successful exploitation of these vulnerabilities may allow an...

PT-2019-9695

Name of the Vulnerable Software and Affected Versions LCDS Laquis SCADA versions prior to 4.1.0.4150 Description The issue allows an attacker to gain unauthorized access to the system with high privileges due to the use of hard-coded credentials. Recommendations For versions prior to 4.1.0.4150,...

PT-2019-9697

Name of the Vulnerable Software and Affected Versions LCDS Laquis SCADA versions prior to 4.1.0.4150 Description The issue allows for improper control of generation of code when opening a specially crafted project file. This may lead to remote code execution, data exfiltration, or cause a system...

PT-2019-9693

Name of the Vulnerable Software and Affected Versions LCDS Laquis SCADA versions prior to 4.1.0.4150 Description The issue allows an attacker to execute remote code on the server due to improper authorization or sanitation of user input. This can be achieved through command injection in certain...

PT-2019-9689

Name of the Vulnerable Software and Affected Versions LCDS Laquis SCADA versions prior to 4.1.0.4150 Description The issue allows a user-supplied path in file operations prior to proper validation, which can be leveraged by an attacker to disclose sensitive information under the context of the we...

PT-2019-9686

Name of the Vulnerable Software and Affected Versions LCDS Laquis SCADA versions prior to 4.1.0.4150 Description The issue allows the opening of a specially crafted report format file, which may cause an out of bounds read. This can lead to a system crash, allow data exfiltration, or enable remot...

PT-2019-9690

Name of the Vulnerable Software and Affected Versions LCDS Laquis SCADA versions prior to 4.1.0.4150 Description The issue allows an attacker to execute remote code on the server due to improper sanitation of user input. This can be achieved through command injection vulnerabilities in various...

PT-2019-9696

Name of the Vulnerable Software and Affected Versions LCDS Laquis SCADA versions prior to 4.1.0.4150 Description The issue allows an authentication bypass, which may enable an attacker to access sensitive data. Recommendations For versions prior to 4.1.0.4150, update to version 4.1.0.4150 or late...

PT-2019-9691

Name of the Vulnerable Software and Affected Versions LCDS Laquis SCADA versions prior to 4.1.0.4150 Description The issue allows for an out of bounds read when opening a specially crafted project file. This may cause a system crash or allow data exfiltration. Recommendations For versions prior t...

PT-2019-9698

Name of the Vulnerable Software and Affected Versions LCDS Laquis SCADA versions prior to 4.1.0.4150 Description The issue allows for an out of bounds read when opening a specially crafted project file, which may enable data exfiltration. Recommendations For versions prior to 4.1.0.4150, update t...

PT-2019-9717

Name of the Vulnerable Software and Affected Versions LCDS Laquis SCADA versions prior to 4.1.0.4150 Description The issue allows an attacker to supply a pointer for a controlled memory address using a specially crafted project file. This may lead to remote code execution, data exfiltration, or...

PT-2019-9687

Name of the Vulnerable Software and Affected Versions LCDS Laquis SCADA versions prior to 4.1.0.4150 Description The issue allows execution of script code by opening a specially crafted report format file, which may lead to remote code execution, data exfiltration, or cause a system crash. Multip...

LAquis SCADA LGX Report Ini WriteString Arbitrary File Creation Vulnerability

This vulnerability allows remote attackers to create arbitrary files on vulnerable installations of LAquis SCADA Software. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

LAquis SCADA LGX Report Memory Integer Untrusted Pointer Dereference Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of LAquis SCADA Software. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within th...

LAquis SCADA LGX Report Ini WriteNumber Arbitrary File Creation Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of LAquis SCADA Software. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

LAquis SCADA LGX Report MemoryReadWord Untrusted Pointer Dereference Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of LAquis SCADA Software. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within th...

LAquis SCADA LGX Report Memory Byte Untrusted Pointer Dereference Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of LAquis SCADA Software. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within th...

LAquis SCADA Web Server acompanhamentotela TAGALTERE Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of LAquis SCADA Software. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of calls to acompanhamentotela.lhtml. When parsing the TAGALTERE...

LAquis SCADA Web Server acompanhamentotela PAGINA Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of LAquis SCADA Software. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of calls to acompanhamentotela.lhtml. When parsing the PAGINA...