CVE-2018-19015

The CVE-2018-19015 issue affects OMRON CX-Supervisor (versions up to 3.42) via project-file parsing. The root cause is improper validation of user-supplied strings, enabling an attacker to inject commands and create/write/read files, potentially executing code with the application’s privileges. D...

CVE-2018-19015: Improper Neutralization of Special Elements used in a Command

An attacker could inject commands to launch programs and create, write, and read files on CX-Supervisor Versions 3.42 and prior through a specially crafted project file. An attacker could exploit this to execute code under the privileges of the application...

OMRON CX-Supervisor sr3 File Parsing Script API HWND Object Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of OMRON CX-Supervisor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processi...

CVE-2018-19019

A type confusion vulnerability exists when processing project files in CX-Supervisor Versions 3.42 and prior. An attacker could use a specially crafted project file to exploit and execute code under the privileges of the application...

CVE-2018-19019

A type confusion vulnerability exists when processing project files in CX-Supervisor Versions 3.42 and prior. An attacker could use a specially crafted project file to exploit and execute code under the privileges of the application...

CVE-2018-19013

An attacker could inject commands to delete files and/or delete the contents of a file on CX-Supervisor Versions 3.42 and prior through a specially crafted project file...

Design/Logic Flaw

An attacker could inject commands to delete files and/or delete the contents of a file on CX-Supervisor Versions 3.42 and prior through a specially crafted project file...

Code injection

CX-Supervisor Versions 3.42 and prior can execute code that has been injected into a project file. An attacker could exploit this to execute code under the privileges of the application...

Design/Logic Flaw

Several use after free vulnerabilities have been identified in CX-Supervisor Versions 3.42 and prior. When processing project files, the application fails to check if it is referencing freed memory. An attacker could use a specially crafted project file to exploit and execute code under the...

Type confusion

A type confusion vulnerability exists when processing project files in CX-Supervisor Versions 3.42 and prior. An attacker could use a specially crafted project file to exploit and execute code under the privileges of the application...

CVE-2018-19017

Several use after free vulnerabilities have been identified in CX-Supervisor Versions 3.42 and prior. When processing project files, the application fails to check if it is referencing freed memory. An attacker could use a specially crafted project file to exploit and execute code under the...

CVE-2018-19011

CX-Supervisor Versions 3.42 and prior can execute code that has been injected into a project file. An attacker could exploit this to execute code under the privileges of the application...

CVE-2018-19017

Several use after free vulnerabilities have been identified in CX-Supervisor Versions 3.42 and prior. When processing project files, the application fails to check if it is referencing freed memory. An attacker could use a specially crafted project file to exploit and execute code under the...

CVE-2018-19011

CX-Supervisor Versions 3.42 and prior can execute code that has been injected into a project file. An attacker could exploit this to execute code under the privileges of the application...

CVE-2018-19011

CX-Supervisor Versions 3.42 and prior can execute code that has been injected into a project file. An attacker could exploit this to execute code under the privileges of the application...

CVE-2018-19013

An attacker could inject commands to delete files and/or delete the contents of a file on CX-Supervisor Versions 3.42 and prior through a specially crafted project file...

CVE-2018-19019

A type confusion vulnerability exists when processing project files in CX-Supervisor Versions 3.42 and prior. An attacker could use a specially crafted project file to exploit and execute code under the privileges of the application...

CVE-2018-19013

Omron CX-Supervisor CVE-2018-19013 affects CX-Supervisor versions 3.42 and earlier. The vulnerability arises from command injection during processing of a crafted project file, allowing an attacker to delete files or their contents on the device. Public details from connected sources describe exp...

CVE-2018-19017

CVE-2018-19017 pertains to OMRON CX-Supervisor (versions ≤ 3.42). The issue is a use-after-free in the SCS/project file parsing path where the software may reference freed memory while processing project files, enabling remote code execution. Exploitation appears tied to opening or processing a m...

CVE-2018-19011

Omron CX-Supervisor is affected (versions 3.42 and prior). The vulnerability, CVE-2018-19011, allows code execution by processing a project file that contains injected code, enabling an attacker to run code with the application’s privileges. Public disclosures and advisories (ZDI, ICS-CERT/ICSA-1...