3519 matches found
Sql injection
WebAccess/SCADA, Version 8.3. The software does not properly sanitize its inputs for SQL commands...
CVE-2019-6519
WebAccess/SCADA, Version 8.3. An improper authentication vulnerability exists that could allow a possible authentication bypass allowing an attacker to upload malicious data...
CVE-2019-6523
WebAccess/SCADA, Version 8.3. The software does not properly sanitize its inputs for SQL commands...
CVE-2019-6521
WebAccess/SCADA, Version 8.3. Specially crafted requests could allow a possible authentication bypass that could allow an attacker to obtain and manipulate sensitive information...
CVE-2019-6519
WebAccess/SCADA, Version 8.3. An improper authentication vulnerability exists that could allow a possible authentication bypass allowing an attacker to upload malicious data...
CVE-2019-6523
Affected product: Advantech WebAccess/SCADA, Version 8.3. Vulnerability: CVE-2019-6523 – improper sanitization of inputs for SQL commands (SQL injection) in WebAccess/SCADA 8.3. Root cause / details: The affected component/process does not properly sanitize inputs used in SQL queries, enabling po...
CVE-2019-6519
The CVE-2019-6519 entry concerns Advantech WebAccess/SCADA, Version 8.3, which contains an improper authentication vulnerability that could allow an authentication bypass and upload of malicious data. The issue affects WebAccess/SCADA 8.3 and has a CVSS v3 base score of 9.8 (critical) with remote...
CVE-2019-6521
Affected product: Advantech WebAccess/SCADA Version 8.3. The CVE-2019-6521 issue is an authentication bypass via an alternate path or channel, allowing a remote attacker (no authentication required) to obtain and manipulate sensitive information. ICSA-19-024-01 explicitly documents this vulnerabi...
CVE-2018-18990
LCDS Laquis SCADA prior to version 4.1.0.4150 allows a user-supplied path in file operations prior to proper validation. An attacker can leverage this vulnerability to disclose sensitive information under the context of the web server process...
CVE-2018-19002
LCDS Laquis SCADA prior to version 4.1.0.4150 allows improper control of generation of code when opening a specially crafted project file, which may allow remote code execution, data exfiltration, or cause a system crash...
CVE-2018-18990
LCDS Laquis SCADA prior to version 4.1.0.4150 allows a user-supplied path in file operations prior to proper validation. An attacker can leverage this vulnerability to disclose sensitive information under the context of the web server process...
CVE-2018-19000
LCDS Laquis SCADA prior to version 4.1.0.4150 allows an authentication bypass, which may allow an attacker access to sensitive data...
CVE-2018-19029
LCDS Laquis SCADA prior to version 4.1.0.4150 allows an attacker using a specially crafted project file to supply a pointer for a controlled memory address, which may allow remote code execution, data exfiltration, or cause a system crash...
CVE-2018-18996
LCDS Laquis SCADA prior to version 4.1.0.4150 allows taking in user input without proper authorization or sanitation, which may allow an attacker to execute remote code on the server...
Design/Logic Flaw
LCDS Laquis SCADA prior to version 4.1.0.4150 allows improper control of generation of code when opening a specially crafted project file, which may allow remote code execution, data exfiltration, or cause a system crash...
Hardcoded credentials
LCDS Laquis SCADA prior to version 4.1.0.4150 uses hard coded credentials, which may allow an attacker unauthorized access to the system with high privileges...
Code injection
LCDS Laquis SCADA prior to version 4.1.0.4150 allows taking in user input without proper sanitation, which may allow an attacker to execute remote code on the server...
CVE-2018-18986
LCDS Laquis SCADA prior to version 4.1.0.4150 allows the opening of a specially crafted report format file that may cause an out of bounds read, which may cause a system crash, allow data exfiltration, or remote code execution...