CVE-2019-13537

The IEC870IP driver for AVEVA’s Vijeo Citect and Citect SCADA and Schneider Electric’s Power SCADA Operation has a buffer overflow vulnerability that could result in a server-side crash...

Aveva Indusoft Web Studio Remote Code Execution (CVE-2018-10620)

A buffer overflow vulnerability exists in Aveva Indusoft Web Studio. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system or cause application crashes...

AVEVA IEC870IP Driver CVE-2019-13537 Stack Buffer Overflow Vulnerability

...

Schneider Electric Floating License Manager ICSA-19-192-07 Multiple Security Vulnerabilities

Description Schneider Electric Floating License Manager is prone to multiple security vulnerabilities Attackers can exploit these issues to shut down the affected device, denying service to legitimate users. Floating License Manager version 2.3.0.0 and prior are vulnerable. Technologies Affected...

AVEVA Vijeo Citect and Citect SCADA Floating License Manager

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION : Exploitable remotely/low skill level to exploit Vendor : AVEVA Equipment : Vijeo Citect and Citect SCADA Floating License Manager Vulnerabilities : Improper Input Validation, Memory Corruption 2. RISK EVALUATION These vulnerabilities could allow an...

Schneider Electric AVEVA Vijeo Citect and Schneider Electric AVEVA CitectSCADA Insecure Credential Storage Vulnerability

Schneider Electric AVEVA Vijeo Citect and Schneider Electric AVEVA CitectSCADA are both data acquisition and monitoring system SCADA software packages from Schneider Electric, France. A security vulnerability exists in Schneider Electric AVEVA Vijeo Citect and Schneider Electric AVEVA CitectSCADA...

AVEVA Vijeo Citect and CitectSCADA

1. EXECUTIVE SUMMARY CVSS v3 6.5 ATTENTION: Low skill level to exploit Vendor: AVEVA Equipment: Vijeo Citect and CitectSCADA Vulnerability: Insufficiently Protected Credentials 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a locally authenticated user to obtain...

CVE-2019-6525

AVEVA Wonderware System Platform 2017 Update 2 and prior uses an ArchestrA network user account for authentication of system processes and inter-node communications. A user with low privileges could make use of an API to obtain the credentials for this account...

Default credentials

AVEVA Wonderware System Platform 2017 Update 2 and prior uses an ArchestrA network user account for authentication of system processes and inter-node communications. A user with low privileges could make use of an API to obtain the credentials for this account...

CVE-2019-6525

CVE-2019-6525 affects AVEVA Wonderware System Platform 2017 Update 2 and earlier. The vulnerability arises because the system uses an ArchestrA network user account for authentication of system processes and inter-node communications, and a user with low privileges can call an API to obtain the c...

CVE-2019-6525

AVEVA Wonderware System Platform 2017 Update 2 and prior uses an ArchestrA network user account for authentication of system processes and inter-node communications. A user with low privileges could make use of an API to obtain the credentials for this account...

AVEVA InduSoft Web Studio and InTouch Edge HMI

1. EXECUTIVE SUMMARY CVSS v3 6.5 ATTENTION: Low skill level to exploit Vendor: AVEVA Equipment: InduSoft Web Studio, InTouch Edge HMI Vulnerability: Uncontrolled Search Path Element 2. RISK EVALUATION Successful exploitation of this vulnerability could allow execution of unauthorized code or...

Unspecified Vulnerability in AVEVA Group plc InduSoft Web Studio and InTouch Edge HMI

AVEVA Group plc InduSoft Web Studio is a suite of industrial configuration software from AVEVA Group plc, UK. A security vulnerability exists in AVEVA Group plc InduSoft Web Studio versions prior to 8.1 SP3 and prior to InTouch Edge HMI 2017 Update. An attacker could exploit the vulnerability to...

AVEVA InduSoft Web Studio / InTouch Edge HMI Command 66 RCE

Binary data scadaavevaiwsitehcmd66rce.nbin...

CVE-2019-6543

AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI formerly InTouch Machine Edition prior to Version 2017 Update. Code is executed under the program runtime privileges, which could lead to the compromise of the machine...

Code injection

AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI formerly InTouch Machine Edition prior to Version 2017 Update. Code is executed under the program runtime privileges, which could lead to the compromise of the machine...

Code injection

AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI formerly InTouch Machine Edition prior to Version 2017 Update. An unauthenticated remote user could use a specially crafted database connection configuration file to execute an arbitrary process on the server...

CVE-2019-6543

Summary: CVE-2019-6543 affects AVEVA InduSoft Web Studio versions before 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) before 2017 Update. The flaw allows code to be executed with program runtime privileges due to missing authentication for a critical function (and related resou...

CVE-2019-6545

CVE-2019-6545 affects AVEVA InduSoft Web Studio prior to 8.1 SP3 and InTouch Edge HMI prior to 2017 Update. An unauthenticated remote attacker can trigger arbitrary process execution on the server by supplying a specially crafted database connection configuration file. Public sources document a r...

CVE-2019-6545

AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI formerly InTouch Machine Edition prior to Version 2017 Update. An unauthenticated remote user could use a specially crafted database connection configuration file to execute an arbitrary process on the server...