CVE-2013-2785

CVE-2013-2785 affects GE Intelligent Platforms Proficy HMI/SCADA CIMPLICITY (WebView/CimWebServer). The vulnerability stems from improper input handling in CimWebServer’s WebView, allowing a remote attacker to execute arbitrary code by sending crafted data to TCP port 10212. Affected installation...

CVE-2013-2785

Multiple buffer overflows in CimWebServer.exe in the WebView component in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY before 8.0 SIM 27, 8.1 before SIM 25, and 8.2 before SIM 19, and Proficy Process Systems with CIMPLICITY, allow remote attackers to execute arbitrary code via crafted...

GE Proficy DNP3 Improper Input Validation

OVERVIEW This advisory was originally posted to the US-CERT secure Portal library on October 24, 2013, and is now being released to the NCCIC/ICS-CERT Web site. General Electric GE Intelligent Platforms reported to NCCIC/ICS-CERT an improper input validation vulnerability in the DNP3 driver used...

GE Proficy CIMPLICITY CimWebServer Broadcase/Init Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of GE Proficy CIMPLICITY. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CimWebServer component. This component performs insufficient bounds checking...

GE Proficy CIMPLICITY CimWebServer Password Decode Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of GE Proficy CIMPLICITY. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CimWebServer component. This component performs insufficient bounds checking...

Proficy Portal SCADA server detection

Binary data 6813.prm...

GE Proficy HMI/SCADA CIMPLICITY WebView Improper Input Validation

OVERVIEW This advisory was originally posted to the US-CERT secure Portal library on June 19, 2013, and is now being released to the ICS-CERT-Web page. Independent researchers ZombiE and amisto0x07 have identified an improper input validation vulnerability in the GE CIMPLICITY WebView application...

CVE-2013-0652

GE Intelligent Platforms Proficy Real-Time Information Portal does not restrict access to methods of an unspecified Java class, which allows remote attackers to obtain a username listing via an RMI call...

CVE-2013-0654

CimWebServer in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY 4.01 through 8.0, and Proficy Process Systems with CIMPLICITY, allows remote attackers to execute arbitrary commands or cause a denial of service daemon crash via a crafted packet...

Improper access control

The Portal installation process in GE Intelligent Platforms Proficy Real-Time Information Portal stores sensitive information under the web root with insufficient access control, which allows remote attackers to read configuration files, and discover data-source credentials, via a direct request...

Directory traversal

Directory traversal vulnerability in substitute.bcl in the WebView CimWeb subsystem in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY 4.01 through 8.0, and Proficy Process Systems with CIMPLICITY, allows remote attackers to read arbitrary files via a crafted packet...

Design/Logic Flaw

CimWebServer in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY 4.01 through 8.0, and Proficy Process Systems with CIMPLICITY, allows remote attackers to execute arbitrary commands or cause a denial of service daemon crash via a crafted packet...

Design/Logic Flaw

GE Intelligent Platforms Proficy Real-Time Information Portal does not restrict access to methods of an unspecified Java class, which allows remote attackers to obtain a username listing via an RMI call...

CVE-2013-0654

CVE-2013-0654 affects GE Intelligent Platforms Proficy HMI/SCADA—CIMPLICITY (Proficy CIMPLICITY 4.01–8.0 and related CIMPLICITY Process Systems). The CimWebServer component (WebView CimWeb) mishandles input; an attacker sending a crafted packet to port 80/TCP could trigger directory traversal or ...

CVE-2013-0651

The CVE-2013-0651 issue affects GE Intelligent Platforms Proficy Real-Time Information Portal. A misconfiguration in the Portal installation places sensitive files under the web root with insufficient access control, allowing unauthenticated remote retrieval of configuration data and data-source ...

EUVD-2013-0664

Directory traversal vulnerability in substitute.bcl in the WebView CimWeb subsystem in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY 4.01 through 8.0, and Proficy Process Systems with CIMPLICITY, allows remote attackers to read arbitrary files via a crafted packet...

CVE-2013-0651

The Portal installation process in GE Intelligent Platforms Proficy Real-Time Information Portal stores sensitive information under the web root with insufficient access control, which allows remote attackers to read configuration files, and discover data-source credentials, via a direct request...

CVE-2013-0652

CVE-2013-0652 (GE Proficy Real-Time Information Portal) is an information disclosure vulnerability in GE’s Proficy Real-Time Information Portal. The issue arises because the portal exposes methods of an unspecified Java class via Java RMI, allowing an unauthenticated remote attacker to obtain a u...

CVE-2013-0654

CimWebServer in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY 4.01 through 8.0, and Proficy Process Systems with CIMPLICITY, allows remote attackers to execute arbitrary commands or cause a denial of service daemon crash via a crafted packet...

CVE-2013-0653

CVE-2013-0653 is a directory traversal vulnerability in GE Intelligent Platforms Proficy CIMPLICITY’s WebView CimWeb substitute.bcl component (versions 4.01–8.0; also affects Proficy Process Systems with CIMPLICITY). The flaw allows remote attackers to read arbitrary files by sending a crafted pa...