CISA Releases Security Advisory on PTC Axeda Agent and Desktop Server

CISA has released an Industrial Controls Systems Advisory ICSA, detailing vulnerabilities in PTC Axeda agent and Axeda Desktop Server. Successful exploitation of these vulnerabilities—collectively known as “Access:7”—could result in full system access, remote code execution, read/change...

PTC OPC UA Server Multiple vulnerabilities

Binary data ptcopcuamultivulns.nbin...

PTC Kepware KEPServerEX (Update A)

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: PTC Equipment: Kepware KEPServerEX Vulnerabilities: Stack-based Buffer Overflow, Heap-based Buffer Overflow, Use After Free 2. UPDATE INFORMATION This updated advisory is a follow-up to the...

PTC Kepware LinkMaster

1. EXECUTIVE SUMMARY CVSS v3 9.3 ATTENTION: Low skill level to exploit Vendor: PTC Equipment: Kepware LinkMaster Vulnerability: Incorrect Default Permissions 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a local attacker to globally overwrite the service...

ptc-asia.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1179001 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

CVE-2018-20092

PTC ThingWorx Platform through 8.3.0 is vulnerable to a directory traversal attack on ZIP files via a POST request...

Directory traversal

PTC ThingWorx Platform through 8.3.0 is vulnerable to a directory traversal attack on ZIP files via a POST request...

CVE-2018-20092

CVE-2018-20092 affects PTC ThingWorx Platform up to version 8.3.0. The vulnerability is a directory traversal flaw in ZIP file handling via a POST request. The underlying impact, as stated, is partial confidentiality with no other impacts (integrity/availability not affected) and no user interact...

CVE-2018-20092

PTC ThingWorx Platform through 8.3.0 is vulnerable to a directory traversal attack on ZIP files via a POST request...

PTC ThingWorx Password Disclosure / Cross Site Scripting Vulnerabilities

PTC ThingWorx suffers from cross site scripting and password disclosure vulnerabilities. Versions affected include 6.5 through 7.4, 8.0.x, 8.1.x, and 8.2.x. ======================================================================= title: Password disclosure vulnerability & XSS product: PTC ThingWor...

CVE-2018-17217

An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2. There is a hardcoded encryption key...

Hardcoded credentials

An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2. There is a hardcoded encryption key...

CVE-2018-17218

An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2. There is reflected XSS in the SQUEAL search function...

CVE-2018-17216

An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2. There is password hash exposure to privileged users...

Design/Logic Flaw

An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2. There is password hash exposure to privileged users...

Cross site scripting

An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2. There is reflected XSS in the SQUEAL search function...

CVE-2018-17217

An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2. There is a hardcoded encryption key...

CVE-2018-17218

PTC ThingWorx Platform versions 6.5–8.2 have a reflected XSS in the SQUEAL search function. A remote attacker can exploit via a specially crafted URL to execute script in a user’s browser. Affected component: SQUEAL search; vulnerability type: cross-site scripting. No remediation details are prov...

CVE-2018-17216

An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2. There is password hash exposure to privileged users...

CVE-2018-17217

PTC ThingWorx Platform versions 6.5 through 8.2 are affected by CVE-2018-17217 due to a hardcoded encryption key. This root cause enables potential exposure of sensitive data, with NVD listing CVSSv3 base score 7.5 (HIGH) and network vector. No remediation or exploit details are provided in the c...