CVE-2013-0688

Cross-site scripting XSS vulnerability in Invensys Wonderware Information Server WIS 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-0684

SQL injection vulnerability in Invensys Wonderware Information Server WIS 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2013-0685

Invensys Wonderware Information Server WIS 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal does not restrict unspecified size and amount values, which allows remote attackers to execute arbitrary code or cause a denial of service resource consumption via unknown vectors...

CVE-2013-0686

Invensys Wonderware Information Server WIS 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service CPU and memory consumption via an XML document containing an external entity declaration in...

Cross site scripting

Cross-site scripting XSS vulnerability in Invensys Wonderware Information Server WIS 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Sql injection

SQL injection vulnerability in Invensys Wonderware Information Server WIS 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

Code injection

Invensys Wonderware Information Server WIS 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal does not restrict unspecified size and amount values, which allows remote attackers to execute arbitrary code or cause a denial of service resource consumption via unknown vectors...

Xxe

Invensys Wonderware Information Server WIS 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service CPU and memory consumption via an XML document containing an external entity declaration in...

CVE-2013-0685

Invensys Wonderware Information Server WIS 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal does not restrict unspecified size and amount values, which allows remote attackers to execute arbitrary code or cause a denial of service resource consumption via unknown vectors...

CVE-2013-0684

CVE-2013-0684 is a SQL injection vulnerability in Invensys Wonderware Information Server (WIS) affecting WIS 4.0 SP1SP1, 4.5 Portal, and 5.0 Portal. The issue allows remote attackers to execute arbitrary SQL commands via unspecified vectors (CWE-89). Multiple sources confirm the affected products...

CVE-2013-0688

Cross-site scripting XSS vulnerability in Invensys Wonderware Information Server WIS 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-0685

CVE-2013-0685 affects Invensys Wonderware Information Server (WIS): versions 4.0 SP1SP1, 4.5 Portal, and 5.0 Portal. The root cause is improper restriction of resource requests, allowing an attacker to perform resource exhaustion that could lead to remote code execution or a denial of service. Ex...

CVE-2013-0684

SQL injection vulnerability in Invensys Wonderware Information Server WIS 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2013-0686

Invensys Wonderware Information Server WIS 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service CPU and memory consumption via an XML document containing an external entity declaration in...

CVE-2013-0688

CVE-2013-0688 (Wonderware Information Server): XSS in WIS 4.0 SP1, 4.5 Portal, and 5.0 Portal allows remote injection of script/HTML. Root cause: improper neutralization of input in web pages (CWE-79). Impact noted as potentially remote code execution, data disclosure, or session credential hijac...

Invensys Wonderware HMI Reports XSS and Write Access Violation Vulnerabilities

Overview Independent security researchers Billy Rios and Terry McCorkle have identified cross-site scripting XSS and write access violation vulnerabilities in the Invensys Wonderware HMI reports product. ICS-CERT has coordinated these two vulnerabilities with Invensys, which has produced a new...

CVE-2012-4710

Invensys Wonderware Win-XML Exporter 1522.148.0.0 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service CPU and memory consumption via an XML external entity declaration in conjunction with an entity reference...

Xxe

Invensys Wonderware Win-XML Exporter 1522.148.0.0 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service CPU and memory consumption via an XML external entity declaration in conjunction with an entity reference...

CVE-2012-4710

CVE-2012-4710 affects Invensys Wonderware Win-XML Exporter (version 1522.148.0.0 cited). The issue is an XML External Entity (XXE) vulnerability: parsing XML with an unsafe DTD/entity declaration allows a local/remote resource disclosure, outbound HTTP requests, or a denial of service (CPU/memory...

Wonderware Intelligence Tableau Server Ruby on Rails Improper Input Validation (Update A)

Overview This updated advisory was orignally posted to the US-CERT secure Portal library on February 5, 2013, and is now being released to the ICS-CERT Web page. Mitigation details for multiple vulnerabilities that impact third-party software integrated into the Invensys Wonderware Intelligence...