CVE-2012-3005

CVE-2012-3005 is an Untrusted Search Path (DLL hijack) vulnerability in Invensys Wonderware InTouch 2012 and earlier, used by Wonderware InTouch family products (Application Server, Information Server, Foxboro Control Software, InFusion CE/FE/SCADA, InBatch, Wonderware Historian). The underlying ...

CVE-2012-0258

The CVE-2012-0258 issue is a heap-based buffer overflow in the WWCabFile ActiveX Component used by Wonderware System Platform and related products (Wonderware Application Server 2012 and earlier, Foxboro Control Software 3.1 and earlier, InFusion CE/FE/SCADA 2.5 and earlier, Wonderware Informatio...

CVE-2014-2381

Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1–5.5 is affected by CVE-2014-2381 due to inadequate encryption strength (CWE-326). The vulnerability allows local users to obtain sensitive information by reading a credential file, with a local access requirement and no authent...

CVE-2012-0257

The CVE-2012-0257 issue is a heap-based buffer overflow in the WWCabFile ActiveX component used by Wonderware System Platform and several associated products (e.g., Wonderware Application Server 2012, Foxboro Control Software 3.1, InFusion CE/FE/SCADA 2.5, Wonderware Information Server 4.5, Arche...

CVE-2013-0684

CVE-2013-0684 is a SQL injection vulnerability in Invensys Wonderware Information Server (WIS) affecting WIS 4.0 SP1SP1, 4.5 Portal, and 5.0 Portal. The issue allows remote attackers to execute arbitrary SQL commands via unspecified vectors (CWE-89). Multiple sources confirm the affected products...

CVE-2014-5398

CVE-2014-5398 affects Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 to 5.5. The issue is an XML External Entity (XXE) vulnerability causing local file disclosure or denial of service due to unsafe XML parsing. Affected versions include Portal 4.0 SP1 through 5.5; root caus...

CVE-2013-0688

CVE-2013-0688 (Wonderware Information Server): XSS in WIS 4.0 SP1, 4.5 Portal, and 5.0 Portal allows remote injection of script/HTML. Root cause: improper neutralization of input in web pages (CWE-79). Impact noted as potentially remote code execution, data disclosure, or session credential hijac...

CVE-2012-0225

Invensys Wonderware Information Server 4.0 SP1 and 4.5 (Portal and Client) contain a Cross-Site Scripting (CVE-2012-0225) vulnerability. ICS-CERT/ICS advisories indicate that, if exploited, these flaws could lead to denial of service, information disclosure, remote code execution, or session cred...

CVE-2012-0226

Invensys Wonderware Information Server 4.0 SP1 and 4.5 Portal/Client are affected by CVE-2012-0226, a SQL injection vulnerability that could allow a remote attacker to execute arbitrary SQL commands via unspecified vectors. The ICS-CERT advisory confirms multiple vulnerabilities in these products...

CVE-2014-5397

CVE-2014-5397 concerns multiple Cross-Site Scripting (XSS) vulnerabilities in Schneider Electric Wonderware Information Server (WIS) Portal. Affected: WIS Portal versions 4.0 SP1 through 5.5. Root cause: improper input handling/encoding in the web portal frontend, allowing arbitrary web script or...

CVE-2013-0686

CVE-2013-0686 affects Invensys Wonderware Information Server (WIS) 4.0 SP1SP1, 4.5 Portal, and 5.0 Portal. The root cause is an XML External Entity (XXE) vulnerability in XML parsing, enabling remote attackers to read local/remote files, send HTTP requests to intranet servers, or cause DoS via cr...

CVE-2014-5399

CVE-2014-5399 corresponds to SQL injection vulnerabilities in Schneider Electric Wonderware Information Server (WIS) Portal. Connected PT-2014-21 confirms multiple SQL injection flaws affecting WIS, with the vendor releasing updates to mitigate these issues. Affected products include Wonderware I...

CVE-2012-0228

CVE-2012-0228 affects Invensys Wonderware Information Server 4.0 SP1 and 4.5 (Portal and Client). The vulnerability stems from security access permissions issues in client controls, which could allow a remote attacker to cause a denial of service. ICS-CERT notes multiple vulnerabilities across th...

CVE-2013-0685

CVE-2013-0685 affects Invensys Wonderware Information Server (WIS): versions 4.0 SP1SP1, 4.5 Portal, and 5.0 Portal. The root cause is improper restriction of resource requests, allowing an attacker to perform resource exhaustion that could lead to remote code execution or a denial of service. Ex...

CVE-2014-2380

Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1–5.5 is affected by Inadequate Encryption Strength (CWE-326). The vulnerability arises from weak encryption of credential data, enabling remote attackers to read a credential file and obtain sensitive information. Some sources a...

CVE-2011-2962

CVE-2011-2962 affects Wonderware Information Server 3.1, 4.0 and 4.0 SP1. The ICS-CERT advisory details a stack-based buffer overflow in two ActiveX controls that could allow remote code execution on vulnerable clients when a malicious page or file is opened. Invensys issued a patch to address th...