CVE-2022-2896

Measuresoft ScadaPro Server (All Versions) is affected by CVE-2022-2896 due to a use-after-free in processing a specific project file (ORM-related parsing). The vulnerability can lead to arbitrary code execution, as described by multiple sources (ZDI: remote code execution requiring user interact...

CVE-2024-3746

CVE-2024-3746 affects Measuresoft ScadaPro, where the entire directory path “C:\ScadaPro” and its subdirectories/files are writable by non-privileged users. The vulnerability is an improper access control (CWE-284) that can enable privilege escalation from unprivileged to SYSTEM on affected SCADA...

CVE-2022-2894

CVE-2022-2894 – Measuresoft ScadaPro Server is associated with unmaintained ActiveX controls that may permit seven untrusted pointer dereference instances when processing a specific project file. The affected product is Measuresoft ScadaPro Server (and Client per related advisories) across all ve...

CVE-2022-2895

CVE-2022-2895 affects Measuresoft ScadaPro Server (All Versions). The vulnerability stems from unmaintained ActiveX controls used by ScadaPro Server, enabling two stack-based buffer overflow instances while processing a specific project file. ZDI advisories describe remote code execution with use...

CVE-2022-2897

CVE-2022-2897 affects Measuresoft ScadaPro Server and Client (all versions). The issue is improper link resolution before file access (link following) that can lead to local privilege escalation. Public sources describe a local attack requiring initial code execution by a low-privileged user, wit...

CVE-2022-2892

CVE-2022-2892 affects Measuresoft ScadaPro Server prior to 6.8.0.1. The flaw arises from an unmaintained ActiveX control used during processing of a specific project file, enabling an out-of-bounds write. The CVSS v3.1 base score is 7.8 (HIGH) with LOCAL attack vector, low attack complexity, no p...

CVE-2022-3263

CVE-2022-3263 affects Measuresoft ScadaPro Server 6.7. The issue is an improper access control (CWE-284) where the ORCHESTRATOR service has inconsistent permissions, allowing a local low-privileged user to modify the service binary path and execute commands with SYSTEM privileges. Public sources ...

CVE-2022-2898

CVE-2022-2898 affects Measuresoft ScadaPro Server and Client (All Versions). The issue is improper link resolution before file access (Link Following), leading to a Denial-of-Service condition. Exploitation in public advisories indicates a local attacker with low privileges may abuse the ScadaPro...

CVE-2012-1824

CVE-2012-1824 affects Measuresoft ScadaPro Server and Client prior to version 4.0.0. The vulnerability is an Untrusted Search Path (DLL hijack) that lets a local attacker place a Trojan horse DLL in the current working directory to gain privileges. OpenVAS/Red Hat/NVD entries confirm a code execu...