Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,863

CVE-2022-1159

Rockwell Automation Studio 5000 Logix Designer Code Injection

Rockwell Automation Studio 5000 Logix Designer (all versions) are vulnerable when an attacker who achieves administrator access on a workstation running Studio 5000 Logix Designer could inject controller code undetectable to a user.

CVSS 3.1 · 7.7 High EPSS 3.5% KEV · Not listed
Vendors
Rockwellautomation
Products
Compact Guardlogix 5380 Compact Guardlogix 5380 Firmware Compactlogix 5380 and 7 more
CVE-2022-26417

Rockwell Automation Studio 5000 Logix Designer Use After Free

Omron CX-Position (versions 2.5.3 and prior) is vulnerable to a use after free memory condition while processing a specific project file, which may allow an attacker to execute arbitrary code.

CVSS 3.1 · 7.8 High EPSS 1.5% KEV · Not listed
Vendors
Omron
Products
Cx-position
CVE-2022-26022

Rockwell Automation Studio 5000 Logix Designer Out-of-Bounds Write

Omron CX-Position (versions 2.5.3 and prior) is vulnerable to an out-of-bounds write while processing a specific project file, which may allow an attacker to execute arbitrary code.

CVSS 3.1 · 7.8 High EPSS 1.5% KEV · Not listed
Vendors
Omron
Products
Cx-position
CVE-2022-26419

Rockwell Automation Studio 5000 Logix Designer Code Injection

Omron CX-Position (versions 2.5.3 and prior) is vulnerable to multiple stack-based buffer overflow conditions while parsing a specific project file, which may allow an attacker to locally execute arbitrary code.

CVSS 3.1 · 7.8 High EPSS 2.1% KEV · Not listed
Vendors
Omron
Products
Cx-position
CVE-2021-32977

AVEVA System Platform Improper Verification of Cryptographic Signature

AVEVA System Platform versions 2017 through 2020 R2 P01 does not verify, or incorrectly verifies, the cryptographic signature for data.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Aveva
Products
System Platform
CVE-2021-32985

AVEVA System Platform Origin Validation Error

AVEVA System Platform versions 2017 through 2020 R2 P01 does not properly verify that the source of data or communication is valid.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Aveva
Products
System Platform
CVE-2021-32981

AVEVA System Platform Path Traversal

AVEVA System Platform versions 2017 through 2020 R2 P01 uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

CVSS 3.1 · 7.2 High EPSS 1.2% KEV · Not listed
Vendors
Aveva
Products
System Platform
CVE-2021-33008

AVEVA System Platform Missing Authentication for Critical Function

AVEVA System Platform versions 2017 through 2020 R2 P01 does not perform any authentication for functionality that requires a provable user identity.

CVSS 3.1 · 8.8 High EPSS 1.2% KEV · Not listed
Vendors
Aveva
Products
System Platform
CVE-2022-0835

AVEVA System Platform Cleartext Storage of Sensitive Information in Memory

AVEVA System Platform 2020 stores sensitive information in cleartext, which may allow access to an attacker or a low-privileged user.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Aveva
Products
System Platform
CVE-2022-0999

mySCADA myPRO Command Injection

An authenticated user may be able to misuse parameters to inject arbitrary operating system commands into mySCADA myPRO versions 8.25.0 and prior.

CVSS 3.1 · 8.8 High EPSS 1.4% KEV · Not listed
Vendors
Myscada
Products
Mypro
CVE-2020-16238

B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus

A vulnerability in the configuration import mechanism of the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers with command line access to the underlying Linux system to escalate privileges to the root user.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Bbraun
Products
Datamodule Compactplus Spacecom
CVE-2020-25156

B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus

Active debug code in the B. Braun Melsungen AG SpaceCom Version L8/U61, and the Data module compactplus Versions A10 and A11 and earlier enables attackers in possession of cryptographic material to access the device as root.

CVSS 3.1 · 7.2 High EPSS 1.2% KEV · Not listed
Vendors
Bbraun
Products
Datamodule Compactplus Spacecom
CVE-2020-25163

OSIsoft PI Vision Cross-site Scripting

A remote attacker with write access to PI ProcessBook files could inject code that is imported into OSIsoft PI Vision 2020 versions prior to 3.5.0. Unauthorized information disclosure, modification, or deletion is also possible if a victim views or interacts with the infected display. This vulnerability affects PI System data and other data accessible with victim’s user permissions.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Osisoft
Products
Pi Vision
CVE-2022-26516

ICSA-22-104-03 Red Lion DA50N

Authorized users may install a maliciously modified package file when updating the device via the web user interface. The user may inadvertently use a package file obtained from an unauthorized source or a file that was compromised between download and deployment.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Redlion
Products
Da50n Da50n Firmware
CVE-2022-1039

ICSA-22-104-03 Red Lion DA50N

The weak password on the web user interface can be exploited via HTTP or HTTPS. Once such access has been obtained, the other passwords can be changed. The weak password on Linux accounts can be accessed via SSH or Telnet, the former of which is by default enabled on trusted interfaces. While the SSH service does not support root login, a user logging in using either of the other Linux accounts may elevate to root access using the su command if they have access to the associated password.

CVSS 3.1 · 9.6 Critical EPSS 1.2% KEV · Not listed
Vendors
Redlion
Products
Da50n Da50n Firmware
CVE-2021-43932

Elcomplus SmartPtt Cross-site Scripting

Elcomplus SmartPTT is vulnerable when an attacker injects JavaScript code into a specific parameter that can executed upon accessing the dashboard or the main page.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed
Vendors
Smartptt
Products
Smartptt Scada
CVE-2021-43939

Elcomplus SmartPtt Improper Authorization

Elcomplus SmartPTT is vulnerable when a low-authenticated user can access higher level administration authorization by issuing requests directly to the desired endpoints.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Smartptt
Products
Smartptt Scada