CVE-2022-2253

Distributed Data Systems WebHMI OS Command Injection

A user with administrative privileges in Distributed Data Systems WebHMI 4.1.1.7662 may send OS commands to execute on the host server.

CVSS 3.1 · 9.1 Critical EPSS 1.3% KEV · Not listed

Vendors

Webhmi

Products

Webhmi Webhmi Firmware

CVE-2022-2199

ICSA-22-200-01 MiCODUS MV720 GPS tracker Cross-site Scripting

The main MiCODUS MV720 GPS tracker web server has a reflected cross-site scripting vulnerability that could allow an attacker to gain control by tricking a user into making a request.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Micodus

Products

Mv720 Mv720 Firmware

CVE-2022-2136

Advantech iView

The affected product is vulnerable to multiple SQL injections that require low privileges for exploitation and may allow an unauthorized attacker to disclose information.

CVSS 3.1 · 8.8 High EPSS 9.4% KEV · Not listed

Vendors

Advantech

Products

Iview

CVE-2022-2142

Advantech iView

The affected product is vulnerable to a SQL injection with high attack complexity, which may allow an unauthorized attacker to disclose information.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Advantech

Products

Iview

CVE-2022-2661

Sequi PortBloque S Improper Authorization

Sequi PortBloque S has an improper authorization vulnerability, which may allow a low-privileged user to perform administrative functions using specifically crafted requests.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Sequi

Products

Portbloque S Portbloque S Firmware

CVE-2022-2662

Sequi PortBloque S Improper Authentication

Sequi PortBloque S has a improper authentication issues which may allow an attacker to bypass the authentication process and gain user-level access to the device.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Sequi

Products

Portbloque S Portbloque S Firmware

CVE-2022-1373

Softing Secure Integration Server Relative Path Traversal

The “restore configuration” feature of Softing Secure Integration Server V1.22 is vulnerable to a directory traversal vulnerability when processing zip files. An attacker can craft a zip file to load an arbitrary dll and execute code. Using the "restore configuration" feature to upload a zip file containing a path traversal file may cause a file to be created and executed upon touching the disk.

CVSS 3.1 · 7.2 High EPSS 13.2% KEV · Not listed

Vendors

Softing

Products

Edgeaggregator Edgeconnector Opc and 3 more

CVE-2022-2334

Softing Secure Integration Server Uncontrolled Search Path Element

The application searches for a library dll that is not found. If an attacker can place a dll with this name, then the attacker can leverage it to execute arbitrary code on the targeted Softing Secure Integration Server V1.22.

CVSS 3.1 · 7.2 High EPSS 12.1% KEV · Not listed

Vendors

Softing

Products

Edgeaggregator Edgeconnector Opc and 3 more

CVE-2022-2464

ISaGRAF Workbench Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-22

Rockwell Automation ISaGRAF Workbench software versions 6.0 through 6.6.9 are affected by a Path Traversal vulnerability. Crafted malicious files can allow an attacker to traverse the file system when opened by ISaGRAF Workbench. If successfully exploited, an attacker could overwrite existing files and create additional files with the same permissions of the ISaGRAF Workbench software. User interaction is required for this exploit to be successful.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Rockwellautomation

Products

Isagraf Workbench

CVE-2022-2465

ISaGRAF Workbench Deserialization of Untrusted Data CWE-502

Rockwell Automation ISaGRAF Workbench software versions 6.0 through 6.6.9 are affected by a Deserialization of Untrusted Data vulnerability. ISaGRAF Workbench does not limit the objects that can be deserialized. This vulnerability allows attackers to craft a malicious serialized object that, if opened by a local user in ISaGRAF Workbench, may result in remote code execution. This vulnerability requires user interaction to be successfully exploited.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Rockwellautomation

Products

Isagraf Workbench

CVE-2022-1888

Fuji Electric Alpha7 PC Loader Fuji Electric Alpha7 PC Loader

Alpha7 PC Loader (All versions) is vulnerable to a stack-based buffer overflow while processing a specifically crafted project file, which may allow an attacker to execute arbitrary code.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Fujielectric

Products

Alpha7 Pc Loader Alpha7 Pc Loader Firmware

CVE-2022-2006

AutomationDirect C-more EA9 HMI Uncontrolled Search Path Element

AutomationDirect DirectLOGIC has a DLL vulnerability in the install directory that may allow an attacker to execute code during the installation process. This issue affects: AutomationDirect C-more EA9 EA9-T6CL versions prior to 6.73; EA9-T6CL-R versions prior to 6.73; EA9-T7CL versions prior to 6.73; EA9-T7CL-R versions prior to 6.73; EA9-T8CL versions prior to 6.73; EA9-T10CL versions prior to 6.73; EA9-T10WCL versions prior to 6.73; EA9-T12CL versions prior to 6.73; EA9-T15CL versions prior to 6.73; EA9-RHMI versions prior to 6.73; EA9-PGMSW versions prior to 6.73;

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Automationdirect

Products

C-more Ea9-pgmsw C-more Ea9-pgmsw Firmware C-more Ea9-rhmi and 21 more

CVE-2022-1405

Delta Electronics CNCSoft Stack-based Buffer Overflow

CNCSoft: All versions prior to 1.01.32 does not properly sanitize input while processing a specific project file, allowing a possible stack-based buffer overflow condition.

CVSS 3.1 · 7.8 High EPSS 2.2% KEV · Not listed

Vendors

Deltaww

Products

Cncsoft

CVE-2022-2485

AutomationDirect Stride Field I/O Cleartext Transmission of Sensitive Information

Any attempt (good or bad) to log into AutomationDirect Stride Field I/O with a web browser may result in the device responding with its password in the communication packets.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Automationdirect

Products

Sio-mb04ads Sio-mb04ads Firmware Sio-mb04das and 17 more

CVE-2022-2866

FATEK Automation FvDesigner Out-of-bounds Write

FATEK FvDesigner version 1.5.103 and prior is vulnerable to an out-of-bounds write while processing project files. If a valid user is tricked into using maliciously crafted project files, an attacker could achieve arbitrary code execution.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Fatek

Products

Fvdesigner

CVE-2022-2892

Measuresoft ScadaPro Server Out-of-bounds Write

Measuresoft ScadaPro Server (Versions prior to 6.8.0.1) uses an unmaintained ActiveX control, which may allow an out-of-bounds write condition while processing a specific project file.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Measuresoft

Products

Scadapro Server

CVE-2022-2895

Measuresoft ScadaPro Server Stack-based Buffer Overflow

Measuresoft ScadaPro Server (All Versions) uses unmaintained ActiveX controls. These controls may allow two stack-based buffer overflow instances while processing a specific project file.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Measuresoft

Products

Scadapro Server

CVE-2022-2897

Measuresoft ScadaPro Server and Client Link Following

Measuresoft ScadaPro Server and Client (All Versions) do not properly resolve links before file access; this could allow privilege escalation..

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Measuresoft

Products

Scadapro Client Scadapro Server

CVE-2022-2896

Measuresoft ScadaPro Server Use After Free

Measuresoft ScadaPro Server (All Versions) allows use after free while processing a specific project file.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Measuresoft

Products

Scadapro Server

CVE-2022-2979

Omron CX-Programmer

Opening a specially crafted file could cause the affected product to fail to release its memory reference potentially resulting in arbitrary code execution.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Omron

Products

Cx-programmer