indusoft web studio vulnerabilities and exploits

(subscribe to this query)

NA

The vulnerability, if exploited, could allow a malicious entity with access to the file system to achieve arbitrary code execution and privilege escalation by tricking AVEVA Edge to load an unsafe DLL.

5.3

CVSSv3

An issue exists in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior. The application allows a client to provide a malicious connection string that could allow an adversary to port scan the LAN, depending on the hosts' responses.

Aveva Edge 2020 Aveva Edge

9.8

CVSSv3

An issue exists in ExecuteCommand() in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior that allows unauthenticated arbitrary commands to be executed.

Aveva Edge 2020 Aveva Edge

7.5

CVSSv3

Path traversal vulnerability in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior allows an unauthenticated user to steal the Windows access token of the user account configured for accessing external DB resources.

Aveva Edge 2020 Aveva Edge

7.5

CVSSv3

AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 2017 Update. An unauthenticated remote user could use a specially crafted database connection configuration file to execute an arbitrary proce...

Aveva Indusoft Web Studio 8.1 Aveva Indusoft Web Studio 8.0 Aveva Indusoft Web Studio 7.1 Aveva Indusoft Web Studio 6.1 Aveva Intouch Machine Edition 2014 R2

9.8

CVSSv3

AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 2017 Update. Code is executed under the program runtime privileges, which could lead to the compromise of the machine.

Aveva Indusoft Web Studio 8.1 Aveva Indusoft Web Studio 8.0 Aveva Indusoft Web Studio 7.1 Aveva Indusoft Web Studio 6.1 Aveva Intouch Machine Edition 2014 R2

9.8

CVSSv3

InduSoft Web Studio versions before 8.1 SP2, and InTouch Edge HMI (formerly InTouch Machine Edition) versions before 2017 SP2. This vulnerability could allow an unauthenticated user to remotely execute code with the same privileges as that of the InduSoft Web Studio or InTouch Ed...

Aveva Indusoft Web Studio 8.0 Aveva Indusoft Web Studio 7.1 Aveva Indusoft Web Studio 8.1 Aveva Indusoft Web Studio 6.1 Aveva Edge 8.1 Aveva Intouch Machine Edition 2014 R2

9.8

CVSSv3

InduSoft Web Studio versions before 8.1 SP2, and InTouch Edge HMI (formerly InTouch Machine Edition) versions before 2017 SP2. A remote attacker could send a carefully crafted packet to exploit a stack-based buffer overflow vulnerability during tag, alarm, or event related action...

Aveva Indusoft Web Studio 8.0 Aveva Indusoft Web Studio 7.1 Aveva Indusoft Web Studio 8.1 Aveva Indusoft Web Studio 6.1 Aveva Edge 8.1 Aveva Intouch Machine Edition 2014 R2

9.8

CVSSv3

AVEVA InduSoft Web Studio v8.1 and v8.1SP1, and InTouch Machine Edition v2017 8.1 and v2017 8.1 SP1 a remote user could send a carefully crafted packet to exploit a stack-based buffer overflow vulnerability during tag, alarm, or event related actions such as read and write, with ...

Aveva Intouch Machine 2017 8.1 Aveva Indusoft Web Studio 8.1

9.8

CVSSv3

A remote attacker could send a carefully crafted packet in InduSoft Web Studio v8.1 and prior versions, and/or InTouch Machine Edition 2017 v8.1 and prior versions during a tag, alarm, or event related action such as read and write, which may allow remote code execution.

Indusoft Web Studio Industrial-software Intouch Machine Edition 2017

Get Started

1 2 3 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook