| CVE-2023-5909 | ALTO7.5 |
KEPServerEX does not properly validate certificates from clients which may allow unauthenticated users to connect.
| 30/11/2023 |
| CVE-2023-5908 | CRÍTICO9.1 |
KEPServerEX is vulnerable to a buffer overflow which may allow an attacker to crash the product being accessed or leak information.
| 30/11/2023 |
| CVE-2023-4487 | ALTO7.8 |
GE CIMPLICITY 2023 is by a process control vulnerability, which could allow a local attacker to insert malicious configuration files in the expected web server execution path to escalate privileges and gain full control of the HMI software.
| 05/09/2023 |
| CVE-2023-1552 | ALTO7.8 | ToolboxST prior to version 7.10 is affected by a deserialization vulnerability. An attacker with local access to an HMI or who has conducted a social engineering attack on an authorized operator could execute code in a Toolbox user's context through the deserialization of an untrusted configuration file. Two CVSS score | 11/04/2023 |
| CVE-2022-2848 | CRÍTICO9.1 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kepware KEPServerEX 6.11.718.0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of text encoding conversions. The issue results from the lack of proper validation | 29/03/2023 |
| CVE-2022-2825 | CRÍTICO9.8 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kepware KEPServerEX 6.11.718.0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of text encoding conversions. The issue results from the lack of proper validation | 29/03/2023 |
| CVE-2023-0598 | CRÍTICO9.8 |
GE Digital Proficy iFIX 2022, GE Digital Proficy iFIX v6.1, and GE Digital Proficy iFIX v6.5 are vulnerable to code injection, which may allow an attacker to insert malicious configuration files in the expected web server execution path and gain full control of the HMI software.
| 16/03/2023 |
| CVE-2023-0755 | CRÍTICO9.8 |
The affected products are vulnerable to an improper validation of array index, which could allow an attacker to crash the server and remotely execute arbitrary code.
| 23/02/2023 |
| CVE-2023-0754 | CRÍTICO9.8 |
The affected products are vulnerable to an integer
overflow or wraparound, which could allow an attacker to crash the server and remotely
execute arbitrary code.
| 23/02/2023 |
| CVE-2022-46732 | CRÍTICO9.8 | Even if the authentication fails for local service authentication, the requested command could still execute regardless of authentication status. | 18/01/2023 |
| CVE-2022-46660 | MÉDIO6.5 |
An unauthorized user could alter or write files with full control over the path and content of the file.
| 18/01/2023 |
| CVE-2022-46331 | ALTO8.1 |
An unauthorized user could possibly delete any file on the system.
| 18/01/2023 |
| CVE-2022-43494 | MÉDIO6.5 |
An unauthorized user could be able to read any file on the system, potentially exposing sensitive information.
| 18/01/2023 |
| CVE-2022-38469 | ALTO7.5 |
An unauthorized user with network access and the decryption key could decrypt sensitive data, such as usernames and passwords.
| 18/01/2023 |
| CVE-2022-3092 | ALTO7.8 | GE CIMPICITY versions 2022 and prior is
vulnerable to an out-of-bounds write, which could allow an attacker to execute arbitrary code.
| 08/12/2022 |
| CVE-2022-3084 | ALTO7.8 | GE CIMPICITY versions 2022 and prior is vulnerable when data from a faulting address controls code flow starting at gmmiObj!CGmmiRootOptionTable, which could allow an attacker to execute arbitrary code.
| 08/12/2022 |
| CVE-2022-2952 | ALTO7.8 | GE CIMPICITY versions 2022 and prior is
vulnerable when data from a faulting address controls code flow starting at gmmiObj!CGmmiOptionContainer, which could allow an attacker to execute arbitrary code.
| 07/12/2022 |
| CVE-2022-2948 | ALTO7.8 | GE CIMPICITY versions 2022 and prior is
vulnerable to a heap-based buffer overflow, which could allow an attacker to execute arbitrary code.
| 07/12/2022 |
| CVE-2022-2002 | ALTO7.8 | GE CIMPICITY versions 2022 and prior is
vulnerable when data from faulting address controls code flow starting at gmmiObj!CGmmiOptionContainer, which could allow an attacker to execute arbitrary code.
| 07/12/2022 |
| CVE-2022-37953 | MÉDIO6.1 | An HTTP response splitting vulnerability exists in the AM Gateway Challenge-Response dialog of WorkstationST (<v07.09.15) and could allow an attacker to compromise a victim's browser/session. WorkstationST is only deployed in specific, controlled environments rendering attack complexity significantly higher than if the | 25/08/2022 |