Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

498 results · page 4 of 10

Sep 5, 2023ARDEREG Sistema SCADA Central versions 2.203 and prior login page are vulnerable to an unauthenticated blind SQL injection attack.CVE-2023-4485 · Other software · ARDEREG · reported by ics-cert@hq.dhs.govCritical 9.8
ARDEREG Sistema SCADA Central versions 2.203 and prior login page are vulnerable to an unauthenticated blind SQL injection attack. An attacker could manipulate the application's SQL query logic to extract sensitive information or perform unauthorized actions within the database. In this case, the vulnerability could allow an attacker to execute arbitrary SQL queries through the login page, potentially leading to unauthorized access, data leakage, or even disruption of critical industrial processes.
Product
Sistemas SCADA
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Aug 3, 2023 External input could be used on TEL-STER TelWin SCADA WebInterface to construct paths to files and directories without properly neutralizing special elements wCVE-2023-0956 · Other software · TEL-STER · reported by ics-cert@hq.dhs.govHigh 7.5
External input could be used on TEL-STER TelWin SCADA WebInterface to construct paths to files and directories without properly neutralizing special elements within the pathname, which could allow an unauthenticated attacker to read files on the system.
Product
TelWin SCADA WebInterface
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl cisa.gov
Aug 2, 2023SpiderControl SCADA Webserver versions 2.08 and prior are vulnerable to path traversal.CVE-2023-3329 · Other software · iniNet · reported by ics-cert@hq.dhs.govMedium 6.5
SpiderControl SCADA Webserver versions 2.08 and prior are vulnerable to path traversal. An attacker with administrative privileges could overwrite files on the webserver using the HMI's upload file feature. This could create size zero files anywhere on the webserver, potentially overwriting system files and creating a denial-of-service condition.
Product
SCADAWebServer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Aug 2, 2023All versions prior to 9.1.4 of Advantech WebAccess/SCADA are vulnerable to use of untrusted pointers.CVE-2023-1437 · Other software · Advantech · reported by ics-cert@hq.dhs.govCritical 9.8
All versions prior to 9.1.4 of Advantech WebAccess/SCADA are vulnerable to use of untrusted pointers. The RPC arguments the client sent could contain raw memory pointers for the server to use as-is. This could allow an attacker to gain access to the remote file system and the ability to execute commands and overwrite files.
Product
WebAccess/SCADA
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Jun 7, 2023 If an attacker can trick an authenticated user into loading a maliciously crafted .zip file onto Advantech WebAccess version 8.4.5, a web shell could be used tCVE-2023-2866 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 7.3
If an attacker can trick an authenticated user into loading a maliciously crafted .zip file onto Advantech WebAccess version 8.4.5, a web shell could be used to give the attacker full control of the SCADA server.
Product
WebAccess/SCADA
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Jun 7, 2023On Triangle MicroWorks' SCADA Data Gateway version <= v5.01.03, an unauthenticated attacker can send broadcast events to any user via the WebMonitor.An unauthenCVE-2023-2187 · Other software · Triangle MicroWorks · reported by trellixpsirt@trellix.comMedium 5.3
On Triangle MicroWorks' SCADA Data Gateway version <= v5.01.03, an unauthenticated attacker can send broadcast events to any user via the WebMonitor.An unauthenticated user can use this vulnerability to forcefully log out of any currently logged-in user by sending a "password change event". Furthermore, an attacker could use this vulnerability to spam the logged-in user with false events.
Product
SCADA Data Gateway
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record trellix.com trellix.com
Jun 7, 2023On Triangle MicroWorks' SCADA Data Gateway version <= v5.01.03, an unauthenticated attacker can send a specially crafted broadcast message including format striCVE-2023-2186 · Other software · Triangle MicroWorks · reported by trellixpsirt@trellix.comHigh 8.2
On Triangle MicroWorks' SCADA Data Gateway version <= v5.01.03, an unauthenticated attacker can send a specially crafted broadcast message including format string characters to the SCADA Data Gateway to perform unrestricted memory reads.An unauthenticated user can use this format string vulnerability to repeatedly crash the GTWWebMonitor.exe process to DoS the Web Monitor. Furthermore, an authenticated user can leverage this vulnerability to leak memory from the GTWWebMonitor.exe process. This could be leveraged in an exploit chain to gain code execution.
Product
SCADA Data Gateway
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record trellix.com trellix.com
Jun 5, 2023 In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file upload vulnerability that could allow an attacker to modify the file extension of CVE-2023-32628 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 7.2
In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file upload vulnerability that could allow an attacker to modify the file extension of a certificate file to ASP when uploading it, which can lead to remote code execution.
Product
WebAccess/SCADA
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Jun 5, 2023 In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file overwrite vulnerability, which could allow an attacker to overwrite any file in the opCVE-2023-32540 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 7.2
In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file overwrite vulnerability, which could allow an attacker to overwrite any file in the operating system (including system files), inject code into an XLS file, and modify the file extension, which could lead to arbitrary code execution.
Product
WebAccess/SCADA
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Jun 5, 2023 In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file upload vulnerability that could allow an attacker to upload an ASP script file to a CVE-2023-22450 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 7.2
In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file upload vulnerability that could allow an attacker to upload an ASP script file to a webserver when logged in as manager user, which can lead to arbitrary code execution.
Product
WebAccess/SCADA
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
May 12, 2023The PnPSCADA system, a product of SDG Technologies CC, is afflicted by a critical unauthenticated error-based PostgreSQL Injection vulnerability.CVE-2023-1934 · Other software · SDG Technologies · reported by ics-cert@hq.dhs.govCritical 9.8
The PnPSCADA system, a product of SDG Technologies CC, is afflicted by a critical unauthenticated error-based PostgreSQL Injection vulnerability. Present within the hitlogcsv.jsp endpoint, this security flaw permits unauthenticated attackers to engage with the underlying database seamlessly and passively. Consequently, malicious actors could gain access to vital information, such as Industrial Control System (ICS) and OT data, alongside other sensitive records like SMS and SMS Logs. The unauthorized database access exposes compromised systems to potential manipulation or breach of essential infrastructure data, highlighting the severity of this vulnerability.
Product
PnPSCADA
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com cisa.gov
Apr 27, 2023mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands.CVE-2023-29169 · Other software · mySCADA Technologies · reported by ics-cert@hq.dhs.govHigh 8.8
mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands.
Product
mySCADA myPRO
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Apr 27, 2023mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands.CVE-2023-29150 · Other software · mySCADA Technologies · reported by ics-cert@hq.dhs.govHigh 8.8
mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands.
Product
mySCADA myPRO
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Apr 27, 2023mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands.CVE-2023-28716 · Other software · mySCADA Technologies · reported by ics-cert@hq.dhs.govHigh 8.8
mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands.
Product
mySCADA myPRO
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Apr 27, 2023mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands.CVE-2023-28400 · Other software · mySCADA Technologies · reported by ics-cert@hq.dhs.govHigh 8.8
mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands.
Product
mySCADA myPRO
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Apr 27, 2023mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands.CVE-2023-28384 · Other software · mySCADA Technologies · reported by ics-cert@hq.dhs.govHigh 8.8
mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands.
Product
mySCADA myPRO
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Apr 14, 2023SmartPTT SCADA 1.1.0.0 allows remote code execution (when the attacker has administrator privileges) by writing a malicious C# script and executing it on the seCVE-2023-30459 · Other software · Smartptt · reported by MITREHigh 7.2
SmartPTT SCADA 1.1.0.0 allows remote code execution (when the attacker has administrator privileges) by writing a malicious C# script and executing it on the server (via server settings in the administrator control panel on port 8101, by default).
Product
Smartptt Scada
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com smartptt.com
Apr 10, 2023An privilege escalation issue was discovered in Scada-LTS 2.7.1.1 build 2948559113 allows remote attackers, authenticated in the application as a low-privilegedCVE-2022-41976 · Other software · Scada-lts · reported by MITRECritical 9.9
An privilege escalation issue was discovered in Scada-LTS 2.7.1.1 build 2948559113 allows remote attackers, authenticated in the application as a low-privileged user to change role (e.g., to administrator) by updating their user profile.
Product
Scada-lts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record scada-lts.org github.com
Mar 16, 2023The listed versions of AVEVA Plant SCADA and AVEVA Telemetry Server are vulnerable to an improper authorization exploit which could allow an unauthenticated useCVE-2023-1256 · Other software · AVEVA · reported by ics-cert@hq.dhs.govCritical 9.8
The listed versions of AVEVA Plant SCADA and AVEVA Telemetry Server are vulnerable to an improper authorization exploit which could allow an unauthenticated user to remotely read data, cause denial of service, and tamper with alarm states.
Product
AVEVA Plant SCADA
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Mar 6, 2023Improper Protection for Outbound Error Messages and Alert Signals vulnerability in ProMIS Process Co.CVE-2023-0839 · Other software · ProMIS Process Co. · reported by iletisim@usom.gov.trCritical 9.8
Improper Protection for Outbound Error Messages and Alert Signals vulnerability in ProMIS Process Co. InSCADA allows Account Footprinting. This issue affects inSCADA: before 20230115-1.
Product
inSCADA
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
Feb 24, 2023A CWE-117: Improper Output Neutralization for Logs vulnerability exists that could cause the misinterpretation of log files when malicious packets are sent to tCVE-2023-0595 · Other software · Schneider Electric · reported by cybersecurity@se.comMedium 5.3
A CWE-117: Improper Output Neutralization for Logs vulnerability exists that could cause the misinterpretation of log files when malicious packets are sent to the Geo SCADA server's database web port (default 443). Affected products: EcoStruxure Geo SCADA Expert 2019, EcoStruxure Geo SCADA Expert 2020, EcoStruxure Geo SCADA Expert 2021(All Versions prior to October 2022), ClearSCADA (All Versions)
Product
EcoStruxure Geo SCADA Expert 2019
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record download.schneider-electric.com download.schneider-electric.com
Jan 31, 2023A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause information disclosure when specific messages are seCVE-2023-22611 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 7.5
A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause information disclosure when specific messages are sent to the server over the database server TCP port. Affected Products: EcoStruxure Geo SCADA Expert 2019 - 2021 (formerly known as ClearSCADA) (Versions prior to October 2022)
Product
EcoStruxure Geo SCADA Expert 2019 - 2021 (formerly known as ClearSCADA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record download.schneider-electric.com download.schneider-electric.com
Jan 31, 2023 A CWE-863: Incorrect Authorization vulnerability exists that could cause Denial of Service against the Geo SCADA server when specific messages are sent to the CVE-2023-22610 · Other software · Schneider Electric · reported by cybersecurity@se.comCritical 9.1
A CWE-863: Incorrect Authorization vulnerability exists that could cause Denial of Service against the Geo SCADA server when specific messages are sent to the server over the database server TCP port.
Product
EcoStruxure Geo SCADA Expert 2019 - 2021 (formerly known as ClearSCADA)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record download.schneider-electric.com download.schneider-electric.com
Dec 6, 2022Rapid Software LLC Rapid SCADA 5.8.4 is vulnerable to Cross Site Scripting (XSS).CVE-2022-44153 · Other software · Rapidscada · reported by MITREMedium 6.1
Rapid Software LLC Rapid SCADA 5.8.4 is vulnerable to Cross Site Scripting (XSS).
Product
Rapid Scada
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record nitroteam.kz nitroteam.kz
Nov 21, 2022An input validation vulnerability exists in the Monitor Pro interface of MicroSCADA Pro and MicroSCADA X SYS600.CVE-2022-3388 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comHigh 8.8
An input validation vulnerability exists in the Monitor Pro interface of MicroSCADA Pro and MicroSCADA X SYS600. An authenticated user can launch an administrator level remote code execution irrespective of the authenticated user's role.
Product
MicroSCADA Pro SYS600
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record search.abb.com search.abb.com
Nov 2, 2022An Improper Input Validation vulnerability exists in Trihedral VTScada version 12.0.38 and prior.CVE-2022-3181 · Other software · Trihedral · reported by ics-cert@hq.dhs.govHigh 7.5
An Improper Input Validation vulnerability exists in Trihedral VTScada version 12.0.38 and prior. A specifically malformed HTTP request could cause the affected VTScada to crash. Both local area network (LAN)-only and internet facing systems are affected.
Product
VTScada
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Sep 23, 2022The security descriptor of Measuresoft ScadaPro Server version 6.7 has inconsistent permissions, which could allow a local user with limited privileges to modifCVE-2022-3263 · Other software · Measuresoft · reported by ics-cert@hq.dhs.govHigh 7.8
The security descriptor of Measuresoft ScadaPro Server version 6.7 has inconsistent permissions, which could allow a local user with limited privileges to modify the service binary path and start malicious commands with SYSTEM privileges.
Product
ScadaPro Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Sep 14, 2022Improper Input Validation vulnerability exists in the Hitachi Energy MicroSCADA X SYS600's ICCP stack during the ICCP communication establishment causes a deniaCVE-2022-2277 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comHigh 7.5
Improper Input Validation vulnerability exists in the Hitachi Energy MicroSCADA X SYS600's ICCP stack during the ICCP communication establishment causes a denial-of-service when ICCP of SYS600 is request to forward any data item updates with timestamps too distant in the future to any remote ICCP system. By default, ICCP is not configured and not enabled. This issue affects: Hitachi Energy MicroSCADA X SYS600 version 10.2 to version 10.3.1. cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3.1:*:*:*:*:*:*:*
Product
MicroSCADA X SYS600
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record publisher.hitachienergy.com search.abb.com
Sep 14, 2022Improper Input Validation vulnerability in the handling of a specially crafted IEC 61850 packet with a valid data item but with incorrect data type in the IEC 6CVE-2022-29922 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comHigh 7.5
Improper Input Validation vulnerability in the handling of a specially crafted IEC 61850 packet with a valid data item but with incorrect data type in the IEC 61850 OPC Server in the Hitachi Energy MicroSCADA X SYS600, MicroSCADA Pro SYS600. The vulnerability may cause a denial-of-service on the IEC 61850 OPC Server part of the SYS600 product. This issue affects: Hitachi Energy MicroSCADA Pro SYS600 version 9.4 FP2 Hotfix 4 and earlier versions Hitachi Energy MicroSCADA X SYS600 version 10 to version 10.3.1. cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.0:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.2:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.3:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.4:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.1.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3:
Product
MicroSCADA X SYS600
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record search.abb.com search.abb.com
Sep 14, 2022Improper Input Validation vulnerability in the handling of a malformed IEC 104 TCP packet in the Hitachi Energy MicroSCADA X SYS600, MicroSCADA Pro SYS600.CVE-2022-29492 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comMedium 5.3
Improper Input Validation vulnerability in the handling of a malformed IEC 104 TCP packet in the Hitachi Energy MicroSCADA X SYS600, MicroSCADA Pro SYS600. Upon receiving a malformed IEC 104 TCP packet, the malformed packet is dropped, however the TCP connection is left open. This may cause a denial-of-service if the affected connection is left open. This issue affects: Hitachi Energy MicroSCADA Pro SYS600 version 9.4 FP2 Hotfix 4 and earlier versions Hitachi Energy MicroSCADA X SYS600 version 10 to version 10.3.1. cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.0:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.2:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.3:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_pro_sys600:9.4:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.1.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys60
Product
MicroSCADA X SYS600
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record search.abb.com search.abb.com
Sep 14, 2022Improper Input Validation vulnerability in Hitachi Energy MicroSCADA X SYS600 while reading a specific configuration file causes a buffer-overflow that causes aCVE-2022-1778 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comHigh 7.5
Improper Input Validation vulnerability in Hitachi Energy MicroSCADA X SYS600 while reading a specific configuration file causes a buffer-overflow that causes a failure to start the SYS600. The configuration file can only be accessed by an administrator access. This issue affects: Hitachi Energy MicroSCADA X SYS600 version 10 to version 10.3.1. cpe:2.3:a:hitachienergy:microscada_x_sys600:10:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.1.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3.1:*:*:*:*:*:*:*
Product
MicroSCADA X SYS600
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record publisher.hitachienergy.com search.abb.com
Sep 12, 2022Improper Authorization vulnerability exists in the Workplace X WebUI of the Hitachi Energy MicroSCADA X SYS600 allows an authenticated user to execute any MicroCVE-2022-29490 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comHigh 8.5
Improper Authorization vulnerability exists in the Workplace X WebUI of the Hitachi Energy MicroSCADA X SYS600 allows an authenticated user to execute any MicroSCADA internal scripts irrespective of the authenticated user's role. This issue affects: Hitachi Energy MicroSCADA X SYS600 version 10 to version 10.3.1. cpe:2.3:a:hitachienergy:microscada_x_sys600:10:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.1.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3.1:*:*:*:*:*:*:*
Product
MicroSCADA X SYS600
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record search.abb.com search.abb.com
Aug 31, 2022Measuresoft ScadaPro Server and Client (All Versions) do not properly resolve links before file access; this could allow a denial-of-service condition.CVE-2022-2898 · Other software · Measuresoft · reported by ics-cert@hq.dhs.govMedium 6.1
Measuresoft ScadaPro Server and Client (All Versions) do not properly resolve links before file access; this could allow a denial-of-service condition.
Product
ScadaPro Server and Client
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Aug 31, 2022Measuresoft ScadaPro Server and Client (All Versions) do not properly resolve links before file access; this could allow privilege escalation..CVE-2022-2897 · Other software · Measuresoft · reported by ics-cert@hq.dhs.govHigh 7.8
Measuresoft ScadaPro Server and Client (All Versions) do not properly resolve links before file access; this could allow privilege escalation..
Product
ScadaPro Server and Client
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Aug 31, 2022Measuresoft ScadaPro Server (All Versions) allows use after free while processing a specific project file.CVE-2022-2896 · Other software · Measuresoft · reported by ics-cert@hq.dhs.govHigh 7.8
Measuresoft ScadaPro Server (All Versions) allows use after free while processing a specific project file.
Product
ScadaPro Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Aug 31, 2022Measuresoft ScadaPro Server (All Versions) uses unmaintained ActiveX controls.CVE-2022-2895 · Other software · Measuresoft · reported by ics-cert@hq.dhs.govHigh 7.8
Measuresoft ScadaPro Server (All Versions) uses unmaintained ActiveX controls. These controls may allow two stack-based buffer overflow instances while processing a specific project file.
Product
ScadaPro Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Aug 31, 2022Measuresoft ScadaPro Server (All Versions) uses unmaintained ActiveX controls.CVE-2022-2894 · Other software · Measuresoft · reported by ics-cert@hq.dhs.govHigh 7.8
Measuresoft ScadaPro Server (All Versions) uses unmaintained ActiveX controls. The controls may allow seven untrusted pointer deference instances while processing a specific project file.
Product
ScadaPro Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Aug 31, 2022Measuresoft ScadaPro Server (Versions prior to 6.8.0.1) uses an unmaintained ActiveX control, which may allow an out-of-bounds write condition while processing CVE-2022-2892 · Other software · Measuresoft · reported by ics-cert@hq.dhs.govHigh 7.8
Measuresoft ScadaPro Server (Versions prior to 6.8.0.1) uses an unmaintained ActiveX control, which may allow an out-of-bounds write condition while processing a specific project file.
Product
ScadaPro Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Aug 24, 2022An authenticated mySCADA myPRO 8.26.0 user may be able to modify parameters to run commands directly in the operating system.CVE-2022-2234 · Other software · mySCADA Technologies · reported by ics-cert@hq.dhs.govCritical 9.9
An authenticated mySCADA myPRO 8.26.0 user may be able to modify parameters to run commands directly in the operating system.
Product
mySCADA myPRO
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Jun 24, 2022A CWE-668 Exposure of Resource to Wrong Sphere vulnerability exists that could cause users to be misled, hiding alarms, showing the wrong server connection optiCVE-2022-32530 · Other software · Schneider Electric · reported by cybersecurity@se.comMedium 4.8
A CWE-668 Exposure of Resource to Wrong Sphere vulnerability exists that could cause users to be misled, hiding alarms, showing the wrong server connection option or the wrong control request when a mobile device has been compromised by a malicious application. Affected Product: Geo SCADA Mobile (Build 222 and prior)
Product
Geo SCADA Mobile
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record download.schneider-electric.com download.schneider-electric.com
May 25, 2022When a non-existent resource is requested, the LCDS LAquis SCADA application (version 4.3.1.1011 and prior) returns error messages which may allow reflected croCVE-2021-32989 · Other software · LCDS—Leão Consultoria e Desenvolvimento de Sistemas Ltda ME · reported by ics-cert@hq.dhs.govCritical 9.3
When a non-existent resource is requested, the LCDS LAquis SCADA application (version 4.3.1.1011 and prior) returns error messages which may allow reflected cross-site scripting.
Product
LAquis SCADA
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
May 16, 2022xArrow SCADA versions 7.2 and prior permits unvalidated registry keys to be run with application-level privileges.CVE-2021-33025 · Other software · xArrow · reported by ics-cert@hq.dhs.govMedium 5.6
xArrow SCADA versions 7.2 and prior permits unvalidated registry keys to be run with application-level privileges.
Product
xArrow SCADA
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
May 16, 2022xArrow SCADA versions 7.2 and prior is vulnerable to cross-site scripting due to parameter ‘edate’ of the resource xhisalarm.htm, which may allow an unauthorizeCVE-2021-33021 · Other software · xArrow · reported by ics-cert@hq.dhs.govMedium 6.1
xArrow SCADA versions 7.2 and prior is vulnerable to cross-site scripting due to parameter ‘edate’ of the resource xhisalarm.htm, which may allow an unauthorized attacker to execute arbitrary code.
Product
xArrow SCADA
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
May 16, 2022xArrow SCADA versions 7.2 and prior is vulnerable to cross-site scripting due to parameter ‘bdate’ of the resource xhisvalue.htm, which may allow an unauthorizeCVE-2021-33001 · Other software · xArrow · reported by ics-cert@hq.dhs.govMedium 6.1
xArrow SCADA versions 7.2 and prior is vulnerable to cross-site scripting due to parameter ‘bdate’ of the resource xhisvalue.htm, which may allow an unauthorized attacker to execute arbitrary code.
Product
xArrow SCADA
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
May 13, 2022mySCADA myPRO versions prior to 8.20.0 does not restrict unauthorized read access to sensitive system information.CVE-2021-33013 · Other software · mySCADA · reported by ics-cert@hq.dhs.govHigh 8.2
mySCADA myPRO versions prior to 8.20.0 does not restrict unauthorized read access to sensitive system information.
Product
myPRO
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov myscada.org
May 13, 2022mySCADA myPRO versions prior to 8.20.0 allows an unauthenticated remote attacker to upload arbitrary files to the file system.CVE-2021-33009 · Other software · mySCADA · reported by ics-cert@hq.dhs.govHigh 7.5
mySCADA myPRO versions prior to 8.20.0 allows an unauthenticated remote attacker to upload arbitrary files to the file system.
Product
myPRO
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov myscada.org
May 13, 2022mySCADA myPRO versions prior to 8.20.0 allows an unauthenticated remote attacker to upload arbitrary files to arbitrary directories.CVE-2021-33005 · Other software · mySCADA · reported by ics-cert@hq.dhs.govHigh 7.5
mySCADA myPRO versions prior to 8.20.0 allows an unauthenticated remote attacker to upload arbitrary files to arbitrary directories.
Product
myPRO
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov myscada.org
May 13, 2022mySCADA myPRO versions prior to 8.20.0 does not restrict unauthorized read access to sensitive directory listing information.CVE-2021-27505 · Other software · mySCADA · reported by ics-cert@hq.dhs.govHigh 7.5
mySCADA myPRO versions prior to 8.20.0 does not restrict unauthorized read access to sensitive directory listing information.
Product
myPRO
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov myscada.org
Apr 29, 2022Elcomplus SmartPTT SCADA Server is vulnerable to an unauthenticated user can request various files from the server without any authentication or authorization.CVE-2021-43938 · Other software · Elcomplus · reported by ics-cert@hq.dhs.govHigh 8.1
Elcomplus SmartPTT SCADA Server is vulnerable to an unauthenticated user can request various files from the server without any authentication or authorization.
Product
SmartPTT SCADA Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Apr 29, 2022Elcomplus SmartPTT SCADA Server web application does not, or cannot, sufficiently verify whether a well-formed, valid, consistent request was intentionally provCVE-2021-43937 · Other software · Elcomplus · reported by ics-cert@hq.dhs.govHigh 7.6
Elcomplus SmartPTT SCADA Server web application does not, or cannot, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Product
SmartPTT SCADA Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.