Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
498 results · page 6 of 10
Jun 11, 2021A CWE-125: Out-of-bounds read vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in disclosure of information or remote CVE-2021-22757 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.8
A CWE-125: Out-of-bounds read vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in disclosure of information or remote code execution due to lack of sanity checks on user-supplied input data, when a malicious CGF file is imported to IGSS Definition.
- Product
- Interactive Graphical Scada System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Jun 11, 2021A CWE-125: Out-of-bounds read vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in disclosure of information or remote CVE-2021-22756 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.8
A CWE-125: Out-of-bounds read vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in disclosure of information or remote code execution due to lack of user-supplied data validation, when a malicious CGF file is imported to IGSS Definition.
- Product
- Interactive Graphical Scada System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Jun 11, 2021A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in disclosure of information or remoteCVE-2021-22755 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.8
A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in disclosure of information or remote code execution due to lack of sanity checks on user-supplied data, when a malicious CGF file is imported to IGSS Definition.
- Product
- Interactive Graphical Scada System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Jun 11, 2021A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in loss of data or remote code executiCVE-2021-22754 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.8
A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in loss of data or remote code execution due to lack of proper validation of user-supplied data, when a malicious CGF file is imported to IGSS Definition.
- Product
- Interactive Graphical Scada System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Jun 11, 2021A CWE-125: Out-of-bounds read vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in loss of data or remote code executioCVE-2021-22753 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.8
A CWE-125: Out-of-bounds read vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in loss of data or remote code execution due to missing length checks, when a malicious WSP file is being parsed by IGSS Definition.
- Product
- Interactive Graphical Scada System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Jun 11, 2021A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in loss of data or remote code executiCVE-2021-22752 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.8
A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in loss of data or remote code execution due to missing size checks, when a malicious WSP (Workspace) file is being parsed by IGSS Definition.
- Product
- Interactive Graphical Scada System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Jun 11, 2021A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in disclosure of information or executCVE-2021-22751 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.8
A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21140 and prior that could result in disclosure of information or execution of arbitrary code due to lack of input validation, when a malicious CGF (Configuration Group File) file is imported to IGSS Definition.
- Product
- Interactive Graphical Scada System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Jun 11, 2021A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21041 and prior that could result in loss of data or remote code executiCVE-2021-22750 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.8
A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition (Def.exe) V15.0.0.21041 and prior that could result in loss of data or remote code execution due to missing length checks, when a malicious CGF file is imported to IGSS Definition.
- Product
- Interactive Graphical Scada System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Jun 11, 2021OpenPLC ScadaBR Cross-site Scripting VulnerabilityCVE-2021-26829 · Other software · OpenPLC · reported by MITREExploitedMedium 5.4
OpenPLC ScadaBR contains a cross-site scripting vulnerability via system_settings.shtm.
- Product
- ScadaBR
- On CISA’s list since
- Nov 28, 2025 (federal fix deadline Dec 19, 2025)
- What to do
- Attackers are using this now. Install OpenPLC’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogforum.scadabr.com.bryoutu.be
Jun 11, 2021OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type VulnerabilityCVE-2021-26828 · Other software · OpenPLC · reported by MITREExploitedHigh 8.8
OpenPLC ScadaBR contains an unrestricted upload of file with dangerous type vulnerability that allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm.
- Product
- ScadaBR
- On CISA’s list since
- Dec 3, 2025 (federal fix deadline Dec 24, 2025)
- What to do
- Attackers are using this now. Install OpenPLC’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogforum.scadabr.com.brpacketstormsecurity.com
May 26, 2021Use of Password Hash with Insufficient Computational Effort vulnerability exists in ClearSCADA (all versions), EcoStruxure Geo SCADA Expert 2019 (all versions),CVE-2021-22741 · Other software · Schneider-electric · reported by cybersecurity@se.comMedium 6.7
Use of Password Hash with Insufficient Computational Effort vulnerability exists in ClearSCADA (all versions), EcoStruxure Geo SCADA Expert 2019 (all versions), and EcoStruxure Geo SCADA Expert 2020 (V83.7742.1 and prior), which could cause the revealing of account credentials when server database files are available. Exposure of these files to an attacker can make the system vulnerable to password decryption attacks. Note that “.sde” configuration export files do not contain user account password hashes.
- Product
- Clearscada
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Apr 26, 2021Incorrect permissions are set to default on the ‘Project Management’ page of WebAccess/SCADA portal of WebAccess/SCADA Versions 9.0.1 and prior, which may allowCVE-2021-22669 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 8.8
Incorrect permissions are set to default on the ‘Project Management’ page of WebAccess/SCADA portal of WebAccess/SCADA Versions 9.0.1 and prior, which may allow a low-privileged user to update an administrator’s password and login as an administrator to escalate privileges on the system.
- Product
- Webaccess/scada
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Mar 18, 2021WebAccess/SCADA Versions 9.0 and prior is vulnerable to cross-site scripting, which may allow an attacker to send malicious JavaScript code to an unsuspecting uCVE-2021-27436 · Other software · Advantech · reported by ics-cert@hq.dhs.govMedium 6.1
WebAccess/SCADA Versions 9.0 and prior is vulnerable to cross-site scripting, which may allow an attacker to send malicious JavaScript code to an unsuspecting user, which could result in hijacking of the user’s cookie/session tokens, redirecting the user to a malicious webpage and performing unintended browser actions.
- Product
- Webaccess/scada
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Mar 11, 2021A CWE-119:Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in Interactive Graphical SCADA System (IGSS) Definition (CVE-2021-22712 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.8
A CWE-119:Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in Interactive Graphical SCADA System (IGSS) Definition (Def.exe) V15.0.0.21041 and prior, which could result in arbitrary read or write conditions when malicious CGF (Configuration Group File) file is imported to IGSS Definition due to an unchecked pointer address.
- Product
- Interactive Graphical Scada System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comse.com
Mar 11, 2021A CWE-119:Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in Interactive Graphical SCADA System (IGSS) Definition (CVE-2021-22711 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.8
A CWE-119:Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in Interactive Graphical SCADA System (IGSS) Definition (Def.exe) V15.0.0.21041 and prior, which could result in arbitrary read or write conditions when malicious CGF (Configuration Group File) file is imported to IGSS Definition due to missing validation of input data.
- Product
- Interactive Graphical Scada System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comse.com
Mar 11, 2021A CWE-119:Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in Interactive Graphical SCADA System (IGSS) Definition (CVE-2021-22710 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.8
A CWE-119:Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in Interactive Graphical SCADA System (IGSS) Definition (Def.exe) V15.0.0.21041 and prior, which could cause remote code execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition.
- Product
- Interactive Graphical Scada System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comse.com
Mar 11, 2021A CWE-119:Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in Interactive Graphical SCADA System (IGSS) Definition (CVE-2021-22709 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.8
A CWE-119:Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in Interactive Graphical SCADA System (IGSS) Definition (Def.exe) V15.0.0.21041 and prior, which could result in loss of data or remote code execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition.
- Product
- Interactive Graphical Scada System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comse.com
Mar 3, 2021An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation.CVE-2020-13554 · Other software · Advantech · reported by talos-cna@cisco.comHigh 7.8
An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation. In webvrpcs Run Key Privilege Escalation in installation folder of WebAccess, an attacker can either replace binary or loaded modules to execute code with NT SYSTEM privilege.
- Product
- Webaccess/scada
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Feb 23, 2021The WADashboard component of WebAccess/SCADA Versions 9.0 and prior may allow an attacker to control or influence a path used in an operation on the filesystem CVE-2020-25161 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 8.8
The WADashboard component of WebAccess/SCADA Versions 9.0 and prior may allow an attacker to control or influence a path used in an operation on the filesystem and remotely execute code as an administrator.
- Product
- Webaccess/scada
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Feb 18, 2021HMI/SCADA iFIX (Versions 6.1 and prior) allows a local authenticated user to modify system-wide iFIX configurations through the registry.CVE-2019-18243 · Other software · GE · reported by ics-cert@hq.dhs.govMedium 5.5
HMI/SCADA iFIX (Versions 6.1 and prior) allows a local authenticated user to modify system-wide iFIX configurations through the registry. This may allow privilege escalation.
- Product
- Ifix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Feb 18, 2021HMI/SCADA iFIX (Versions 6.1 and prior) allows a local authenticated user to modify system-wide iFIX configurations through section objects.CVE-2019-18255 · Other software · GE · reported by ics-cert@hq.dhs.govMedium 5.5
HMI/SCADA iFIX (Versions 6.1 and prior) allows a local authenticated user to modify system-wide iFIX configurations through section objects. This may allow privilege escalation.
- Product
- Ifix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Feb 17, 2021An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation.CVE-2020-13555 · Other software · Advantech · reported by talos-cna@cisco.comHigh 8.8
An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation. In COM Server Application Privilege Escalation, an attacker can either replace binary or loaded modules to execute code with NT SYSTEM privilege.
- Product
- Webaccess/scada
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Feb 17, 2021An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation.CVE-2020-13553 · Other software · Advantech · reported by talos-cna@cisco.comHigh 8.8
An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation. In webvrpcs Run Key Privilege Escalation in installation folder of WebAccess, an attacker can either replace binary or loaded modules to execute code with NT SYSTEM privilege.
- Product
- Webaccess/scada
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Feb 17, 2021An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation.CVE-2020-13552 · Other software · Advantech · reported by talos-cna@cisco.comHigh 8.8
An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation. In privilege escalation via multiple service executables in installation folder of WebAccess, an attacker can either replace binary or loaded modules to execute code with NT SYSTEM privilege.
- Product
- Webaccess/scada
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Feb 17, 2021An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation.CVE-2020-13551 · Other software · Advantech · reported by talos-cna@cisco.comHigh 8.8
An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation. In privilege escalation via PostgreSQL executable, an attacker can either replace binary or loaded modules to execute code with NT SYSTEM privilege.
- Product
- Webaccess/scada
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Feb 17, 2021A local file inclusion vulnerability exists in the installation functionality of Advantech WebAccess/SCADA 9.0.1.CVE-2020-13550 · Other software · Advantech · reported by talos-cna@cisco.comHigh 7.7
A local file inclusion vulnerability exists in the installation functionality of Advantech WebAccess/SCADA 9.0.1. A specially crafted application can lead to information disclosure. An attacker can send an authenticated HTTP request to trigger this vulnerability.
- Product
- Webaccess/scada
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Feb 16, 2021PNPSCADA 2.200816204020 allows SQL injection via parameter 'interf' in /browse.jsp.CVE-2020-24841 · Other software · SDG · reported by MITRECritical 9.8
PNPSCADA 2.200816204020 allows SQL injection via parameter 'interf' in /browse.jsp. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
- Product
- Pnpscada
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Feb 10, 2021PNPSCADA 2.200816204020 allows cross-site scripting (XSS), which can execute arbitrary JavaScript in the victim's browser.CVE-2020-24842 · Other software · Sdgc · reported by MITREMedium 6.1
PNPSCADA 2.200816204020 allows cross-site scripting (XSS), which can execute arbitrary JavaScript in the victim's browser.
- Product
- Pnpscada
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Jan 11, 2021A denial-of-service vulnerability exists in the traffic-logging functionality of FreyrSCADA IEC-60879-5-104 Server Simulator 21.04.028.CVE-2020-13559 · Other software · Freyrscada · reported by talos-cna@cisco.comHigh 7.5
A denial-of-service vulnerability exists in the traffic-logging functionality of FreyrSCADA IEC-60879-5-104 Server Simulator 21.04.028. A specially crafted packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.
- Product
- Iec-60879-5-104 Server Simulator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Dec 10, 2020A CWE-522: Insufficiently Protected Credentials vulnerability exists in EcoStruxure Geo SCADA Expert 2019 (Original release and Monthly Updates to September 202CVE-2020-28219 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.8
A CWE-522: Insufficiently Protected Credentials vulnerability exists in EcoStruxure Geo SCADA Expert 2019 (Original release and Monthly Updates to September 2020, from 81.7268.1 to 81.7578.1) and EcoStruxure Geo SCADA Expert 2020 (Original release and Monthly Updates to September 2020, from 83.7551.1 to 83.7578.1), that could cause exposure of credentials to server-side users when web users are logged in to Virtual ViewX.
- Product
- Ecostruxure GEO Scada Expert 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2020A CWE-284: Improper Access Control vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for veCVE-2020-7547 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 8.8
A CWE-284: Improper Access Control vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for version information) that could allow a user the ability to perform actions via the web interface at a higher privilege level.
- Product
- Ecostruxure Energy Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2020A CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA SoftwarCVE-2020-7546 · Other software · Schneider-electric · reported by cybersecurity@se.comMedium 5.4
A CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for version information) that could allow an attacker to perform actions on behalf of the authorized user when accessing an affected webpage.
- Product
- Ecostruxure Energy Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 1, 2020A CWE-284:Improper Access Control vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for verCVE-2020-7545 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.2
A CWE-284:Improper Access Control vulnerability exists in EcoStruxureª and SmartStruxureª Power Monitoring and SCADA Software (see security notification for version information) that could allow for arbitrary code execution on the server when an authorized user access an affected webpage.
- Product
- Ecostruxure Energy Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2020A CWE-787 Out-of-bounds Write vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF (CVE-2020-7558 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.8
A CWE-787 Out-of-bounds Write vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition.
- Product
- Interactive Graphical Scada System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordse.comzerodayinitiative.com
Nov 19, 2020A CWE-125 Out-of-bounds Read vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF (CCVE-2020-7557 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.8
A CWE-125 Out-of-bounds Read vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition.
- Product
- Interactive Graphical Scada System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordse.comzerodayinitiative.com
Nov 19, 2020A CWE-787 Out-of-bounds Write vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF (CVE-2020-7556 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.8
A CWE-787 Out-of-bounds Write vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition.
- Product
- Interactive Graphical Scada System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordse.comzerodayinitiative.com
Nov 19, 2020A CWE-787 Out-of-bounds Write vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF (CVE-2020-7555 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.8
A CWE-787 Out-of-bounds Write vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition.
- Product
- Interactive Graphical Scada System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordse.comzerodayinitiative.com
Nov 19, 2020A CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that coCVE-2020-7554 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.8
A CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition.
- Product
- Interactive Graphical Scada System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordse.comzerodayinitiative.com
Nov 19, 2020A CWE-787 Out-of-bounds Write vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF (CVE-2020-7553 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.8
A CWE-787 Out-of-bounds Write vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition.
- Product
- Interactive Graphical Scada System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordse.comzerodayinitiative.com
Nov 19, 2020A CWE-787: Out-of-bounds Write vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247, that could cause Remote Code Execution when malicious CGFCVE-2020-7552 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.8
A CWE-787: Out-of-bounds Write vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247, that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition.
- Product
- Interactive Graphical Scada System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2020A CWE-787: Out-of-bounds Write vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247, that could cause Remote Code Execution when malicious CGFCVE-2020-7551 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.8
A CWE-787: Out-of-bounds Write vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247, that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition.
- Product
- Interactive Graphical Scada System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2020A CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 and priCVE-2020-7550 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.8
A CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 and prior that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition.
- Product
- Interactive Graphical Scada System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordse.comzerodayinitiative.com
Oct 14, 2020An attacker who convinces a valid user to open a specially crafted project file to exploit could execute code under the privileges of the application due to an CVE-2020-25188 · Other software · Laquisscada · reported by ics-cert@hq.dhs.govHigh 7.8
An attacker who convinces a valid user to open a specially crafted project file to exploit could execute code under the privileges of the application due to an out-of-bounds read vulnerability on the LAquis SCADA (Versions prior to 4.3.1.870).
- Product
- Scada
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govzerodayinitiative.com
Sep 16, 2020A CWE-502 Deserialization of Untrusted Data vulnerability exists in SCADAPack x70 Security Administrator (V1.2.0 and prior) which could allow arbitrary code exeCVE-2020-7532 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.8
A CWE-502 Deserialization of Untrusted Data vulnerability exists in SCADAPack x70 Security Administrator (V1.2.0 and prior) which could allow arbitrary code execution when an attacker builds a custom .SDB file containing a malicious serialized buffer.
- Product
- Scadapack X70 Security Administrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2020A CWE-284 Improper Access Control vulnerability exists in SCADAPack 7x Remote Connect (V3.6.3.574 and prior) which allows an attacker to place executables in a CVE-2020-7531 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.8
A CWE-284 Improper Access Control vulnerability exists in SCADAPack 7x Remote Connect (V3.6.3.574 and prior) which allows an attacker to place executables in a specific folder and run code whenever RemoteConnect is executed by the user.
- Product
- Scadapack 7x Remote Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2020A CWE-285 Improper Authorization vulnerability exists in SCADAPack 7x Remote Connect (V3.6.3.574 and prior) which allows improper access to executable code foldCVE-2020-7530 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 8.8
A CWE-285 Improper Authorization vulnerability exists in SCADAPack 7x Remote Connect (V3.6.3.574 and prior) which allows improper access to executable code folders.
- Product
- Scadapack 7x Remote Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2020A CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Transversal') vulnerability exists in SCADAPack 7x Remote Connect (V3.6.3.574 and prCVE-2020-7529 · Other software · Schneider-electric · reported by cybersecurity@se.comMedium 5.5
A CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Transversal') vulnerability exists in SCADAPack 7x Remote Connect (V3.6.3.574 and prior) which allows an attacker to place content in any unprotected folder on the target system using a crafted .RCZ file.
- Product
- Scadapack 7x Remote Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2020A CWE-502 Deserialization of Untrusted Data vulnerability exists in SCADAPack 7x Remote Connect (V3.6.3.574 and prior) which could allow arbitrary code executioCVE-2020-7528 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.8
A CWE-502 Deserialization of Untrusted Data vulnerability exists in SCADAPack 7x Remote Connect (V3.6.3.574 and prior) which could allow arbitrary code execution when an attacker builds a custom .PRJ file containing a malicious serialized buffer.
- Product
- Scadapack 7x Remote Connect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2020Rapid Software LLC Rapid SCADA 5.8.0 is affected by a local privilege escalation vulnerability in the ScadaAgentSvc.exe executable file.CVE-2020-22722 · Other software · Rapidscada · reported by MITREHigh 7.8
Rapid Software LLC Rapid SCADA 5.8.0 is affected by a local privilege escalation vulnerability in the ScadaAgentSvc.exe executable file. An attacker can obtain admin privileges by placing a malicious .exe file in the application and renaming it ScadaAgentSvc.exe, which would result in executing the binary as NT AUTHORITY\SYSTEM in a Windows operating system. For example, an attacker can plant a reverse shell from a low privileged user account and by restarting the computer, the malicious service will be started as NT AUTHORITY\SYSTEM by giving the attacker full system access to the remote PC.
- Product
- Rapid Scada
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsyhack.wordpress.comsyhack.wordpress.com
May 4, 2020LCDS LAquis SCADA Versions 4.3.1 and prior.CVE-2020-10622 · Other software · Lcds · reported by ics-cert@hq.dhs.govHigh 7.8
LCDS LAquis SCADA Versions 4.3.1 and prior. The affected product is vulnerable to arbitrary file creation by unauthorized users
- Product
- Laquis Scada
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.govus-cert.gov
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.