Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17 results
May 21, 2024There are multiple ways in LCDS LAquis SCADA for an attacker to access locations outside of their own directory.CVE-2024-5040 · Other software · LCDS · reported by ics-cert@hq.dhs.govHigh 8.5
There are multiple ways in LCDS LAquis SCADA for an attacker to access locations outside of their own directory.
- Product
- LAquis SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2022When a non-existent resource is requested, the LCDS LAquis SCADA application (version 4.3.1.1011 and prior) returns error messages which may allow reflected croCVE-2021-32989 · Other software · LCDS—Leão Consultoria e Desenvolvimento de Sistemas Ltda ME · reported by ics-cert@hq.dhs.govCritical 9.3
When a non-existent resource is requested, the LCDS LAquis SCADA application (version 4.3.1.1011 and prior) returns error messages which may allow reflected cross-site scripting.
- Product
- LAquis SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2021LCDS LAquis SCADA through 4.3.1.1085 is vulnerable to a control bypass and path traversal.CVE-2021-41579 · Other software · Laquisscada · reported by MITREHigh 7.8
LCDS LAquis SCADA through 4.3.1.1085 is vulnerable to a control bypass and path traversal. If an attacker can get a victim to load a malicious els project file and use the play feature, then the attacker can bypass a consent popup and write arbitrary files to OS locations where the user has permission, leading to code execution.
- Product
- Scada
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2020LCDS LAquis SCADA Versions 4.3.1 and prior.CVE-2020-10622 · Other software · Lcds · reported by ics-cert@hq.dhs.govHigh 7.8
LCDS LAquis SCADA Versions 4.3.1 and prior. The affected product is vulnerable to arbitrary file creation by unauthorized users
- Product
- Laquis Scada
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.govus-cert.gov
May 4, 2020LCDS LAquis SCADA Versions 4.3.1 and prior.CVE-2020-10618 · Other software · Lcds · reported by ics-cert@hq.dhs.govMedium 5.5
LCDS LAquis SCADA Versions 4.3.1 and prior. The affected product is vulnerable to sensitive information exposure by unauthorized users.
- Product
- Laquis Scada
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.govus-cert.gov
Mar 27, 2019LCDS Laquis SCADA prior to version 4.1.0.4150 allows an out of bounds read when opening a specially crafted project file, which may cause a system crash or alloCVE-2018-18994 · Other software · LCDS Laquis · reported by ics-cert@hq.dhs.govHigh 7.1
LCDS Laquis SCADA prior to version 4.1.0.4150 allows an out of bounds read when opening a specially crafted project file, which may cause a system crash or allow data exfiltration.
- Product
- LCDS Laquis SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.us-cert.govics-cert.us-cert.gov
Mar 27, 2019Opening a specially crafted LCDS LAquis SCADA before 4.3.1.71 ELS file may result in a write past the end of an allocated buffer, which may allow an attacker toCVE-2019-6536 · Other software · LCDS - Leão Consultoria e Desenvolvimento de Sistemas Ltda ME · reported by ics-cert@hq.dhs.govHigh 7.8
Opening a specially crafted LCDS LAquis SCADA before 4.3.1.71 ELS file may result in a write past the end of an allocated buffer, which may allow an attacker to execute remote code in the context of the current process.
- Product
- LAquis SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.us-cert.govzerodayinitiative.com
Feb 5, 2019LCDS Laquis SCADA prior to version 4.1.0.4150 allows an attacker using a specially crafted project file to supply a pointer for a controlled memory address, whiCVE-2018-19029 · Other software · LCDS · reported by ics-cert@hq.dhs.govHigh 7.8
LCDS Laquis SCADA prior to version 4.1.0.4150 allows an attacker using a specially crafted project file to supply a pointer for a controlled memory address, which may allow remote code execution, data exfiltration, or cause a system crash.
- Product
- LCDS Laquis SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Feb 5, 2019LCDS Laquis SCADA prior to version 4.1.0.4150 allows improper control of generation of code when opening a specially crafted project file, which may allow remotCVE-2018-19002 · Other software · LCDS · reported by ics-cert@hq.dhs.govHigh 7.8
LCDS Laquis SCADA prior to version 4.1.0.4150 allows improper control of generation of code when opening a specially crafted project file, which may allow remote code execution, data exfiltration, or cause a system crash.
- Product
- LCDS Laquis SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Feb 5, 2019LCDS Laquis SCADA prior to version 4.1.0.4150 allows an authentication bypass, which may allow an attacker access to sensitive data.CVE-2018-19000 · Other software · ICS-CERT · reported by ics-cert@hq.dhs.govMedium 5.3
LCDS Laquis SCADA prior to version 4.1.0.4150 allows an authentication bypass, which may allow an attacker access to sensitive data.
- Product
- LCDS Laquis SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Feb 5, 2019LCDS Laquis SCADA prior to version 4.1.0.4150 uses hard coded credentials, which may allow an attacker unauthorized access to the system with high privileges.CVE-2018-18998 · Other software · ICS-CERT · reported by ics-cert@hq.dhs.govCritical 9.8
LCDS Laquis SCADA prior to version 4.1.0.4150 uses hard coded credentials, which may allow an attacker unauthorized access to the system with high privileges.
- Product
- LCDS Laquis SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Feb 5, 2019LCDS Laquis SCADA prior to version 4.1.0.4150 allows taking in user input without proper authorization or sanitation, which may allow an attacker to execute remCVE-2018-18996 · Other software · ICS-CERT · reported by ics-cert@hq.dhs.govCritical 9.8
LCDS Laquis SCADA prior to version 4.1.0.4150 allows taking in user input without proper authorization or sanitation, which may allow an attacker to execute remote code on the server.
- Product
- LCDS Laquis SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Feb 5, 2019LCDS Laquis SCADA prior to version 4.1.0.4150 allows taking in user input without proper sanitation, which may allow an attacker to execute remote code on the sCVE-2018-18992 · Other software · ICS-CERT · reported by ics-cert@hq.dhs.govHigh 8.8
LCDS Laquis SCADA prior to version 4.1.0.4150 allows taking in user input without proper sanitation, which may allow an attacker to execute remote code on the server.
- Product
- LCDS Laquis SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Feb 5, 2019LCDS Laquis SCADA prior to version 4.1.0.4150 allows a user-supplied path in file operations prior to proper validation.CVE-2018-18990 · Other software · ICS-CERT · reported by ics-cert@hq.dhs.govMedium 5.3
LCDS Laquis SCADA prior to version 4.1.0.4150 allows a user-supplied path in file operations prior to proper validation. An attacker can leverage this vulnerability to disclose sensitive information under the context of the web server process.
- Product
- LCDS Laquis SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Feb 5, 2019LCDS Laquis SCADA prior to version 4.1.0.4150 allows the opening of a specially crafted report format file that may cause an out of bounds read, which may causeCVE-2018-18986 · Other software · LCDS · reported by ics-cert@hq.dhs.govHigh 7.8
LCDS Laquis SCADA prior to version 4.1.0.4150 allows the opening of a specially crafted report format file that may cause an out of bounds read, which may cause a system crash, allow data exfiltration, or remote code execution.
- Product
- LCDS Laquis SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Feb 1, 2019LCDS Laquis SCADA prior to version 4.1.0.4150 allows out of bounds read when opening a specially crafted project file, which may allow data exfiltration.CVE-2018-19004 · Other software · ICS-CERT · reported by ics-cert@hq.dhs.govLow 3.3
LCDS Laquis SCADA prior to version 4.1.0.4150 allows out of bounds read when opening a specially crafted project file, which may allow data exfiltration.
- Product
- LCDS Laquis SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Feb 1, 2019LCDS Laquis SCADA prior to version 4.1.0.4150 allows execution of script code by opening a specially crafted report format file.CVE-2018-18988 · Other software · ICS-CERT · reported by ics-cert@hq.dhs.govHigh 8.8
LCDS Laquis SCADA prior to version 4.1.0.4150 allows execution of script code by opening a specially crafted report format file. This may allow remote code execution, data exfiltration, or cause a system crash.
- Product
- LCDS Laquis SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comics-cert.us-cert.gov
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.