Updated 9 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

46 results

Feb 5, 2026ProficySCADA for iOS 5.0.25920 contains a denial of service vulnerability that allows attackers to crash the application by manipulating the password input fielCVE-2020-37143 · Other software · GE Intelligent Platforms, Inc. · reported by VulnCheckMedium 4.6
ProficySCADA for iOS 5.0.25920 contains a denial of service vulnerability that allows attackers to crash the application by manipulating the password input field. Attackers can overwrite the password field with 257 bytes of repeated characters to trigger an application crash and prevent successful authentication.
Product
ProficySCADA for iOS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record download.cnet.com exploit-db.com
Mar 16, 2023 GE Digital Proficy iFIX 2022, GE Digital Proficy iFIX v6.1, and GE Digital Proficy iFIX v6.5 are vulnerable to code injection, which may allow an attacker to iCVE-2023-0598 · Other software · GE Digital · reported by ics-cert@hq.dhs.govHigh 7.8
GE Digital Proficy iFIX 2022, GE Digital Proficy iFIX v6.1, and GE Digital Proficy iFIX v6.5 are vulnerable to code injection, which may allow an attacker to insert malicious configuration files in the expected web server execution path and gain full control of the HMI software.
Product
Proficy iFIX
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record digitalsupport.ge.com cisa.gov
Jan 17, 2023Even if the authentication fails for local service authentication, the requested command could still execute regardless of authentication status.CVE-2022-46732 · Other software · GE Digital · reported by ics-cert@hq.dhs.govCritical 9.8
Even if the authentication fails for local service authentication, the requested command could still execute regardless of authentication status.
Product
Proficy Historian
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record digitalsupport.ge.com cisa.gov
Jan 17, 2023 An unauthorized user could alter or write files with full control over the path and content of the file.CVE-2022-46660 · Other software · GE Digital · reported by ics-cert@hq.dhs.govHigh 7.5
An unauthorized user could alter or write files with full control over the path and content of the file.
Product
Proficy Historian
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record digitalsupport.ge.com cisa.gov
Jan 17, 2023 An unauthorized user could possibly delete any file on the system.CVE-2022-46331 · Other software · GE Digital · reported by ics-cert@hq.dhs.govHigh 7.5
An unauthorized user could possibly delete any file on the system.
Product
Proficy Historian
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record digitalsupport.ge.com cisa.gov
Jan 17, 2023 An unauthorized user could be able to read any file on the system, potentially exposing sensitive information.CVE-2022-43494 · Other software · GE Digital · reported by ics-cert@hq.dhs.govHigh 7.5
An unauthorized user could be able to read any file on the system, potentially exposing sensitive information.
Product
Proficy Historian
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record digitalsupport.ge.com cisa.gov
Jan 17, 2023 An unauthorized user with network access and the decryption key could decrypt sensitive data, such as usernames and passwords.CVE-2022-38469 · Other software · GE Digital · reported by ics-cert@hq.dhs.govHigh 7.5
An unauthorized user with network access and the decryption key could decrypt sensitive data, such as usernames and passwords.
Product
Proficy Historian
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record digitalsupport.ge.com cisa.gov
Nov 22, 2022Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulnerable to CWE-434 Unrestricted Upload of File with Dangerous Type, and will upload any CVE-2022-2791 · Other software · Emerson Electric · reported by ics-cert@hq.dhs.govMedium 5.9
Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulnerable to CWE-434 Unrestricted Upload of File with Dangerous Type, and will upload any file written into the PLC logic folder to the connected PLC.
Product
Proficy Machine Edition
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Aug 19, 2022Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-353 Missing Support for Integrity Check, and has no authentication or autCVE-2022-2793 · Other software · Emerson Electric · reported by ics-cert@hq.dhs.govMedium 5.9
Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-353 Missing Support for Integrity Check, and has no authentication or authorization of data packets after establishing a connection for the SRTP protocol.
Product
Proficy Machine Edition
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Aug 19, 2022Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-284 Improper Access Control, and stores project data in a directory with CVE-2022-2792 · Other software · Emerson Electric · reported by ics-cert@hq.dhs.govMedium 6.6
Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-284 Improper Access Control, and stores project data in a directory with improper access control lists.
Product
Proficy Machine Edition
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Aug 19, 2022Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-347 Improper Verification of Cryptographic Signature, and does not properCVE-2022-2790 · Other software · Emerson Electric · reported by ics-cert@hq.dhs.govMedium 5.9
Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-347 Improper Verification of Cryptographic Signature, and does not properly verify compiled logic (PDT files) and data blocks data (BLD/BLK files).
Product
Proficy Machine Edition
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Aug 19, 2022Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulnerable to CWE-345 Insufficient Verification of Data Authenticity, and can display logicCVE-2022-2789 · Other software · Emerson Electric · reported by ics-cert@hq.dhs.govMedium 4.7
Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulnerable to CWE-345 Insufficient Verification of Data Authenticity, and can display logic that is different than the compiled logic.
Product
Proficy Machine Edition
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Aug 19, 2022Emerson Electric's Proficy Machine Edition Version 9.80 and prior is vulnerable to CWE-29 Path Traversal: '\..\Filename', also known as a ZipSlip attack, througCVE-2022-2788 · Other software · Emerson Electric · reported by ics-cert@hq.dhs.govLow 3.9
Emerson Electric's Proficy Machine Edition Version 9.80 and prior is vulnerable to CWE-29 Path Traversal: '\..\Filename', also known as a ZipSlip attack, through an upload procedure which enables attackers to implant a malicious .BLZ file on the PLC. The file can transfer through the engineering station onto Windows in a way that executes the malicious code.
Product
Proficy Machine Edition
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Feb 25, 2022Exploitation of this vulnerability may result in local privilege escalation and code execution.CVE-2022-23921 · Other software · General Electric · reported by ics-cert@hq.dhs.govHigh 7.5
Exploitation of this vulnerability may result in local privilege escalation and code execution. GE maintains exploitation of this vulnerability is only possible if the attacker has login access to a machine actively running CIMPLICITY, the CIMPLICITY server is not already running a project, and the server is licensed for multiple projects.
Product
Proficy CIMPLICITY
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Feb 25, 2022The affected product is vulnerable due to cleartext transmission of credentials seen in the CIMPLICITY network, which can be easily spoofed and used to log in tCVE-2022-21798 · Other software · General Electric · reported by ics-cert@hq.dhs.govHigh 7.5
The affected product is vulnerable due to cleartext transmission of credentials seen in the CIMPLICITY network, which can be easily spoofed and used to log in to make operational changes to the system.
Product
Proficy CIMPLICITY
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov cisa.gov
Jul 30, 2021Improper Input Validation in Emerson GE Automation Proficy Machine Edition v8.0 allows an attacker to cause a denial of service and application crash via crafteCVE-2021-29298 · Other software · Emerson · reported by MITREMedium 5.3
Improper Input Validation in Emerson GE Automation Proficy Machine Edition v8.0 allows an attacker to cause a denial of service and application crash via crafted traffic from a Man-in-the-Middle (MITM) attack to the component "FrameworX.exe"in the module "fxVPStatcTcp.dll".
Product
Proficy Machine Edition
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 30, 2021Buffer Overflow in Emerson GE Automation Proficy Machine Edition v8.0 allows an attacker to cause a denial of service and application crash via crafted traffic CVE-2021-29297 · Other software · Emerson · reported by MITREMedium 5.3
Buffer Overflow in Emerson GE Automation Proficy Machine Edition v8.0 allows an attacker to cause a denial of service and application crash via crafted traffic from a Man-in-the-Middle (MITM) attack to the component "FrameworX.exe" in the module "MSVCR100.dll".
Product
Proficy Machine Edition
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 16, 2019Emerson GE Automation Proficy Machine Edition 8.0 allows an access violation and application crash via crafted traffic from a remote device, as demonstrated by CVE-2019-16353 · Other software · Geautomation · reported by MITREHigh 7.5
Emerson GE Automation Proficy Machine Edition 8.0 allows an access violation and application crash via crafted traffic from a remote device, as demonstrated by an RX7i device.
Product
Proficy
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Dec 7, 2018XXE in GE Proficy Cimplicity GDS versions 9.0 R2, 9.5, 10.0CVE-2018-15362 · Other software · GE · reported by vulnerability@kaspersky.comCritical 9.1
XXE in GE Proficy Cimplicity GDS versions 9.0 R2, 9.5, 10.0
Product
Cimplicity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com ics-cert.kaspersky.com
Oct 5, 2017A Stack-based Buffer Overflow issue was discovered in GE CIMPLICITY Versions 9.0 and prior.CVE-2017-12732 · Other software · GE · reported by ics-cert@hq.dhs.govMedium 6.8
A Stack-based Buffer Overflow issue was discovered in GE CIMPLICITY Versions 9.0 and prior. A function reads a packet to indicate the next packet length. The next packet length is not verified, allowing a buffer overwrite that could lead to an arbitrary remote code execution.
Product
Intelligent Platforms Proficy Hmi/scada Cimplicity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com ics-cert.us-cert.gov
Feb 13, 2017An issue was discovered in General Electric (GE) Proficy HMI/SCADA iFIX Version 5.8 SIM 13 and prior versions, Proficy HMI/SCADA CIMPLICITY Version 9.0 and prioCVE-2016-9360 · Other software · GE · reported by ics-cert@hq.dhs.govMedium 6.7
An issue was discovered in General Electric (GE) Proficy HMI/SCADA iFIX Version 5.8 SIM 13 and prior versions, Proficy HMI/SCADA CIMPLICITY Version 9.0 and prior versions, and Proficy Historian Version 6.0 and prior versions. An attacker may be able to retrieve user passwords if he or she has access to an authenticated session.
Product
Cimplicity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Jul 15, 2016General Electric (GE) Digital Proficy HMI/SCADA - CIMPLICITY before 8.2 SIM 27 mishandles service DACLs, which allows local users to modify a service configuratCVE-2016-5787 · Other software · GE · reported by ics-cert@hq.dhs.govMedium 6.3
General Electric (GE) Digital Proficy HMI/SCADA - CIMPLICITY before 8.2 SIM 27 mishandles service DACLs, which allows local users to modify a service configuration via unspecified vectors.
Product
Cimplicity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com ge-ip.force.com
Jan 16, 2015The (1) CimView and (2) CimEdit components in GE Proficy HMI/SCADA-CIMPLICITY 8.2 and earlier allow remote attackers to gain privileges via a crafted CIMPLICITYCVE-2014-2355 · Other software · GE · reported by ics-cert@hq.dhs.govMedium 6.6
The (1) CimView and (2) CimEdit components in GE Proficy HMI/SCADA-CIMPLICITY 8.2 and earlier allow remote attackers to gain privileges via a crafted CIMPLICITY screen (aka .CIM) file.
Product
Proficy HMI/SCADA–CIMPLICITY
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov ics-cert.us-cert.gov
Jan 25, 2014The CIMPLICITY Web-based access component, CimWebServer, does not check the location of shell files being loaded into the system.CVE-2014-0751 · Other software · GE · reported by ics-cert@hq.dhs.govMedium 6.8
The CIMPLICITY Web-based access component, CimWebServer, does not check the location of shell files being loaded into the system. By modifying the source location, an attacker could send shell code to the CimWebServer which would deploy the nefarious files as part of any SCADA project. This could allow the attacker to execute arbitrary code.
Product
Proficy HMI/SCADA - CIMPLICITY
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.ge-ip.com securityfocus.com
Jan 25, 2014Directory traversal vulnerability in gefebt.exe in the WebView CimWeb components in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY through 8.2 SIM 24, CVE-2014-0750 · Other software · GE · reported by ics-cert@hq.dhs.govHigh 7.5
Directory traversal vulnerability in gefebt.exe in the WebView CimWeb components in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY through 8.2 SIM 24, and Proficy Process Systems with CIMPLICITY, allows remote attackers to execute arbitrary code via a crafted HTTP request, aka ZDI-CAN-1622.
Product
Proficy HMI/SCADA - CIMPLICITY
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.ge-ip.com securityfocus.com
Nov 21, 2013The (1) Catapult DNP3 I/O driver before 7.2.0.60 and the (2) GE Intelligent Platforms Proficy DNP3 I/O driver before 7.20k, as used in DNPDrv.exe (aka the DNP mCVE-2013-2823 · Other software · Catapultsoftware · reported by ics-cert@hq.dhs.govMedium 4.7
The (1) Catapult DNP3 I/O driver before 7.2.0.60 and the (2) GE Intelligent Platforms Proficy DNP3 I/O driver before 7.20k, as used in DNPDrv.exe (aka the DNP master station server) in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY and iFIX, allow physically proximate attackers to cause a denial of service (infinite loop) via crafted input over a serial line.
Product
Catapult Dnp3 I/o Driver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ics-cert.us-cert.gov ics-cert.us-cert.gov
Nov 21, 2013The (1) Catapult DNP3 I/O driver before 7.2.0.60 and the (2) GE Intelligent Platforms Proficy DNP3 I/O driver before 7.20k, as used in DNPDrv.exe (aka the DNP mCVE-2013-2811 · Other software · Catapultsoftware · reported by ics-cert@hq.dhs.govHigh 7.1
The (1) Catapult DNP3 I/O driver before 7.2.0.60 and the (2) GE Intelligent Platforms Proficy DNP3 I/O driver before 7.20k, as used in DNPDrv.exe (aka the DNP master station server) in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY and iFIX, allow remote attackers to cause a denial of service (infinite loop) via a crafted DNP3 TCP packet.
Product
Catapult Dnp3 I/o Driver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ics-cert.us-cert.gov ics-cert.us-cert.gov
Jul 31, 2013Multiple buffer overflows in CimWebServer.exe in the WebView component in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY before 8.0 SIM 27, 8.1 before CVE-2013-2785 · Other software · GE · reported by ics-cert@hq.dhs.govHigh 9.3
Multiple buffer overflows in CimWebServer.exe in the WebView component in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY before 8.0 SIM 27, 8.1 before SIM 25, and 8.2 before SIM 19, and Proficy Process Systems with CIMPLICITY, allow remote attackers to execute arbitrary code via crafted data in packets to TCP port 10212, aka ZDI-CAN-1621 and ZDI-CAN-1624.
Product
Intelligent Platforms Proficy Hmi/scada Cimplicity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ics-cert.us-cert.gov support.ge-ip.com
Jan 27, 2013CimWebServer in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY 4.01 through 8.0, and Proficy Process Systems with CIMPLICITY, allows remote attackers tCVE-2013-0654 · Other software · GE · reported by ics-cert@hq.dhs.govHigh 9.3
CimWebServer in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY 4.01 through 8.0, and Proficy Process Systems with CIMPLICITY, allows remote attackers to execute arbitrary commands or cause a denial of service (daemon crash) via a crafted packet.
Product
Intelligent Platforms Proficy Hmi/scada Cimplicity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.gov us-cert.gov
Jan 27, 2013Directory traversal vulnerability in substitute.bcl in the WebView CimWeb subsystem in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY 4.01 through 8.0,CVE-2013-0653 · Other software · GE · reported by ics-cert@hq.dhs.govMedium 4.3
Directory traversal vulnerability in substitute.bcl in the WebView CimWeb subsystem in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY 4.01 through 8.0, and Proficy Process Systems with CIMPLICITY, allows remote attackers to read arbitrary files via a crafted packet.
Product
Intelligent Platforms Proficy Hmi/scada Cimplicity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.gov us-cert.gov
Jan 27, 2013GE Intelligent Platforms Proficy Real-Time Information Portal does not restrict access to methods of an unspecified Java class, which allows remote attackers toCVE-2013-0652 · Other software · GE · reported by ics-cert@hq.dhs.govMedium 5
GE Intelligent Platforms Proficy Real-Time Information Portal does not restrict access to methods of an unspecified Java class, which allows remote attackers to obtain a username listing via an RMI call.
Product
Intelligent Platforms Proficy Real-time Information Portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.gov us-cert.gov
Jan 27, 2013The Portal installation process in GE Intelligent Platforms Proficy Real-Time Information Portal stores sensitive information under the web root with insufficieCVE-2013-0651 · Other software · GE · reported by ics-cert@hq.dhs.govMedium 5
The Portal installation process in GE Intelligent Platforms Proficy Real-Time Information Portal stores sensitive information under the web root with insufficient access control, which allows remote attackers to read configuration files, and discover data-source credentials, via a direct request.
Product
Intelligent Platforms Proficy Real-time Information Portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record us-cert.gov us-cert.gov
Jan 17, 2013Integer overflow in CimWebServer.exe in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY 4.01 through 8.0, and Proficy Process Systems with CIMPLICITY, aCVE-2012-4689 · Other software · GE · reported by ics-cert@hq.dhs.govMedium 4.3
Integer overflow in CimWebServer.exe in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY 4.01 through 8.0, and Proficy Process Systems with CIMPLICITY, allows remote attackers to cause a denial of service (daemon crash) via a malformed HTTP request.
Product
Intelligent Platforms Proficy Hmi/scada Cimplicity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.ge-ip.com us-cert.gov
Nov 1, 2012rifsrvd.exe in the Remote Interface Service in GE Intelligent Platforms Proficy Real-Time Information Portal 2.6 through 3.5 SP1 allows remote attackers to causCVE-2012-3026 · Other software · GE · reported by ics-cert@hq.dhs.govHigh 10
rifsrvd.exe in the Remote Interface Service in GE Intelligent Platforms Proficy Real-Time Information Portal 2.6 through 3.5 SP1 allows remote attackers to cause a denial of service (memory corruption and service crash) or possibly execute arbitrary code via long input data, a different vulnerability than CVE-2012-3010 and CVE-2012-3021.
Product
Intelligent Platforms Proficy Real-time Information Portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.ge-ip.com support.ge-ip.com
Nov 1, 2012rifsrvd.exe in the Remote Interface Service in GE Intelligent Platforms Proficy Real-Time Information Portal 2.6 through 3.5 SP1 allows remote attackers to causCVE-2012-3021 · Other software · GE · reported by ics-cert@hq.dhs.govHigh 10
rifsrvd.exe in the Remote Interface Service in GE Intelligent Platforms Proficy Real-Time Information Portal 2.6 through 3.5 SP1 allows remote attackers to cause a denial of service (memory corruption and service crash) or possibly execute arbitrary code via long input data, a different vulnerability than CVE-2012-3010 and CVE-2012-3026.
Product
Intelligent Platforms Proficy Real-time Information Portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.ge-ip.com support.ge-ip.com
Nov 1, 2012rifsrvd.exe in the Remote Interface Service in GE Intelligent Platforms Proficy Real-Time Information Portal 2.6 through 3.5 SP1 allows remote attackers to causCVE-2012-3010 · Other software · GE · reported by ics-cert@hq.dhs.govHigh 10
rifsrvd.exe in the Remote Interface Service in GE Intelligent Platforms Proficy Real-Time Information Portal 2.6 through 3.5 SP1 allows remote attackers to cause a denial of service (memory corruption and service crash) or possibly execute arbitrary code via long input data, a different vulnerability than CVE-2012-3021 and CVE-2012-3026.
Product
Intelligent Platforms Proficy Real-time Information Portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.ge-ip.com support.ge-ip.com
Jul 4, 2012An ActiveX control in KeyHelp.ocx in KeyWorks KeyHelp Module (aka the HTML Help component), as used in GE Intelligent Platforms Proficy Historian 3.1, 3.5, 4.0,CVE-2012-2516 · Other software · GE · reported by ics-cert@hq.dhs.govHigh 9.3
An ActiveX control in KeyHelp.ocx in KeyWorks KeyHelp Module (aka the HTML Help component), as used in GE Intelligent Platforms Proficy Historian 3.1, 3.5, 4.0, and 4.5; Proficy HMI/SCADA iFIX 5.0 and 5.1; Proficy Pulse 1.0; Proficy Batch Execution 5.6; SI7 I/O Driver 7.20 through 7.42; and other products, allows remote attackers to execute arbitrary commands via crafted input, related to a "command injection vulnerability."
Product
Intelligent Platforms Proficy Batch Execution
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.ge-ip.com us-cert.gov
Mar 15, 2012Directory traversal vulnerability in rifsrvd.exe in the Remote Interface Service in GE Intelligent Platforms Proficy Real-Time Information Portal 2.6, 3.0, 3.0 CVE-2012-0232 · Other software · GE · reported by cret@cert.orgMedium 6.4
Directory traversal vulnerability in rifsrvd.exe in the Remote Interface Service in GE Intelligent Platforms Proficy Real-Time Information Portal 2.6, 3.0, 3.0 SP1, and 3.5 allows remote attackers to modify the configuration via crafted strings.
Product
Intelligent Platforms Proficy Real-time Information Portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.ge-ip.com securityfocus.com
Mar 15, 2012PRLicenseMgr.exe in the Proficy Server License Manager in GE Intelligent Platforms Proficy Plant Applications 5.0 and earlier allows remote attackers to cause aCVE-2012-0231 · Other software · GE · reported by cret@cert.orgHigh 10
PRLicenseMgr.exe in the Proficy Server License Manager in GE Intelligent Platforms Proficy Plant Applications 5.0 and earlier allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted TCP session on port 12401.
Product
Intelligent Platforms Proficy Plant Applications
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com support.ge-ip.com
Mar 15, 2012PRRDS.exe in the Proficy Remote Data Service in GE Intelligent Platforms Proficy Plant Applications 5.0 and earlier allows remote attackers to cause a denial ofCVE-2012-0230 · Other software · GE · reported by cret@cert.orgHigh 10
PRRDS.exe in the Proficy Remote Data Service in GE Intelligent Platforms Proficy Plant Applications 5.0 and earlier allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted TCP session on port 12299.
Product
Intelligent Platforms Proficy Plant Applications
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com support.ge-ip.com
Mar 15, 2012The Data Archiver service in GE Intelligent Platforms Proficy Historian 4.5 and earlier allows remote attackers to cause a denial of service (memory corruption)CVE-2012-0229 · Other software · GE · reported by cret@cert.orgHigh 10
The Data Archiver service in GE Intelligent Platforms Proficy Historian 4.5 and earlier allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted session on TCP port 14000 to (1) ihDataArchiver.exe or (2) ihDataArchiver_x64.exe.
Product
Intelligent Platforms Proficy Historian
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com support.ge-ip.com
Nov 2, 2011Cross-site scripting (XSS) vulnerability in the Web Administrator component in GE Intelligent Platforms Proficy Historian 4.x and earlier allows remote attackerCVE-2011-3320 · Other software · GE · reported by cret@cert.orgMedium 4.3
Cross-site scripting (XSS) vulnerability in the Web Administrator component in GE Intelligent Platforms Proficy Historian 4.x and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
Product
Intelligent Platforms Proficy Historian
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com us-cert.gov
Nov 2, 2011Multiple stack-based buffer overflows in GE Intelligent Platforms Proficy Applications before 4.4.1 SIM 101 and 5.x before 5.0 SIM 43 allow remote attackers to CVE-2011-1919 · Other software · GE · reported by cret@cert.orgHigh 10
Multiple stack-based buffer overflows in GE Intelligent Platforms Proficy Applications before 4.4.1 SIM 101 and 5.x before 5.0 SIM 43 allow remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via crafted TCP message traffic to (1) PRProficyMgr.exe in Proficy Server Manager, (2) PRGateway.exe in Proficy Server Gateway, (3) PRRDS.exe in Proficy Remote Data Service, or (4) PRLicenseMgr.exe in Proficy Server License Manager.
Product
Intelligent Platforms Proficy Historian
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com us-cert.gov
Nov 2, 2011Stack-based buffer overflow in the Data Archiver service in GE Intelligent Platforms Proficy Historian before 3.5 SIM 17 and 4.x before 4.0 SIM 12 allows remoteCVE-2011-1918 · Other software · GE · reported by cret@cert.orgHigh 10
Stack-based buffer overflow in the Data Archiver service in GE Intelligent Platforms Proficy Historian before 3.5 SIM 17 and 4.x before 4.0 SIM 12 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via crafted TCP message traffic.
Product
Intelligent Platforms Proficy Historian
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ics-cert.us-cert.gov securityfocus.com
Jan 28, 2008Unrestricted file upload vulnerability in GE Fanuc Proficy Real-Time Information Portal 2.6 and earlier allows remote attackers to execute arbitrary code by uplCVE-2008-0175 · Other software · GE Fanuc · reported by cret@cert.orgHigh 7.5
Unrestricted file upload vulnerability in GE Fanuc Proficy Real-Time Information Portal 2.6 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension to the main virtual directory.
Product
Proficy Real-time Information Portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com securityreason.com
Jan 28, 2008GE Fanuc Proficy Real-Time Information Portal 2.6 and earlier uses HTTP Basic Authentication, which transmits usernames and passwords in base64-encoded cleartexCVE-2008-0174 · Other software · GE · reported by cret@cert.orgCritical 9.8
GE Fanuc Proficy Real-Time Information Portal 2.6 and earlier uses HTTP Basic Authentication, which transmits usernames and passwords in base64-encoded cleartext and allows remote attackers to steal the passwords and gain privileges.
Product
Proficy Real-time Information Portal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityreason.com securitytracker.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.