Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (73 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2023-1256 1 Aveva 2 Aveva Plant Scada, Telemetry Server 2025-01-16 9.8 Critical
The listed versions of AVEVA Plant SCADA and AVEVA Telemetry Server are vulnerable to an improper authorization exploit which could allow an unauthenticated user to remotely read data, cause denial of service, and tamper with alarm states.
CVE-2023-33873 1 Aveva 13 Batch Management, Communication Drivers, Edge and 10 more 2024-11-21 7.8 High
This privilege escalation vulnerability, if exploited, cloud allow a local OS-authenticated user with standard privileges to escalate to System privilege on the machine where these products are installed, resulting in complete compromise of the target machine.
CVE-2024-3467 1 Aveva 1 Pi Asset Framework Client 2024-11-21 7.8 High
There is a vulnerability in AVEVA PI Asset Framework Client that could allow malicious code to execute on the PI System Explorer environment under the privileges of an interactive user that was socially engineered to import XML supplied by an attacker.
CVE-2023-34982 1 Aveva 13 Batch Management, Communication Drivers, Edge and 10 more 2024-11-21 5.5 Medium
This external control vulnerability, if exploited, could allow a local OS-authenticated user with standard privileges to delete files with System privilege on the machine where these products are installed, resulting in denial of service.
CVE-2023-34348 1 Aveva 1 Pi Server 2024-11-21 7.5 High
AVEVA PI Server versions 2023 and 2018 SP3 P05 and prior contain a vulnerability that could allow an unauthenticated user to remotely crash the PI Message Subsystem of a PI Server, resulting in a denial-of-service condition.
CVE-2023-31274 1 Aveva 1 Pi Server 2024-11-21 5.3 Medium
AVEVA PI Server versions 2023 and 2018 SP3 P05 and prior contain a vulnerability that could allow an unauthenticated user to cause the PI Message Subsystem of a PI Server to consume available memory resulting in throttled processing of new PI Data Archive events and a partial denial-of-service condition.
CVE-2021-42797 1 Aveva 1 Edge 2024-11-21 7.5 High
Path traversal vulnerability in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior allows an unauthenticated user to steal the Windows access token of the user account configured for accessing external DB resources.
CVE-2021-42796 1 Aveva 1 Edge 2024-11-21 9.8 Critical
An issue was discovered in ExecuteCommand() in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior that allows unauthenticated arbitrary commands to be executed.
CVE-2021-42794 1 Aveva 1 Edge 2024-11-21 5.3 Medium
An issue was discovered in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior. The application allows a client to provide a malicious connection string that could allow an adversary to port scan the LAN, depending on the hosts' responses.
CVE-2021-32999 1 Aveva 1 Suitelink 2024-11-21 7.5 High
Improper handling of exceptional conditions in SuiteLink server while processing command 0x01
CVE-2021-32987 1 Aveva 1 Suitelink 2024-11-21 7.5 High
Null pointer dereference in SuiteLink server while processing command 0x0b
CVE-2021-32979 1 Aveva 1 Suitelink 2024-11-21 7.5 High
Null pointer dereference in SuiteLink server while processing commands 0x04/0x0a
CVE-2021-32971 1 Aveva 1 Suitelink 2024-11-21 7.5 High
Null pointer dereference in SuiteLink server while processing command 0x07
CVE-2021-32963 1 Aveva 1 Suitelink 2024-11-21 7.5 High
Null pointer dereference in SuiteLink server while processing commands 0x03/0x10
CVE-2021-32959 1 Aveva 1 Suitelink 2024-11-21 8.1 High
Heap-based buffer overflow in SuiteLink server while processing commands 0x05/0x06
CVE-2021-32942 1 Aveva 2 Intouch 2017, Intouch 2020 2024-11-21 6.6 Medium
The vulnerability could expose cleartext credentials from AVEVA InTouch Runtime 2020 R2 and all prior versions (WindowViewer) if an authorized, privileged user creates a diagnostic memory dump of the process and saves it to a non-protected location.
CVE-2020-13505 1 Aveva 1 Edna Enterprise Data Historian 2024-11-21 9.8 Critical
Parameter psClass in ednareporting.asmx is vulnerable to unauthenticated SQL injection attacks. Specially crafted SOAP web requests can cause SQL injections resulting in data compromise. An attacker can send unauthenticated HTTP requests to trigger this vulnerability.
CVE-2020-13504 1 Aveva 1 Edna Enterprise Data Historian 2024-11-21 9.8 Critical
Parameter AttFilterValue in ednareporting.asmx is vulnerable to unauthenticated SQL injection attacks. Specially crafted SOAP web requests can cause SQL injections resulting in data compromise. An attacker can send unauthenticated HTTP requests to trigger this vulnerability.
CVE-2020-13501 1 Aveva 1 Edna Enterprise Data Historian 2024-11-21 9.8 Critical
An SQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053. Specially crafted SOAP web requests can cause SQL injections resulting in data compromise. Parameter InstanceName in CHaD.asmx is vulnerable to unauthenticated SQL injection attacks.
CVE-2020-13500 1 Aveva 1 Edna Enterprise Data Historian 2024-11-21 9.8 Critical
SQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053. Specially crafted SOAP web requests can cause SQL injections resulting in data compromise. Parameter ClassName in CHaD.asmx is vulnerable to unauthenticated SQL injection attacks.