CVSS: 6.9EPSS: 0%CPEs: 1EXPL: 0CVE-2012-4709
https://notcve.org/view.php?id=CVE-2012-4709
Invensys Wonderware InTouch HMI 2012 R2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. Invensys Wonderware InTouch HMI 2012 R2 y anteriores permite a atacantes remotos leer archivos de forma arbitraria, enviar peticiones HTTP a servidores de intranet o causar una denegación de servicio (consumo de memoria y CPU) a través de un documento XML que contienen declaraciones de entidad externas en conjunto con una referencia a entidad, relacionado con el problema XML External Entity (XXE) • http://ics-cert.us-cert.gov/advisories/ICSA-13-276-01 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2013-0684
https://notcve.org/view.php?id=CVE-2013-0684
SQL injection vulnerability in Invensys Wonderware Information Server (WIS) 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Vulnerabilidad de inyección SQL en Invensys Wonderware Information Server (WIS) v4.0 SP1SP2, v4.5- Portal, y v5.0- Portal que permite a atacantes remotos ejecutar código arbitrario SQL a través de vectores sin especificar. • http://ics-cert.us-cert.gov/advisories/ICSA-13-113-01 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.3EPSS: 0%CPEs: 3EXPL: 0CVE-2013-0686
https://notcve.org/view.php?id=CVE-2013-0686
Invensys Wonderware Information Server (WIS) 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. Invensys Wonderware Information Server (WIS) V4.0 SP1SP1, v4.5- Portal, y v5.0- Portal permite a atacantes remotos leer ficheros arbitrarios, enviar peticiones HTTP a servidores de la red interna o causar denegación de servicios (consumo de memoria y CPU) a través de un documento XML que contiene una entidad externa declarada junto con una referencia entidad, relacionado con un asunto XML External Entity (XEE). • http://ics-cert.us-cert.gov/advisories/ICSA-13-113-01 • CWE-20: Improper Input Validation •
CVSS: 9.3EPSS: 0%CPEs: 3EXPL: 0CVE-2013-0685
https://notcve.org/view.php?id=CVE-2013-0685
Invensys Wonderware Information Server (WIS) 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal does not restrict unspecified size and amount values, which allows remote attackers to execute arbitrary code or cause a denial of service (resource consumption) via unknown vectors. Invensys Wonderware Information Server (WIS) 4.0 SP1SP1, 4.5- Portal, y 5.0- Portal no restringe los valores tamaño sin especificar y cantidad de valores, lo que permite a atacantes remotos causar una denegación de servicios (consumo de recursos) a través de vectores desconocidos- • http://ics-cert.us-cert.gov/advisories/ICSA-13-113-01 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2013-0688
https://notcve.org/view.php?id=CVE-2013-0688
Cross-site scripting (XSS) vulnerability in Invensys Wonderware Information Server (WIS) 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en Invensys Wonderware Information Server (WIS) v4.0 SP1SP1, v4.5- Portal, y v5.0- Portal que permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores no especificados. • http://ics-cert.us-cert.gov/advisories/ICSA-13-113-01 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •