CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2022-2898 – Measuresoft ScadaPro Server and Client Link Following
https://notcve.org/view.php?id=CVE-2022-2898
Measuresoft ScadaPro Server and Client (All Versions) do not properly resolve links before file access; this could allow a denial-of-service condition. Measuresoft ScadaPro Server y Client (Todas las versiones) no resuelven apropiadamente los enlaces antes de acceder a los archivos; esto podría permitir una condición de denegación de servicio This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Measuresoft ScadaPro Client. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the ScadaPro Client installer. By creating a symbolic link, an attacker can abuse the installer to create a file. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. • https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-06 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-2895 – Measuresoft ScadaPro Server Stack-based Buffer Overflow
https://notcve.org/view.php?id=CVE-2022-2895
Measuresoft ScadaPro Server (All Versions) uses unmaintained ActiveX controls. These controls may allow two stack-based buffer overflow instances while processing a specific project file. Measuresoft ScadaPro Server (Todas las versiones) usa controles ActiveX no mantenidos. Estos controles pueden permitir dos instancias de desbordamiento de búfer en la región stack de la memoria mientras es procesado un archivo de proyecto específico This vulnerability allows remote attackers to execute arbitrary code on affected installations of Measuresoft ScadaPro Server. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ORM files. • https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-06 • CWE-121: Stack-based Buffer Overflow •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-2896 – Measuresoft ScadaPro Server Use After Free
https://notcve.org/view.php?id=CVE-2022-2896
Measuresoft ScadaPro Server (All Versions) allows use after free while processing a specific project file. Measuresoft ScadaPro Server (Todas las versiones) permite un uso de memoria previamente liberada mientras que el procesamiento de un archivo de proyecto específico This vulnerability allows remote attackers to execute arbitrary code on affected installations of Measuresoft ScadaPro Server. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ORM files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. • https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-06 • CWE-121: Stack-based Buffer Overflow CWE-416: Use After Free •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2012-1824
https://notcve.org/view.php?id=CVE-2012-1824
Untrusted search path vulnerability in Measuresoft ScadaPro Client before 4.0.0 and ScadaPro Server before 4.0.0 allows local users to gain privileges via a Trojan horse DLL in the current working directory. Vulnerabilidad de búsqueda no confiable en la ruta (path) en Measuresoft ScadaPro Client anterior a v4.0.0 permite a usuarios locales ganar privilegios mediante un troyano DLL en el directorio de trabajo actual. • http://www.measuresoft.net/downloads/Measuresoft%20SCADA%204.4.6/issue_disks/Client/DOCUMENTATION/ReleaseNotes.doc http://www.measuresoft.net/downloads/Measuresoft%20SCADA%204.4.6/issue_disks/Server/DOCUMENTATION/ReleaseNotes.doc http://www.us-cert.gov/control_systems/pdf/ICSA-12-145-01.pdf •
CVSS: 10.0EPSS: 22%CPEs: 45EXPL: 2CVE-2011-3497 – Measuresoft ScadaPro 4.0.0 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2011-3497
service.exe in Measuresoft ScadaPro 4.0.0 and earlier allows remote attackers to execute arbitrary DLL functions via the XF function, possibly related to an insecure exposed method. service.exe de Measuresoft ScadaPro 4.0.0 y versiones anteriores permite a atacantes remotos ejecutar funciones DLL arbitrarias a través de una función XF, posiblemente relacionado con una método inseguro expuesto. • https://www.exploit-db.com/exploits/17844 http://aluigi.altervista.org/adv/scadapro_1-adv.txt http://securityreason.com/securityalert/8382 http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-11-256-04.pdf • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •