CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-2895 – Measuresoft ScadaPro Server Stack-based Buffer Overflow
https://notcve.org/view.php?id=CVE-2022-2895
Measuresoft ScadaPro Server (All Versions) uses unmaintained ActiveX controls. These controls may allow two stack-based buffer overflow instances while processing a specific project file. Measuresoft ScadaPro Server (Todas las versiones) usa controles ActiveX no mantenidos. Estos controles pueden permitir dos instancias de desbordamiento de búfer en la región stack de la memoria mientras es procesado un archivo de proyecto específico This vulnerability allows remote attackers to execute arbitrary code on affected installations of Measuresoft ScadaPro Server. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ORM files. • https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-06 • CWE-121: Stack-based Buffer Overflow •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-2896 – Measuresoft ScadaPro Server Use After Free
https://notcve.org/view.php?id=CVE-2022-2896
Measuresoft ScadaPro Server (All Versions) allows use after free while processing a specific project file. Measuresoft ScadaPro Server (Todas las versiones) permite un uso de memoria previamente liberada mientras que el procesamiento de un archivo de proyecto específico This vulnerability allows remote attackers to execute arbitrary code on affected installations of Measuresoft ScadaPro Server. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ORM files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. • https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-06 • CWE-121: Stack-based Buffer Overflow CWE-416: Use After Free •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2012-1824
https://notcve.org/view.php?id=CVE-2012-1824
Untrusted search path vulnerability in Measuresoft ScadaPro Client before 4.0.0 and ScadaPro Server before 4.0.0 allows local users to gain privileges via a Trojan horse DLL in the current working directory. Vulnerabilidad de búsqueda no confiable en la ruta (path) en Measuresoft ScadaPro Client anterior a v4.0.0 permite a usuarios locales ganar privilegios mediante un troyano DLL en el directorio de trabajo actual. • http://www.measuresoft.net/downloads/Measuresoft%20SCADA%204.4.6/issue_disks/Client/DOCUMENTATION/ReleaseNotes.doc http://www.measuresoft.net/downloads/Measuresoft%20SCADA%204.4.6/issue_disks/Server/DOCUMENTATION/ReleaseNotes.doc http://www.us-cert.gov/control_systems/pdf/ICSA-12-145-01.pdf •