CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-29862
https://notcve.org/view.php?id=CVE-2022-29862
An infinite loop in OPC UA .NET Standard Stack 1.04.368 allows a remote attackers to cause the application to hang via a crafted message. Un bucle infinito en OPC UA .NET Standard Stack versión 1.04.368, permite a un atacante remoto causar a la aplicación colgarse por medio de un mensaje diseñado • https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2022-29862.pdf https://opcfoundation.org/security • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-29866 – OPC Foundation UA .NET Standard TranslateBrowsePathsToNodeId Resource Exhaustion Denial-of-Service Vulnerability
https://notcve.org/view.php?id=CVE-2022-29866
OPC UA .NET Standard Stack 1.04.368 allows a remote attacker to exhaust the memory resources of a server via a crafted request that triggers Uncontrolled Resource Consumption. OPC UA .NET Standard Stack versión 1.04.368, permite a un atacante remoto agotar los recursos de memoria de un servidor por medio de una petición diseñada que desencadena un consumo no controlado de recursos This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of OPC Foundation UA .NET Standard. Authentication is not required to exploit this vulnerability. The specific flaw exists within the TranslateBrowsePathsToNodeId method. The issue results from the lack of proper validation of user-supplied data, which can result in a memory exhaustion condition. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. • https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2022-29866.pdf https://opcfoundation.org/security • CWE-400: Uncontrolled Resource Consumption •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-29865 – OPC Foundation UA .NET Standard Improper Input Validation Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2022-29865
OPC UA .NET Standard Stack allows a remote attacker to bypass the application authentication check via crafted fake credentials. OPC UA .NET Standard Stack permite a un atacante remoto eludir la comprobación de autenticación de la aplicación por medio de credenciales falsas diseñadas This vulnerability allows remote attackers to bypass authentication on affected installations of OPC Foundation UA .NET Standard. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of certificates. The issue results from the lack of proper validation of a user-supplied certificate. An attacker can leverage this vulnerability to bypass authentication on the system. • https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2022-29865.pdf https://opcfoundation.org/security • CWE-287: Improper Authentication •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-29864 – OPC Foundation UA .NET Standard Resource Exhaustion Denial-of-Service Vulnerability
https://notcve.org/view.php?id=CVE-2022-29864
OPC UA .NET Standard Stack 1.04.368 allows a remote attacker to cause a server to crash via a large number of messages that trigger Uncontrolled Resource Consumption. OPC UA .NET Standard Stack versión 1.04.368, permite a un atacante remoto causar el bloqueo de un servidor por medio de un gran número de mensajes que desencadenan un Consumo Descontrolado de Recursos This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of OPC Foundation UA .NET Standard. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of message chunks. By sending a large number of requests, an attacker can cause the number of sessions to grow without limit. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. • https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2022-29864.pdf https://opcfoundation.org/security • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 0CVE-2022-30551 – Prosys OPC UA SDK for Java OPC UA Messages Resource Exhaustion Denial-of-Service Vulnerability
https://notcve.org/view.php?id=CVE-2022-30551
OPC UA Legacy Java Stack 2022-04-01 allows a remote attacker to cause a server to stop processing messages by sending crafted messages that exhaust available resources. OPC UA Legacy Java Stack versión 01-04-2022, permite a un atacante remoto causar que un servidor deje de procesar mensajes mediante el envío de mensajes diseñados que agotan los recursos disponibles This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Prosys OPC UA SDK for Java. Authentication is not required to exploit this vulnerability. The specific flaw exists within handling of OPC UA messages. By sending a large number of requests, an attacker can consume all available resources on the server. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. • https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2022-30551.pdf https://github.com/OPCFoundation/UA-Java-Legacy https://opcfoundation.org • CWE-400: Uncontrolled Resource Consumption •