CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2019-10984 – Red Lion Crimson CD3 File Parsing Untrusted Pointer Dereference Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2019-10984
Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vulnerabilities to be exploited when a valid user opens a specially crafted, malicious input file that causes the program to mishandle pointers. Red Lion Controls Crimson, versión 3.0 y anteriores y versión 3.1 anterior a la publicación 3112.00, permite que múltiples vulnerabilidades sean explotadas cuando un usuario válido abre un archivo de entrada malicioso especialmente diseñado que causa que el programa maneje inapropiadamente los punteros. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Red Lion Crimson. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CD3 files. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. • https://www.us-cert.gov/ics/advisories/icsa-19-248-01 • CWE-465: Pointer Issues •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2019-10978 – Red Lion Crimson CD31 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2019-10978
Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vulnerabilities to be exploited when a valid user opens a specially crafted, malicious input file that operates outside of the designated memory area. Red Lion Controls Crimson, versión 3.0 y anterior y versión 3.1 anterior a la publicación 3112.00, permite que múltiples vulnerabilidades sean explotadas cuando un usuario válido abre un archivo de entrada malicioso especialmente diseñado que opera fuera del área de memoria designada. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Red Lion Crimson. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of CD31 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. • https://www.us-cert.gov/ics/advisories/icsa-19-248-01 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.8EPSS: 1%CPEs: 2EXPL: 0CVE-2019-10996 – Red Lion Crimson CD31 File Parsing Use-After-Free Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2019-10996
Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, allow multiple vulnerabilities to be exploited when a valid user opens a specially crafted, malicious input file that can reference memory after it has been freed. Red Lion Controls Crimson, versión 3.0 y anterior y versión 3.1 anterior a la publicación 3112.00, permite que múltiples vulnerabilidades sean explotadas cuando un usuario válido abre un archivo de entrada malicioso especialmente diseñado que puede hacer referencia a la memoria después de que haya sido liberada. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Red Lion Crimson. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of CD31 files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. • https://www.us-cert.gov/ics/advisories/icsa-19-248-01 • CWE-416: Use After Free •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2019-10990 – Red Lion Crimson Hard-coded Cryptographic Key Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2019-10990
Red Lion Controls Crimson, version 3.0 and prior and version 3.1 prior to release 3112.00, uses a hard-coded password to encrypt protected files in transit and at rest, which may allow an attacker to access configuration files. Red Lion Controls Crimson, versión 3.0 y anterior y versión 3.1 anterior a la publicación 3112.00, utiliza una contraseña embebida para encriptar archivos protegidos en tránsito y en reposo, lo que puede permitir a un atacante acceder a los archivos de configuración. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Red Lion Crimson. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CTextStreamMemory class. The class contains hard-coded secrets in clear text. • https://www.us-cert.gov/ics/advisories/icsa-19-248-01 • CWE-321: Use of Hard-coded Cryptographic Key CWE-798: Use of Hard-coded Credentials •