CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2012-0225
https://notcve.org/view.php?id=CVE-2012-0225
Cross-site scripting (XSS) vulnerability in Invensys Wonderware Information Server 4.0 SP1 and 4.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en Invensys Wonderware Information Server v4.0 SP1 y v4.5, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de parámetros no determinados. • http://osvdb.org/80888 http://secunia.com/advisories/48603 http://www.securityfocus.com/bid/52851 http://www.securitytracker.com/id?1026886 http://www.securitytracker.com/id?1026887 http://www.us-cert.gov/control_systems/pdf/ICSA-12-062-01.pdf https://exchange.xforce.ibmcloud.com/vulnerabilities/74549 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 1%CPEs: 2EXPL: 0CVE-2012-0228
https://notcve.org/view.php?id=CVE-2012-0228
Invensys Wonderware Information Server 4.0 SP1 and 4.5 does not properly implement client controls, which allows remote attackers to bypass intended access restrictions via unspecified vectors. Invensys Wonderware Information Server v4.0 SP1 y v4.5 no implementan de forma adecuada los controles, lo que permite a atacantes remotos evitar las restricciones de acceso impuestas a través de vectores no determinados. • http://osvdb.org/80890 http://secunia.com/advisories/48603 http://www.securityfocus.com/bid/52851 http://www.securitytracker.com/id?1026886 http://www.securitytracker.com/id?1026887 http://www.us-cert.gov/control_systems/pdf/ICSA-12-062-01.pdf • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2012-0226
https://notcve.org/view.php?id=CVE-2012-0226
SQL injection vulnerability in Invensys Wonderware Information Server 4.0 SP1 and 4.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Vulnerabilidad de inyección SQL en Invensys Wonderware Information Server v4.0 SP1 y v4.5, permite a atacantes remotos ejecutar comandos SQL de su elección a través de vectores no determinados. • http://osvdb.org/80889 http://secunia.com/advisories/48603 http://www.securityfocus.com/bid/52851 http://www.securitytracker.com/id?1026886 http://www.securitytracker.com/id?1026887 http://www.us-cert.gov/control_systems/pdf/ICSA-12-062-01.pdf https://exchange.xforce.ibmcloud.com/vulnerabilities/74550 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.8EPSS: 4%CPEs: 12EXPL: 0CVE-2012-0257
https://notcve.org/view.php?id=CVE-2012-0257
Heap-based buffer overflow in the WWCabFile ActiveX component in the Wonderware System Platform in Invensys Wonderware Application Server 2012 and earlier, Foxboro Control Software 3.1 and earlier, InFusion CE/FE/SCADA 2.5 and earlier, Wonderware Information Server 4.5 and earlier, ArchestrA Application Object Toolkit 3.2 and earlier, and InTouch 10.0 through 10.5 might allow remote attackers to execute arbitrary code via a long string to the Open member, leading to a function-pointer overwrite. Desbordamiento de búfer basado en memoria dinámica en el componente ActiveX WWCabFile en Wonderware System Platform en Invensys Wonderware Application Server 2012 y anteriores, Foxboro Control Software v3.1 y anteriores, InFusion CE/FE/SCADA v2.5 y anteriores, Wonderware Information Server v4.5 y anteriores, ArchestrA Application Object Toolkit v3.2 y anteriores, y InTouch v10.0 hasta v10.5 ,permite a atacantes remotos ejecutar código arbitrario a través de una cadena larga sobre el miembro Open, provocando una sobrescritura de un puntero a función. • http://osvdb.org/80891 http://secunia.com/advisories/48675 http://www.us-cert.gov/control_systems/pdf/ICSA-12-081-01.pdf https://wdnresource.wonderware.com/support/docs/_SecurityBulletins/Security_Bulletin_LFSEC00000071.pdf • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.8EPSS: 4%CPEs: 12EXPL: 0CVE-2012-0258
https://notcve.org/view.php?id=CVE-2012-0258
Heap-based buffer overflow in the WWCabFile ActiveX component in the Wonderware System Platform in Invensys Wonderware Application Server 2012 and earlier, Foxboro Control Software 3.1 and earlier, InFusion CE/FE/SCADA 2.5 and earlier, Wonderware Information Server 4.5 and earlier, ArchestrA Application Object Toolkit 3.2 and earlier, and InTouch 10.0 through 10.5 might allow remote attackers to execute arbitrary code via a long string to the AddFile member. Desbordamiento de búfer basado en memoria dinámica en el componente ActiveX WWCabFile en Wonderware System Platform en Invensys Wonderware Application Server 2012 y anteriores, Foxboro Control Software v3.1 y anteriores, InFusion CE/FE/SCADA v2.5 y anteriores, Wonderware Information Server v4.5 y anteriores, ArchestrA Application Object Toolkit v3.2 y anteriores, y InTouch v10.0 hasta v10.5 ,permite a atacantes remotos ejecutar código arbitrario a través de una cadena larga sobre el miembro Addfile. • http://osvdb.org/80891 http://secunia.com/advisories/48675 http://www.us-cert.gov/control_systems/pdf/ICSA-12-081-01.pdf https://wdnresource.wonderware.com/support/docs/_SecurityBulletins/Security_Bulletin_LFSEC00000071.pdf • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •