CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-21219
https://notcve.org/view.php?id=CVE-2022-21219
Out-of-bounds read vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file. Una vulnerabilidad de lectura fuera de límites en CX-Programmer versiones v9.76.1 y anteriores, que forma parte de la suite CX-One (v4.60), permite a un atacante causar una divulgación de información y/o la ejecución de código arbitrario al hacer que un usuario abra un archivo CXP especialmente diseñado • https://jvn.jp/en/vu/JVNVU90121984/index.html • CWE-125: Out-of-bounds Read •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-21124
https://notcve.org/view.php?id=CVE-2022-21124
Out-of-bounds write vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file. This vulnerability is different from CVE-2022-25234. Una vulnerabilidad de escritura fuera de límites en CX-Programmer versiones v9.76.1 y anteriores, que forma parte de la suite CX-One (v4.60), permite a un atacante causar una divulgación de información y/o la ejecución de código arbitrario al hacer que un usuario abra un archivo CXP especialmente diseñado. Esta vulnerabilidad es diferente de CVE-2022-25234 • http://www.openwall.com/lists/oss-security/2022/06/14/4 http://www.openwall.com/lists/oss-security/2022/06/16/1 http://xenbits.xen.org/xsa/advisory-404.html https://jvn.jp/en/vu/JVNVU90121984/index.html • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 8%CPEs: 1EXPL: 0CVE-2022-21137 – Omron CX-One
https://notcve.org/view.php?id=CVE-2022-21137
Omron CX-One Versions 4.60 and prior are vulnerable to a stack-based buffer overflow while processing specific project files, which may allow an attacker to execute arbitrary code. Omron CX-One versiones 4.60 y anteriores, son vulnerables a un desbordamiento del búfer en la región stack de la memoria mientras son procesados archivos de proyectos específicos, lo que puede permitir a un atacante ejecutar código arbitrario This vulnerability allows remote attackers to execute arbitrary code on affected installations of Omron CX-One. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FLN files in the CX-FLnet module. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. • https://www.cisa.gov/uscert/ics/advisories/icsa-22-006-01 https://www.zerodayinitiative.com/advisories/ZDI-22-373 https://www.zerodayinitiative.com/advisories/ZDI-22-374 • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-20836
https://notcve.org/view.php?id=CVE-2021-20836
Out-of-bounds read vulnerability in CX-Supervisor v4.0.0.13 and v4.0.0.16 allows an attacker with administrative privileges to cause information disclosure and/or arbitrary code execution by opening a specially crafted SCS project files. Una vulnerabilidad de lectura fuera de límites en CX-Supervisor versiones v4.0.0.13 y v4.0.0.16, permite a un atacante con privilegios administrativos causar una divulgación de información y/o la ejecución de código arbitrario al abrir un archivo de proyecto SCS especialmente diseñado • https://jvn.jp/en/vu/JVNVU90041391/index.html https://www.myomron.com/index.php?action=kb&article=1692 • CWE-125: Out-of-bounds Read •
CVSS: 7.8EPSS: 18%CPEs: 2EXPL: 0CVE-2021-27413 – Omron CX-One CX-Position NCI File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2021-27413
Omron CX-One Versions 4.60 and prior, including CX-Server Versions 5.0.29.0 and prior, are vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code. Las versiones 4.60 y anteriores de Omron CX-One, incluidas las versiones 5.0.29.0 y anteriores de CX-Server, son vulnerables a un desbordamiento del búfer basado en la pila, que puede permitir a un atacante ejecutar código arbitrario This vulnerability allows remote attackers to execute arbitrary code on affected installations of Omron CX-One. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of NCI files in the CX-Position application. When parsing the B_PLC_NAME element, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. • https://us-cert.cisa.gov/ics/advisories/icsa-21-131-01 https://www.zerodayinitiative.com/advisories/ZDI-21-588 • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •