CVSS: 9.0EPSS: 0%CPEs: 5EXPL: 0CVE-2022-38743
https://notcve.org/view.php?id=CVE-2022-38743
17 Oct 2022 — Rockwell Automation FactoryTalk VantagePoint versions 8.0, 8.10, 8.20, 8.30, 8.31 are vulnerable to an improper access control vulnerability. The FactoryTalk VantagePoint SQL Server account could allow a malicious user with read-only privileges to execute SQL statements in the back-end database. If successfully exploited, this could allow the attacker to execute arbitrary code and gain access to restricted data. Rockwell Automation FactoryTalk VantagePoint versiones 8.0, 8.10, 8.20, 8.30, 8.31, son suscepti... • https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1137043 • CWE-284: Improper Access Control •
CVSS: 9.0EPSS: 0%CPEs: 5EXPL: 0CVE-2022-3158
https://notcve.org/view.php?id=CVE-2022-3158
17 Oct 2022 — Rockwell Automation FactoryTalk VantagePoint versions 8.0, 8.10, 8.20, 8.30, 8.31 are vulnerable to an input validation vulnerability. The FactoryTalk VantagePoint SQL Server lacks input validation when users enter SQL statements to retrieve information from the back-end database. If successfully exploited, this could allow a user with basic user privileges to perform remote code execution on the server. Rockwell Automation FactoryTalk VantagePoint versiones 8.0, 8.10, 8.20, 8.30 y 8.31, son vulnerables a u... • https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1137043 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 4%CPEs: 1EXPL: 0CVE-2022-38742 – Rockwell Automation ThinManager Software Vulnerable to Arbitrary Code Execution and Denial-Of-Service Attack
https://notcve.org/view.php?id=CVE-2022-38742
23 Sep 2022 — Rockwell Automation ThinManager ThinServer versions 11.0.0 - 13.0.0 is vulnerable to a heap-based buffer overflow. An attacker could send a specifically crafted TFTP or HTTPS request, causing a heap-based buffer overflow that crashes the ThinServer process. If successfully exploited, this could expose the server to arbitrary remote code execution. Rockwell Automation ThinManager ThinServer versiones 11.0.0 - 13.0.0, son vulnerables a un desbordamiento del búfer en la región heap de la memoria. Un atacante p... • https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1136847 • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 8.6EPSS: 0%CPEs: 1EXPL: 0CVE-2022-2465 – ISaGRAF Workbench Deserialization of Untrusted Data CWE-502
https://notcve.org/view.php?id=CVE-2022-2465
25 Aug 2022 — Rockwell Automation ISaGRAF Workbench software versions 6.0 through 6.6.9 are affected by a Deserialization of Untrusted Data vulnerability. ISaGRAF Workbench does not limit the objects that can be deserialized. This vulnerability allows attackers to craft a malicious serialized object that, if opened by a local user in ISaGRAF Workbench, may result in remote code execution. This vulnerability requires user interaction to be successfully exploited. Rockwell Automation ISaGRAF Workbench software versiones 6.... • https://www.cisa.gov/uscert/ics/advisories/icsa-22-202-03 • CWE-502: Deserialization of Untrusted Data •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-2464 – ISaGRAF Workbench Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-22
https://notcve.org/view.php?id=CVE-2022-2464
25 Aug 2022 — Rockwell Automation ISaGRAF Workbench software versions 6.0 through 6.6.9 are affected by a Path Traversal vulnerability. Crafted malicious files can allow an attacker to traverse the file system when opened by ISaGRAF Workbench. If successfully exploited, an attacker could overwrite existing files and create additional files with the same permissions of the ISaGRAF Workbench software. User interaction is required for this exploit to be successful. Rockwell Automation ISaGRAF Workbench software versiones 6.... • https://www.cisa.gov/uscert/ics/advisories/icsa-22-202-03 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-2463 – ISaGRAF Workbench Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-22
https://notcve.org/view.php?id=CVE-2022-2463
25 Aug 2022 — Rockwell Automation ISaGRAF Workbench software versions 6.0 through 6.6.9 are affected by a Path Traversal vulnerability. A crafted malicious .7z exchange file may allow an attacker to gain the privileges of the ISaGRAF Workbench software when opened. If the software is running at the SYSTEM level, then the attacker will gain admin level privileges. User interaction is required for this exploit to be successful. Rockwell Automation ISaGRAF Workbench software versiones 6.0 hasta 6.6.9, están afectadas por un... • https://www.cisa.gov/uscert/ics/advisories/icsa-22-202-03 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 8.6EPSS: 0%CPEs: 18EXPL: 0CVE-2020-6998 – Rockwell Automation CompactLogix 5370 and ControlLogix 5570 Controllers Improper Input Validation
https://notcve.org/view.php?id=CVE-2020-6998
27 Jul 2022 — The connection establishment algorithm found in Rockwell Automation CompactLogix 5370 and ControlLogix 5570 versions 33 and prior does not sufficiently manage its control flow during execution, creating an infinite loop. This may allow an attacker to send specially crafted CIP packet requests to a controller, which may cause denial-of-service conditions in communications with other products. El algoritmo de establecimiento de conexión encontrado en Rockwell Automation CompactLogix 5370 and ControlLogix 5570... • https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1130398 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2022-2179 – ICSA-22-188-01 Rockwell Automation MicroLogix Improper Restriction of Rendered UI Layers or Frames
https://notcve.org/view.php?id=CVE-2022-2179
20 Jul 2022 — The X-Frame-Options header in Rockwell Automation MicroLogix 1100/1400 Versions 21.007 and prior is not configured in the HTTP response, which could allow clickjacking attacks. El encabezado X-Frame-Options en Rockwell Automation MicroLogix 1100/1400 Versiones 21.007 y anteriores, no está configurado en la respuesta HTTP, lo que podría permitir ataques de clickjacking • https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1135994 • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 8.6EPSS: 0%CPEs: 18EXPL: 0CVE-2022-1797 – Rockwell Automation Logix Controllers Uncontrolled Resource Consumption
https://notcve.org/view.php?id=CVE-2022-1797
31 May 2022 — A malformed Class 3 common industrial protocol message with a cached connection can cause a denial-of-service condition in Rockwell Automation Logix Controllers, resulting in a major nonrecoverable fault. If the target device becomes unavailable, a user would have to clear the fault and redownload the user project file to bring the device back online. Un mensaje de protocolo industrial común de clase 3 malformado con una conexión en caché puede causar una condición de denegación de servicio en los controlad... • https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1135559 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 10.0EPSS: 0%CPEs: 48EXPL: 0CVE-2022-1161 – ICSA-22-090-05 Rockwell Automation Logix Controllers
https://notcve.org/view.php?id=CVE-2022-1161
11 Apr 2022 — An attacker with the ability to modify a user program may change user program code on some ControlLogix, CompactLogix, and GuardLogix Control systems. Studio 5000 Logix Designer writes user-readable program code to a separate location than the executed compiled code, allowing an attacker to change one and not the other. Un atacante con la capacidad de modificar un programa de usuario puede cambiar el código del programa de usuario en algunos sistemas ControlLogix, CompactLogix y GuardLogix Control. Studio 5... • https://www.cisa.gov/uscert/ics/advisories/icsa-22-090-05 • CWE-829: Inclusion of Functionality from Untrusted Control Sphere •