Vulnerabilities > Aveva

DATE CVE VULNERABILITY TITLE RISK
2021-06-09 CVE-2021-32942 Cleartext Storage of Sensitive Information in Memory vulnerability in Aveva Intouch 2017 and Intouch 2020
The vulnerability could expose cleartext credentials from AVEVA InTouch Runtime 2020 R2 and all prior versions (WindowViewer) if an authorized, privileged user creates a diagnostic memory dump of the process and saves it to a non-protected location.
local
low complexity
aveva CWE-316
2.1
2020-09-24 CVE-2020-13505 SQL Injection vulnerability in Aveva Edna Enterprise Data Historian 3.0.1.2/7.5.4989.33053
Parameter psClass in ednareporting.asmx is vulnerable to unauthenticated SQL injection attacks.
network
low complexity
aveva CWE-89
7.5
2020-09-24 CVE-2020-13504 SQL Injection vulnerability in Aveva Edna Enterprise Data Historian 3.0.1.2/7.5.4989.33053
Parameter AttFilterValue in ednareporting.asmx is vulnerable to unauthenticated SQL injection attacks.
network
low complexity
aveva CWE-89
7.5
2020-09-24 CVE-2020-13501 SQL Injection vulnerability in Aveva Edna Enterprise Data Historian 3.0.1.2/7.5.4989.33053
An SQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053.
network
low complexity
aveva CWE-89
7.5
2020-09-24 CVE-2020-13500 SQL Injection vulnerability in Aveva Edna Enterprise Data Historian 3.0.1.2/7.5.4989.33053
SQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053.
network
low complexity
aveva CWE-89
7.5
2020-09-24 CVE-2020-13499 SQL Injection vulnerability in Aveva Edna Enterprise Data Historian 3.0.1.2/7.5.4989.33053
An SQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053.
network
low complexity
aveva CWE-89
7.5
2020-01-14 CVE-2019-13537 Out-Of-Bounds Write vulnerability in Aveva Iec870Ip Firmware 4.14.02
The IEC870IP driver for AVEVA’s Vijeo Citect and Citect SCADA and Schneider Electric’s Power SCADA Operation has a buffer overflow vulnerability that could result in a server-side crash.
network
low complexity
aveva CWE-787
5.0
2019-04-11 CVE-2019-6525 Improper Privilege Management vulnerability in Aveva Wonderware System Platform 2014/2017
AVEVA Wonderware System Platform 2017 Update 2 and prior uses an ArchestrA network user account for authentication of system processes and inter-node communications.
network
low complexity
aveva CWE-269
4.0
2019-02-13 CVE-2019-6545 Resource Injection vulnerability in Aveva Indusoft web Studio and Intouch Machine Edition 2014
AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 2017 Update.
network
low complexity
aveva CWE-99
critical
10.0
2019-02-13 CVE-2019-6543 Missing Authentication FOR Critical Function vulnerability in Aveva Indusoft web Studio and Intouch Machine Edition 2014
AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 2017 Update.
network
low complexity
aveva CWE-306
critical
10.0