Vulnerabilities > Aveva > Critical

DATE CVE VULNERABILITY TITLE RISK
2023-12-16 CVE-2021-42796 Unspecified vulnerability in Aveva Edge 2020/8.1
An issue was discovered in ExecuteCommand() in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior that allows unauthenticated arbitrary commands to be executed.
network
low complexity
aveva
critical
9.8
2023-03-16 CVE-2023-1256 Unspecified vulnerability in Aveva Plant Scada and Telemetry Server
The listed versions of AVEVA Plant SCADA and AVEVA Telemetry Server are vulnerable to an improper authorization exploit which could allow an unauthenticated user to remotely read data, cause denial of service, and tamper with alarm states.
network
low complexity
aveva
critical
9.8
2019-02-13 CVE-2019-6543 Missing Authentication for Critical Function vulnerability in Aveva Indusoft web Studio and Intouch Machine Edition 2014
AVEVA Software, LLC InduSoft Web Studio prior to Version 8.1 SP3 and InTouch Edge HMI (formerly InTouch Machine Edition) prior to Version 2017 Update.
network
low complexity
aveva CWE-306
critical
9.8
2018-11-02 CVE-2018-17916 Out-of-bounds Write vulnerability in Aveva products
InduSoft Web Studio versions prior to 8.1 SP2, and InTouch Edge HMI (formerly InTouch Machine Edition) versions prior to 2017 SP2.
network
low complexity
aveva CWE-787
critical
10.0
2018-11-02 CVE-2018-17914 Unspecified vulnerability in Aveva products
InduSoft Web Studio versions prior to 8.1 SP2, and InTouch Edge HMI (formerly InTouch Machine Edition) versions prior to 2017 SP2.
network
low complexity
aveva
critical
10.0
2018-07-24 CVE-2018-10628 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Aveva Intouch 2014 and Intouch 2017
AVEVA InTouch 2014 R2 SP1 and prior, InTouch 2017, InTouch 2017 Update 1, and InTouch 2017 Update 2 allow an unauthenticated user to send a specially crafted packet that could overflow the buffer on a locale not using a dot floating point separator.
network
low complexity
aveva CWE-119
critical
9.8
2018-07-19 CVE-2018-10620 Out-of-bounds Write vulnerability in Aveva Indusoft web Studio and Intouch Machine 2017
AVEVA InduSoft Web Studio v8.1 and v8.1SP1, and InTouch Machine Edition v2017 8.1 and v2017 8.1 SP1 a remote user could send a carefully crafted packet to exploit a stack-based buffer overflow vulnerability during tag, alarm, or event related actions such as read and write, with potential for code to be executed.
network
low complexity
aveva CWE-787
critical
9.8
2011-08-16 CVE-2011-3143 Resource Management Errors vulnerability in multiple products
Use-after-free vulnerability in Control Microsystems ClearSCADA 2005, 2007, and 2009 before R2.3 and R1.4, as used in SCX before 67 R4.5 and 68 R3.9, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified long strings that trigger heap memory corruption.
network
low complexity
aveva schneider-electric CWE-399
critical
10.0