Vulnerabilities > Aveva > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-09-23 | CVE-2021-32999 | Improper Handling of Exceptional Conditions vulnerability in Aveva Suitelink Improper handling of exceptional conditions in SuiteLink server while processing command 0x01 | 5.0 |
| 2021-06-09 | CVE-2021-32942 | Cleartext Storage of Sensitive Information vulnerability in Aveva Intouch 2017 and Intouch 2020 The vulnerability could expose cleartext credentials from AVEVA InTouch Runtime 2020 R2 and all prior versions (WindowViewer) if an authorized, privileged user creates a diagnostic memory dump of the process and saves it to a non-protected location. | 5.5 |
| 2020-01-14 | CVE-2019-13537 | Out-of-bounds Write vulnerability in Aveva Iec870Ip Firmware 4.14.02 The IEC870IP driver for AVEVA’s Vijeo Citect and Citect SCADA and Schneider Electric’s Power SCADA Operation has a buffer overflow vulnerability that could result in a server-side crash. | 5.0 |
| 2019-04-11 | CVE-2019-6525 | Improper Privilege Management vulnerability in Aveva Wonderware System Platform 2014/2017 AVEVA Wonderware System Platform 2017 Update 2 and prior uses an ArchestrA network user account for authentication of system processes and inter-node communications. | 4.0 |
| 2018-05-14 | CVE-2017-6021 | Improper Input Validation vulnerability in multiple products In Schneider Electric ClearSCADA 2014 R1 (build 75.5210) and prior, 2014 R1.1 (build 75.5387) and prior, 2015 R1 (build 76.5648) and prior, and 2015 R2 (build 77.5882) and prior, an attacker with network access to the ClearSCADA server can send specially crafted sequences of commands and data packets to the ClearSCADA server that can cause the ClearSCADA server process and ClearSCADA communications driver processes to terminate. | 5.0 |
| 2017-09-26 | CVE-2017-9962 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Aveva Clearscada Schneider Electric's ClearSCADA versions released prior to August 2017 are susceptible to a memory allocation vulnerability, whereby malformed requests can be sent to ClearSCADA client applications to cause unexpected behavior. | 5.0 |
| 2017-04-20 | CVE-2017-5158 | Information Exposure vulnerability in Aveva Wonderware Intouch Access Anywhere 11.5.2 An Information Exposure issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior. | 5.0 |
| 2017-04-20 | CVE-2017-5156 | Cross-Site Request Forgery (CSRF) vulnerability in Aveva Wonderware Intouch Access Anywhere 11.5.2 A Cross-Site Request Forgery issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior. | 6.8 |
| 2015-03-29 | CVE-2015-0997 | Information Exposure vulnerability in multiple products Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 provide an HMI user interface that lists all valid usernames, which makes it easier for remote attackers to obtain access via a brute-force password-guessing attack. | 5.0 |
| 2014-09-18 | CVE-2014-5413 | Cryptographic Issues vulnerability in multiple products Schneider Electric StruxureWare SCADA Expert ClearSCADA 2010 R3 through 2014 R1 uses the MD5 algorithm for an X.509 certificate, which makes it easier for remote attackers to spoof servers via a cryptographic attack against this algorithm. | 5.0 |