Vulnerabilities > Invensys > Critical
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2013-05-09 | CVE-2013-0686 | Improper Input Validation vulnerability in Invensys Wonderware Information Server 4.0/4.5/5.0 Invensys Wonderware Information Server (WIS) 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. | 9.3 |
| 2013-05-09 | CVE-2013-0685 | Permissions, Privileges, and Access Controls vulnerability in Invensys Wonderware Information Server 4.0/4.5/5.0 Invensys Wonderware Information Server (WIS) 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal does not restrict unspecified size and amount values, which allows remote attackers to execute arbitrary code or cause a denial of service (resource consumption) via unknown vectors. | 9.3 |
| 2013-04-04 | CVE-2012-4710 | Improper Input Validation vulnerability in Invensys Wonderware Win-Xml Exporter 1522.148.0.0 Invensys Wonderware Win-XML Exporter 1522.148.0.0 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML external entity declaration in conjunction with an entity reference. | 9.3 |
| 2012-02-10 | CVE-2011-4039 | Permissions, Privileges, and Access Controls vulnerability in multiple products Invensys Wonderware HMI Reports 3.42.835.0304 and earlier, as used in Ocean Data Systems Dream Report before 4.0 and other products, allows user-assisted remote attackers to execute arbitrary code via a malformed file that triggers a "write access violation." | 9.3 |
| 2011-08-16 | CVE-2011-3141 | Buffer Errors vulnerability in Invensys Wonderware Inbatch 8.1/9.0 Buffer overflow in the InBatch BatchField ActiveX control for Invensys Wonderware InBatch 8.1 SP1, 9.0, and 9.0 SP1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors. | 9.3 |
| 2011-07-29 | CVE-2011-2962 | Buffer Errors vulnerability in Invensys Wonderware Information Server 3.1/4.0 Multiple stack-based buffer overflows in Invensys Wonderware Information Server 3.1, 4.0, and 4.0 SP1 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via two unspecified ActiveX controls. | 9.3 |
| 2010-12-17 | CVE-2010-4557 | Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Invensys Foxboro I/A Series Batch and Wonderware Inbatch Buffer overflow in the lm_tcp service in Invensys Wonderware InBatch 8.1 and 9.0, as used in Invensys Foxboro I/A Series Batch 8.1 and possibly other products, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted request to port 9001. | 10.0 |
| 2010-08-05 | CVE-2010-2974 | Buffer Errors vulnerability in Invensys products Stack-based buffer overflow in the IConfigurationAccess interface in the Invensys Wonderware Archestra ConfigurationAccessComponent ActiveX control in Wonderware Application Server (WAS) before 3.1 SP2 P01, as used in the Wonderware Archestra Integrated Development Environment (IDE) and the InFusion Integrated Engineering Environment (IEE), allows remote attackers to execute arbitrary code via the first argument to the UnsubscribeData method. | 9.3 |