CveMateVulnerability intelligence

Aveva vulnerabilities

91 vulnerabilities

Known vulnerabilities in Aveva products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 68 products.

Products

50 of 68

Edge14 vulnerabilities
Aveva Edge11 vulnerabilities
Clearscada9 vulnerabilities
System Platform9 vulnerabilities
Process Optimization7 vulnerabilities
Aveva System Platform6 vulnerabilities
Suitelink6 vulnerabilities
Edna Enterprise Data Historian5 vulnerabilities
Indusoft Web Studio5 vulnerabilities
Application Server4 vulnerabilities
Batch Management4 vulnerabilities
Intouch4 vulnerabilities
Intouch Machine Edition 20144 vulnerabilities
Pi Server4 vulnerabilities
Pipeline Integrity Monitor4 vulnerabilities
Communication Drivers Pack3 vulnerabilities
Historian3 vulnerabilities
Manufacturing Execution System3 vulnerabilities
Mobile Operator3 vulnerabilities
Telemetry Server3 vulnerabilities
Wonderware Intouch Access Anywhere3 vulnerabilities
Work Tasks3 vulnerabilities
Communication Drivers2 vulnerabilities
Edge (Formerly Known As Indusoft Web Studio)2 vulnerabilities
Enterprise Licensing2 vulnerabilities
Enterprise Licensing (Formerly Known As License Manager)2 vulnerabilities
Intouch 20172 vulnerabilities
Manufacturing Execution System (Formerly Known As Wonderware MES)2 vulnerabilities
Mobile Operator (Formerly Known As Intelatrac Mobile Operator Rounds)2 vulnerabilities
PI Connector For Cygnet2 vulnerabilities
PI Data Archive2 vulnerabilities
PI Integrator2 vulnerabilities
PI Web API2 vulnerabilities
Plant Scada2 vulnerabilities
Plant Scada (Formerly Known As Citect)2 vulnerabilities
Platform Common Services2 vulnerabilities
Recipe Management2 vulnerabilities
Systemplatform2 vulnerabilities
Worktasks (Formerly Known As Workflow Management)2 vulnerabilities
Aveva Enterprise Scada1 vulnerabilities
Aveva Enterprise Scada HMI1 vulnerabilities
Aveva Intouch Access Anywhere1 vulnerabilities
Aveva Plant Scada1 vulnerabilities
Aveva Plant Scada Access Anywhere1 vulnerabilities
Aveva Telemetry Server1 vulnerabilities
Aveva Vijeo Citect And Citectscada1 vulnerabilities
Enterprise Data Management1 vulnerabilities
Historian Web Server1 vulnerabilities
Iec870Ip1 vulnerabilities
Intouch 20141 vulnerabilities

CVE-2018-17914avevaedge+37y ago02-11-2018 13:00

InduSoft Web Studio versions prior to 8.1 SP2, and InTouch Edge HMI (formerly InTouch Machine Edition) versions prior to 2017 SP2. This vulnerability could allow an unauthenticated user to remotely execute code with the same privileges as that of the InduSoft Web Studio or InTouch Edge HMI (formerly InTouch Machine Edition) runtime.CVE-2018-17916avevaedge+37y ago02-11-2018 13:00

InduSoft Web Studio versions prior to 8.1 SP2, and InTouch Edge HMI (formerly InTouch Machine Edition) versions prior to 2017 SP2. A remote attacker could send a carefully crafted packet to exploit a stack-based buffer overflow vulnerability during tag, alarm, or event related actions such as read and write, with potential for code to be executed. If InduSoft Web Studio remote communication security was not enabled, or a password was left blank, a remote user could send a carefully crafted packet to invoke an arbitrary process, with potential for code to be executed. The code would be executed under the privileges of the InduSoft Web Studio or InTouch Edge HMI runtime and could lead to a compromise of the InduSoft Web Studio or InTouch Edge HMI server machine.CVE-2018-10620aveva software, llcindusoft web studio+38y ago19-07-2018 19:00

AVEVA InduSoft Web Studio v8.1 and v8.1SP1, and InTouch Machine Edition v2017 8.1 and v2017 8.1 SP1 a remote user could send a carefully crafted packet to exploit a stack-based buffer overflow vulnerability during tag, alarm, or event related actions such as read and write, with potential for code to be executed.CVE-2018-10628aveva software, llc.intouch+28y ago24-07-2018 18:00

AVEVA InTouch 2014 R2 SP1 and prior, InTouch 2017, InTouch 2017 Update 1, and InTouch 2017 Update 2 allow an unauthenticated user to send a specially crafted packet that could overflow the buffer on a locale not using a dot floating point separator. Exploitation could allow remote code execution under the privileges of the InTouch View process.CVE-2013-6142avevaclearscada12y ago15-01-2014 15:00

DNP3Driver.exe in the DNP3 driver in Schneider Electric ClearSCADA 2010 R2 through 2010 R3.1 and SCADA Expert ClearSCADA 2013 R1 through 2013 R1.2 allows remote attackers to cause a denial of service (resource consumption) via IP packets containing errors that trigger event-journal messages.CVE-2021-42794avevaedge2y ago16-12-2023 00:00

An issue was discovered in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior. The application allows a client to provide a malicious connection string that could allow an adversary to port scan the LAN, depending on the hosts' responses.CVE-2021-42796avevaedge2y ago16-12-2023 00:00

An issue was discovered in ExecuteCommand() in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior that allows unauthenticated arbitrary commands to be executed.CVE-2021-42797avevaedge2y ago16-12-2023 00:00

Path traversal vulnerability in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior allows an unauthenticated user to steal the Windows access token of the user account configured for accessing external DB resources.CVE-2021-38410avevabatch_management+74y ago27-07-2022 20:23

AVEVA Software Platform Common Services (PCS) Portal versions 4.5.2, 4.5.1, 4.5.0, and 4.4.6 are vulnerable to DLL hijacking through an uncontrolled search path element, which may allow an attacker control to one or more locations in the search path.CVE-2021-32987aveva software, llcaveva batch management 2020+65y ago23-09-2021 13:33

Null pointer dereference in SuiteLink server while processing command 0x0b CVE-2021-32981avevaaveva system platform+14y ago04-04-2022 19:45

AVEVA System Platform versions 2017 through 2020 R2 P01 uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.CVE-2021-32971aveva software, llcaveva batch management 2020+65y ago23-09-2021 13:32

Null pointer dereference in SuiteLink server while processing command 0x07 CVE-2021-32985avevaaveva system platform+14y ago04-04-2022 19:45

AVEVA System Platform versions 2017 through 2020 R2 P01 does not properly verify that the source of data or communication is valid.CVE-2021-32959aveva software, llcaveva batch management 2020+65y ago23-09-2021 13:32

Heap-based buffer overflow in SuiteLink server while processing commands 0x05/0x06 CVE-2021-32979aveva software, llcaveva batch management 2020+65y ago23-09-2021 13:32

Null pointer dereference in SuiteLink server while processing commands 0x04/0x0a CVE-2021-32942avevaintouch+25y ago09-06-2021 16:06

The vulnerability could expose cleartext credentials from AVEVA InTouch Runtime 2020 R2 and all prior versions (WindowViewer) if an authorized, privileged user creates a diagnostic memory dump of the process and saves it to a non-protected location.CVE-2021-32999aveva software, llcaveva batch management 2020+65y ago23-09-2021 13:33

Improper handling of exceptional conditions in SuiteLink server while processing command 0x01 CVE-2021-32963aveva software, llcaveva batch management 2020+65y ago23-09-2021 13:32

Null pointer dereference in SuiteLink server while processing commands 0x03/0x10 CVE-2021-32977avevaaveva system platform+14y ago04-04-2022 19:45

AVEVA System Platform versions 2017 through 2020 R2 P01 does not verify, or incorrectly verifies, the cryptographic signature for data.CVE-2021-33010avevaaveva system platform+14y ago04-04-2022 19:45

An exception is thrown from a function in AVEVA System Platform versions 2017 through 2020 R2 P01, but it is not caught, which may cause a denial-of-service condition.