Ni vulnerabilities, page 3

104 vulnerabilities

Known vulnerabilities in Ni products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 37 products.

7.8HighCVE-2017-2779national instruments · labview 2016 +1 morenational instruments labview 2016An exploitable memory corruption vulnerability exists in the RSRC segment parsing functionality of LabVIEW 2017, LabVIEW 2016, LabVIEW 2015, and LabVIEW 2014. A specially crafted Virtual Instrument (VI) file can cause an attacker controlled looping condition resulting in an arbitrary null write. An attacker controlled VI file can be used to trigger this vulnerability and can potentially result in code execution.EPSS2.17%7.8HighCVE-2017-2775national instruments · labview 2016 evaluation +1 morenational instruments labview 2016 evaluationAn exploitable memory corruption vulnerability exists in the LvVariantUnflatten functionality in 64-bit versions of LabVIEW before 2015 SP1 f7 Patch and 2016 before f2 Patch. A specially crafted VI file can cause a user controlled value to be used as a loop terminator resulting in internal heap corruption. An attacker controlled VI file can be used to trigger this vulnerability, exploitation could lead to remote code execution.EPSS2.94%7.8HighCVE-2024-1156emerson · data_record_ad +9 moreemerson data_record_adIncorrect directory permissions for the shared NI RabbitMQ service may allow a local authenticated user to read RabbitMQ configuration information and potentially enable escalation of privileges.EPSS0.35%7.8HighCVE-2024-1155emerson · data_record_ad +9 moreIncorrect permissions for shared NI SystemLink Elixir based servicesIncorrect permissions in the installation directories for shared SystemLink Elixir based services may allow an authenticated user to potentially enable escalation of privilege via local access.EPSS0.27%8.4HighCVE-2024-4080ni · labviewMemory Corruption Due to Improper Length Checks in LabVIEW tdcore.dllA memory corruption issue due to an improper length check in LabVIEW tdcore.dll may disclose information or result in arbitrary code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q1 and prior versions.EPSS0.27%8.4HighCVE-2024-4081ni · labviewMemory Corruption Due to Improper Length Check in NI LabVIEWA memory corruption issue due to an improper length check in NI LabVIEW may disclose information or result in arbitrary code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects NI LabVIEW 2024 Q1 and prior versions.EPSS0.27%7.8HighCVE-2024-4044ni · flexlogger +1 moreDeserialization of Untrusted Data Vulnerability in FlexLogger and InstrumentStudioA deserialization of untrusted data vulnerability exists in common code used by FlexLogger and InstrumentStudio that may result in remote code execution. Successful exploitation requires an attacker to get a user to open a specially crafted project file. This vulnerability affects NI FlexLogger 2024 Q1 and prior versions as well as NI InstrumentStudio 2024 Q1 and prior versions.EPSS14.69%7.8HighCVE-2024-4079ni · labviewOut of Bounds Read Due to Missing Bounds Check in LabVIEWAn out of bounds read due to a missing bounds check in LabVIEW may disclose information or result in arbitrary code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q1 and prior versions.EPSS0.28%7.8HighCVE-2024-5602ni · io trace toolStack-based Buffer Overflow Vulnerability in NI I/O Trace ToolA stack-based buffer overflow vulnerability due to a missing bounds check in the NI I/O Trace Tool may result in arbitrary code execution. Successful exploitation requires an attacker to provide a user with a specially crafted nitrace file. The NI I/O Trace tool is installed as part of the NI System Configuration utilities included with many NI software products.  Refer to the NI Security Advisory for identifying the version of NI IO Trace.exe installed. The NI I/O Trace tool was also previously released as NI Spy.EPSS0.31%8.4HighCVE-2024-10496ni · labviewOut of bounds read in BuildFontMap in fontmgr.cpp in NI LabVIEWAn out of bounds read due to improper input validation in BuildFontMap in fontmgr.cpp in NI LabVIEW may disclose information or result in arbitrary code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q3 and prior versions.EPSS0.19%8.4HighCVE-2024-10495ni · labviewOut of bounds read when loading the font table in fontmgr.cpp in NI LabVIEWAn out of bounds read due to improper input validation when loading the font table in fontmgr.cpp in NI LabVIEW may disclose information or result in arbitrary code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q3 and prior versions.EPSS0.19%8.4HighCVE-2024-10494ni · labviewOut of bounds read in HeapObjMapImpl.cpp in NI LabVIEWAn out of bounds read due to improper input validation in HeapObjMapImpl.cpp in NI LabVIEW may disclose information or result in arbitrary code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q3 and prior versions.EPSS0.19%9.8CriticalCVE-2024-6794ni · veristandDeserialization of Untrusted Data in NI VeriStand Waveform Streaming ServerA deserialization of untrusted data vulnerability exists in NI VeriStand Waveform Streaming Server that may result in remote code execution. Successful exploitation requires an attacker to send a specially crafted message. These vulnerabilities affect NI VeriStand 2024 Q2 and prior versions.EPSS1.15%9.8CriticalCVE-2024-6806ni · veristandMissing Authorization Checks In NI VeriStand Gateway For Project ResourcesThe NI VeriStand Gateway is missing authorization checks when an actor attempts to access Project resources. These missing checks may result in remote code execution. This affects NI VeriStand 2024 Q2 and prior versions.EPSS1.02%5.5MediumCVE-2024-6122ni · flexlogger +2 moreIncorrect Default Directory Permissions for NI SystemLink Redis ServiceAn incorrect permission in the installation directory for the shared NI SystemLink Server KeyValueDatabase service may result in information disclosure via local access. This affects NI SystemLink Server 2024 Q1 and prior versions. It also affects NI FlexLogger 2023 Q2 and prior versions which installed this shared service.EPSS0.24%7.8HighCVE-2024-6791ni · veristandDirectory Path Traversal Vulnerability in NI VeriStand with vsmodel FilesA directory path traversal vulnerability exists when loading a vsmodel file in NI VeriStand that may result in remote code execution. Successful exploitation requires an attacker to get a user to open a specially crafted .vsmodel file. This vulnerability affects VeriStand 2024 Q2 and prior versions.EPSS0.46%7.8HighCVE-2024-6675ni · veristandDeserialization of Untrusted Data Vulnerability in NI VeriStand Project FileA deserialization of untrusted data vulnerability exists in NI VeriStand that may result in remote code execution. Successful exploitation requires an attacker to get a user to open a specially crafted project file. This vulnerability affects VeriStand 2024 Q2 and prior versions.EPSS0.40%5.5MediumCVE-2024-6638ni · labviewInteger Overflow Vulnerability Reading TDMS Files in LabVIEWAn integer overflow vulnerability due to improper input validation when reading TDMS files in LabVIEW may result in an infinite loop. Successful exploitation requires an attacker to provide a user with a specially crafted TDMS file. This vulnerability affects LabVIEW 2024 Q1 and prior versions.EPSS0.16%7.8HighCVE-2024-6121ni · flexlogger +2 moreNI SystemLink Server Ships Out of Date Redis VersionAn out-of-date version of Redis shipped with NI SystemLink Server is susceptible to multiple vulnerabilities, including CVE-2022-24834. This affects NI SystemLink Server 2024 Q1 and prior versions. It also affects NI FlexLogger 2023 Q2 and prior versions which installed this shared service.EPSS0.27%9.8CriticalCVE-2024-6793ni · veristandDeserialization of Untrusted Data in NI VeriStand DataLogging ServerA deserialization of untrusted data vulnerability exists in NI VeriStand DataLogging Server that may result in remote code execution. Successful exploitation requires an attacker to send a specially crafted message. These vulnerabilities affect NI VeriStand 2024 Q2 and prior versions.EPSS1.19%