CveMateVulnerability intelligence

Ptc vulnerabilities

44 vulnerabilities

Known vulnerabilities in Ptc products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 30 products.

Products

30

Thingworx Industrial Connectivity13 vulnerabilities
Thingworx Kepware Server13 vulnerabilities
Kepware Kepserverex12 vulnerabilities
Axeda Agent7 vulnerabilities
Axeda Desktop Server7 vulnerabilities
Axeda Desktop Server For Windows7 vulnerabilities
Opc Aggregator7 vulnerabilities
Thingworx Kepware Edge6 vulnerabilities
Vuforia Studio6 vulnerabilities
Flexplm4 vulnerabilities
Thingworx Platform4 vulnerabilities
Windchill Pdmlink4 vulnerabilities
Kepserverex3 vulnerabilities
Codebeamer2 vulnerabilities
Keepserverex2 vulnerabilities
Kepware Server2 vulnerabilities
Kepware Serverex2 vulnerabilities
Thingworx Edge C Sdk2 vulnerabilities
Thingworx Edge Microserver2 vulnerabilities
Thingworx Edge Microserver (Ems)2 vulnerabilities
Thingworx .Net Sdk2 vulnerabilities
Creo Elements/Direct License1 vulnerabilities
Creo View1 vulnerabilities
Isoview1 vulnerabilities
Kepware Thingworx Kepware Server1 vulnerabilities
Mathcad1 vulnerabilities
Thingworx1 vulnerabilities
Windchill Risk And Reliability Enterprise Edition (Formerly Relex)1 vulnerabilities
Windchill and FlexPLM0 vulnerabilities
Windchill PDMLink, FlexPLM0 vulnerabilities

CVE-2018-20092ptcthingworx_platform7y ago17-12-2018 18:00

PTC ThingWorx Platform through 8.3.0 is vulnerable to a directory traversal attack on ZIP files via a POST request.CVE-2018-17216ptcthingworx_platform8y ago01-10-2018 01:00

An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2. There is password hash exposure to privileged users.CVE-2018-17217ptcthingworx_platform8y ago01-10-2018 01:00

An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2. There is a hardcoded encryption key.CVE-2018-17218ptcthingworx_platform8y ago01-10-2018 01:00

An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2. There is reflected XSS in the SQUEAL search function.CVE-2015-2061ptccreo_view11y ago09-03-2015 14:00

Heap-based buffer overflow in the browser plugin for PTC Creo View allows remote attackers to execute arbitrary code via vectors involving setting a large buffer to an unspecified attribute.CVE-2007-4600ptcmathcad19y ago18-10-2007 20:00

The "Protect Worksheet" functionality in Mathsoft Mathcad 12 through 13.1, and PTC Mathcad 14, implements file access restrictions via a protection element in a gzipped XML file, which allows attackers to bypass these restrictions by removing this element.CVE-2020-27267geindustrial_gateway_server+65y ago13-01-2021 23:25

KEPServerEX v6.0 to v6.9, ThingWorx Kepware Server v6.8 and v6.9, ThingWorx Industrial Connectivity (all versions), OPC-Aggregator (all versions), Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway Server v7.68.804 and v7.66, and Software Toolbox TOP Server all 6.x versions, are vulnerable to a heap-based buffer overflow. Opening a specifically crafted OPC UA message could allow an attacker to crash the server and potentially leak data.CVE-2020-27263geindustrial_gateway_server+65y ago13-01-2021 23:30

KEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial Connectivity: All versions, OPC-Aggregator: All versions, Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway Server: v7.68.804 and v7.66, Software Toolbox TOP Server: All 6.x versions, are vulnerable to a heap-based buffer overflow. Opening a specifically crafted OPC UA message could allow an attacker to crash the server and potentially leak data.CVE-2020-27265geindustrial_gateway_server+65y ago13-01-2021 23:33

KEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial Connectivity: All versions, OPC-Aggregator: All versions, Rockwell Automation KEPServer Enterprise, GE Digital Industrial Gateway Server: v7.68.804 and v7.66, Software Toolbox TOP Server: All 6.x versions are vulnerable to a stack-based buffer overflow. Opening a specifically crafted OPC UA message could allow an attacker to crash the server and remotely execute code.CVE-2014-9267ptcisoview11y ago08-12-2014 16:00

Heap-based buffer overflow in the PTC IsoView ActiveX control allows remote attackers to execute arbitrary code via a crafted ViewPort property value.CVE-2022-2825geindustrial_gateway_server+83y ago29-03-2023 00:00

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kepware KEPServerEX 6.11.718.0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of text encoding conversions. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-18411.CVE-2022-2848geindustrial_gateway_server+83y ago29-03-2023 00:00

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kepware KEPServerEX 6.11.718.0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of text encoding conversions. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-16486.CVE-2022-25251ptcaxeda_agent+24y ago16-03-2022 14:03

When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send certain XML messages to a specific port without proper authentication. Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to read and modify the affected product’s configuration.CVE-2022-25250ptcaxeda_agent+24y ago16-03-2022 14:03

When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send a certain command to a specific port without authentication. Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to shut down a specific service.CVE-2022-25246ptcaxeda_agent+24y ago16-03-2022 14:03

Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) uses hard-coded credentials for its UltraVNC installation. Successful exploitation of this vulnerability could allow a remote authenticated attacker to take full remote control of the host operating system.CVE-2022-25249ptcaxeda_agent+24y ago16-03-2022 14:03

When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) (disregarding Axeda agent v6.9.2 and v6.9.3) is vulnerable to directory traversal, which could allow a remote unauthenticated attacker to obtain file system read access via web server..CVE-2022-25252ptcaxeda_agent+24y ago16-03-2022 14:03

When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) when receiving certain input throws an exception. Services using said function do not handle the exception. Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to crash the affected product.CVE-2022-25248ptcaxeda_agent+24y ago16-03-2022 14:03

When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) supplies the event log of the specific service.CVE-2022-25247ptcaxeda_agent+24y ago16-03-2022 14:03

Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send certain commands to a specific port without authentication. Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to obtain full file-system access and remote code execution.CVE-2024-40395ptcthingworx2y ago27-08-2024 00:00

An Insecure Direct Object Reference (IDOR) in PTC ThingWorx v9.5.0 allows attackers to view sensitive information, including PII, regardless of access level.