invensys vulnerabilities

Recent CVEs affecting invensys products. 25 tracked.

invensys has 25 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 8. Most recent: 2014-08-28. Highest priority: CVE-2013-0685 (score 55/100).

CVE-2014-5399 HIGH 7.5 DOWNGRADE SQL injection vulnerability in Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 through 5
CVE-2014-5398 LOW 2.1 DOWNGRADE Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 through 5.5 allows remote attackers to r
CVE-2014-5397 HIGH 7.5 DOWNGRADE Cross-site scripting (XSS) vulnerability in Schneider Electric Wonderware Information Server (WIS) Portal 4.0
CVE-2014-2381 LOW 2.1 DOWNGRADE Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 through 5.5 uses weak encryption, which
CVE-2014-2380 HIGH 7.8 DOWNGRADE Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 through 5.5 uses weak encryption, which
CVE-2013-0688 MEDIUM 4.3 DOWNGRADE Cross-site scripting (XSS) vulnerability in Invensys Wonderware Information Server (WIS) 4.0 SP1SP1, 4.5- Port
CVE-2013-0686 HIGH 9.3 DOWNGRADE Invensys Wonderware Information Server (WIS) 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers
CVE-2013-0685 HIGH 9.3 DOWNGRADE Invensys Wonderware Information Server (WIS) 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal does not restrict unspec
CVE-2013-0684 HIGH 7.5 DOWNGRADE SQL injection vulnerability in Invensys Wonderware Information Server (WIS) 4.0 SP1SP1, 4.5- Portal, and 5.0-
CVE-2012-4710 HIGH 9.3 DOWNGRADE Invensys Wonderware Win-XML Exporter 1522.148.0.0 allows remote attackers to read arbitrary files, send HTTP r
CVE-2012-4709 MEDIUM 6.9 UPGRADE Invensys Wonderware InTouch HMI 2012 R2 and earlier allows remote attackers to read arbitrary files, send HTTP
CVE-2012-4693 LOW 1.9 UPGRADE MITIGATE Invensys Wonderware InTouch 2012 R2 and earlier and Siemens ProcessSuite use a weak encryption algorithm for d
CVE-2012-3847 MEDIUM 5.0 DOWNGRADE DOWNGRADE slssvc.exe in Invensys Wonderware SuiteLink in Invensys InTouch 2012 and Wonderware Application Server 2012 al
CVE-2012-3007 MEDIUM 5.0 UPGRADE UPGRADE Stack-based buffer overflow in slssvc.exe before 58.x in Invensys Wonderware SuiteLink in the Invensys System
CVE-2012-3005 MEDIUM 6.9 DOWNGRADE UPGRADE Untrusted search path vulnerability in Invensys Wonderware InTouch 2012 and earlier, as used in Wonderware App
CVE-2012-0258 MEDIUM 6.8 UPGRADE UPGRADE Heap-based buffer overflow in the WWCabFile ActiveX component in the Wonderware System Platform in Invensys Wo
CVE-2012-0257 MEDIUM 6.8 UPGRADE UPGRADE Heap-based buffer overflow in the WWCabFile ActiveX component in the Wonderware System Platform in Invensys Wo
CVE-2012-0228 HIGH 7.5 DOWNGRADE Invensys Wonderware Information Server 4.0 SP1 and 4.5 does not properly implement client controls, which allo
CVE-2012-0226 HIGH 7.5 DOWNGRADE SQL injection vulnerability in Invensys Wonderware Information Server 4.0 SP1 and 4.5 allows remote attackers
CVE-2012-0225 MEDIUM 4.3 DOWNGRADE Cross-site scripting (XSS) vulnerability in Invensys Wonderware Information Server 4.0 SP1 and 4.5 allows remo
CVE-2011-4870 MEDIUM 6.8 DOWNGRADE Multiple buffer overflows in the (1) GUIControls, (2) BatchObjSrv, and (3) BatchSecCtrl ActiveX controls in In
CVE-2011-4039 HIGH 9.3 UPGRADE UPGRADE Invensys Wonderware HMI Reports 3.42.835.0304 and earlier, as used in Ocean Data Systems Dream Report before 4
CVE-2011-4038 MEDIUM 4.3 UPGRADE UPGRADE Cross-site scripting (XSS) vulnerability in Invensys Wonderware HMI Reports 3.42.835.0304 and earlier, as used
CVE-2011-3141 HIGH 9.3 DOWNGRADE Buffer overflow in the InBatch BatchField ActiveX control for Invensys Wonderware InBatch 8.1 SP1, 9.0, and 9.
CVE-2011-2962 HIGH 9.3 DOWNGRADE Multiple stack-based buffer overflows in Invensys Wonderware Information Server 3.1, 4.0, and 4.0 SP1 allow re

FAQ

How do I fix invensys vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is invensys being exploited right now?

None of the tracked invensys CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which invensys CVE should I patch first?

CVE-2013-0685 currently ranks highest (55/100): Invensys Wonderware Information Server (WIS) 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal does not restrict unspec.

Products

RSS feed for invensys · ← Back to latest CVEs