Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-10587 State: PUBLISHED Published: 2018-11-01T17:00:00 Last Updated: 2024-08-05T07:39:08.450Z Vendors: n/a Products: n/a Problem Types: n/a Description: NetGain Enterprise Manager (EM) is affected by OS Command Injection vulnerabilities in versions before 10.0.57. These vulnerabilities could allow remote authenticated attackers to inject arbitrary code, resulting in remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2018-004
CVE ID: CVE-2018-10589 State: PUBLISHED Published: 2018-05-15T22:00:00Z Last Updated: 2024-09-17T01:20:33.098Z Vendors: Advantech Products: WebAccess Problem Types: CWE-22 Description: In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, a path transversal vulnerability has been identified, which may allow an attacker to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104190 - https://ics-cert.us-cert.gov/advisories/ICSA-18-135-01
CVE ID: CVE-2018-10590 State: PUBLISHED Published: 2018-05-15T22:00:00Z Last Updated: 2024-09-16T22:45:05.267Z Vendors: Advantech Products: WebAccess Problem Types: CWE-548 Description: In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, an information exposure vulnerability through directory listing has been identified, which may allow an attacker to find important files that are not normally visible. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104190 - https://ics-cer
ditional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104190 - https://ics-cert.us-cert.gov/advisories/ICSA-18-135-01
CVE ID: CVE-2018-10591 State: PUBLISHED Published: 2018-05-15T22:00:00Z Last Updated: 2024-09-16T18:19:27.437Z Vendors: Advantech Products: WebAccess Problem Types: CWE-346 Description: In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, an origin validation error vulnerability has been identified, which may allow an attacker can create a malicious web site, steal session cookies, and access data of authenticated users. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104190
nticated users. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104190 - https://ics-cert.us-cert.gov/advisories/ICSA-18-135-01
CVE ID: CVE-2018-10592 State: PUBLISHED Published: 2018-07-31T17:00:00Z Last Updated: 2024-09-16T17:38:31.810Z Vendors: Yokogawa Products: STARDOM FCJ Controllers, STARDOM FCN-100 Controllers, STARDOM FCN-RTU Controllers, STARDOM FCN-500 Controllers Problem Types: CWE-798 Description: Yokogawa STARDOM FCJ controllers R4.02 and prior, FCN-100 controllers R4.02 and prior, FCN-RTU controllers R4.02 and prior, and FCN-500 controllers R4.02 and prior utilize hard-coded credentials that could allow an attacker to gain unauthorized administrative access to the device, which could result in remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://web-material3.
result in remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://web-material3.yokogawa.com/1/6712/details/YSAR-18-0004-E.pdf - http://www.securityfocus.com/bid/104376 - https://ics-cert.us-cert.gov/advisories/ICSA-18-151-03
CVE ID: CVE-2018-10593 State: PUBLISHED Published: 2018-05-24T16:00:00Z Last Updated: 2024-09-16T17:54:34.004Z Vendors: Becton, Dickinson and Company Products: Kiestra and InoqulA systems Problem Types: CWE-356 Description: A vulnerability in DB Manager version 3.0.1.0 and previous and PerformA version 3.0.0.0 and previous allows an authorized user with access to a privileged account on a BD Kiestra system (Kiestra TLA, Kiestra WCA, and InoqulA+ specimen processor) to issue SQL commands, which may result in data corruption. Additional Analyst Notes: - CVE Program Container: References: - https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletin-bd-kiestra-tla-bd
References: - https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletin-bd-kiestra-tla-bd-kiestra-wca-bd-inoqula - https://ics-cert.us-cert.gov/advisories/ICSMA-18-142-01
CVE ID: CVE-2018-10594 State: PUBLISHED Published: 2018-06-26T20:00:00Z Last Updated: 2024-09-16T16:58:55.973Z Vendors: ICS-CERT Products: Delta Industrial Automation COMMGR and accompanying PLC Simulators (DVPSimulator EH2, EH3, ES2, SE, SS2 and AHSIM_5x0, AHSIM_5x1) Problem Types: CWE-121 Description: Delta Industrial Automation COMMGR from Delta Electronics versions 1.08 and prior with accompanying PLC Simulators (DVPSimulator EH2, EH3, ES2, SE, SS2 and AHSIM_5x0, AHSIM_5x1) utilize a fixed-length stack buffer where an unverified length value can be read from the network packets via a specific network port, causing the buffer to be overwritten. This may allow remote code execution, cause
packets via a specific network port, causing the buffer to be overwritten. This may allow remote code execution, cause the application to crash, or result in a denial-of-service condition in the application server. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104529 - https://www.exploit-db.com/exploits/44965/ - https://ics-cert.us-cert.gov/advisories/ICSA-18-172-01 - https://www.exploit-db.com/exploits/45574/
CVE ID: CVE-2018-10595 State: PUBLISHED Published: 2018-05-24T16:00:00Z Last Updated: 2024-09-17T03:37:22.581Z Vendors: Becton, Dickinson and Company Products: Kiestra and InoqulA systems Problem Types: CWE-356 Description: A vulnerability in ReadA version 1.1.0.2 and previous allows an authorized user with access to a privileged account on a BD Kiestra system (Kiestra TLA, Kiestra WCA, and InoqulA+ specimen processor) to issue SQL commands, which may result in loss or corruption of data. Additional Analyst Notes: - CVE Program Container: References: - https://www.bd.com/en-us/support/product-security-and-privacy/product-security-bulletin-bd-kiestra-tla-bd-kiestra-wca-bd-inoqula - https://ic
-us/support/product-security-and-privacy/product-security-bulletin-bd-kiestra-tla-bd-kiestra-wca-bd-inoqula - https://ics-cert.us-cert.gov/advisories/ICSMA-18-142-01
CVE ID: CVE-2018-10596 State: PUBLISHED Published: 2018-07-02T18:00:00Z Last Updated: 2025-05-22T17:36:04.656Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Medtronic Products: 2090 CareLink Programmer, 29901 Encore Programmer Problem Types: CWE-923 Description: Medtronic 2090 CareLink Programmer uses a virtual private network connection to securely download updates. It does not verify it is still connected to this virtual private network before downloading updates. The affected products initially establish an encapsulated IP-based VPN connection to a Medtronic-hosted update network. Once the VPN is established, it makes a request to a HTTP (non-TLS) server
ection to a Medtronic-hosted update network. Once the VPN is established, it makes a request to a HTTP (non-TLS) server across the VPN for updates, which responds and provides any available updates. The programmer-side (client) service responsible for this HTTP request does not check to ensure it is still connected to the VPN before making the HTTP request. Thus, an attacker could cause the VPN connection to terminate (through various methods and attack points) and intercept the HTTP request, responding with malicious updates via a man-in-the-middle attack. The affected products do not verify the origin or integrity of these updates, as it insufficiently relied on the security of the VPN. An
ducts do not verify the origin or integrity of these updates, as it insufficiently relied on the security of the VPN. An attacker with remote network access to the programmer could influence these communications. Additional Analyst Notes: - CVE Program Container: References: - https://global.medtronic.com/xg-en/product-security/security-bulletins/carelink-2090-29901.html - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-18-058-01
CVE ID: CVE-2018-10597 State: PUBLISHED Published: 2018-06-05T20:00:00Z Last Updated: 2024-09-16T23:46:22.088Z Vendors: ICS-CERT Products: IntelliVue Patient Monitors, Avalon Fetal/Maternal Monitors Problem Types: CWE-287 Description: IntelliVue Patient Monitors MP Series (including MP2/X2/MP30/MP50/MP70/NP90/MX700/800) Rev B-M, IntelliVue Patient Monitors MX (MX400-550) Rev J-M and (X3/MX100 for Rev M only), and Avalon Fetal/Maternal Monitors FM20/FM30/FM40/FM50 with software Revisions F.0, G.0 and J.3 have a vulnerability that allows an unauthenticated attacker to access memory ("write-what-where") from an attacker-chosen device address within the same subnet. Additional Analyst Notes: - C
memory ("write-what-where") from an attacker-chosen device address within the same subnet. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSMA-18-156-01
CVE ID: CVE-2018-10598 State: PUBLISHED Published: 2018-08-13T22:00:00Z Last Updated: 2024-09-17T02:47:50.846Z Vendors: ICS-CERT Products: CNCSoft with ScreenEditor Problem Types: CWE-125 Description: CNCSoft Version 1.00.83 and prior with ScreenEditor Version 1.00.54 has two out-of-bounds read vulnerabilities could cause the software to crash due to lacking user input validation for processing project files. Which may allow an attacker to gain remote code execution with administrator privileges if exploited. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-18-219-01 - http://www.securityfocus.com/bid/105032
CVE ID: CVE-2018-10599 State: PUBLISHED Published: 2018-06-05T20:00:00Z Last Updated: 2024-09-16T16:33:25.211Z Vendors: ICS-CERT Products: IntelliVue Patient Monitors, Avalon Fetal/Maternal Monitors Problem Types: CWE-200 Description: IntelliVue Patient Monitors MP Series (including MP2/X2/MP30/MP50/MP70/NP90/MX700/800) Rev B-M, IntelliVue Patient Monitors MX (MX400-550) Rev J-M and (X3/MX100 for Rev M only), and Avalon Fetal/Maternal Monitors FM20/FM30/FM40/FM50 with software Revisions F.0, G.0 and J.3 have a vulnerability that allows an unauthenticated attacker to read memory from an attacker-chosen device address within the same subnet. Additional Analyst Notes: - CVE Program Container: R
mory from an attacker-chosen device address within the same subnet. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSMA-18-156-01
CVE ID: CVE-2018-10600 State: PUBLISHED Published: 2018-07-24T13:00:00Z Last Updated: 2024-09-16T16:17:38.171Z Vendors: Schweitzer Engineering Laboratories, Inc. Products: AcSELerator Architect Problem Types: CWE-611 Description: SEL AcSELerator Architect version 2.2.24.0 and prior allows unsanitized input to be passed to the XML parser, which may allow disclosure and retrieval of arbitrary data, arbitrary code execution (in certain situations on specific platforms), and denial of service attacks. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-18-191-02
CVE ID: CVE-2018-10601 State: PUBLISHED Published: 2018-06-05T20:00:00Z Last Updated: 2024-09-17T02:36:04.782Z Vendors: ICS-CERT Products: IntelliVue Patient Monitors, Avalon Fetal/Maternal Monitors Problem Types: CWE-121 Description: IntelliVue Patient Monitors MP Series (including MP2/X2/MP30/MP50/MP70/NP90/MX700/800) Rev B-M, IntelliVue Patient Monitors MX (MX400-550) Rev J-M and (X3/MX100 for Rev M only), and Avalon Fetal/Maternal Monitors FM20/FM30/FM40/FM50 with software Revisions F.0, G.0 and J.3 have a vulnerability that exposes an "echo" service, in which an attacker-sent buffer to an attacker-chosen device address within the same subnet is copied to the stack with no boundary check
er-sent buffer to an attacker-chosen device address within the same subnet is copied to the stack with no boundary checks, hence resulting in stack overflow. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSMA-18-156-01
CVE ID: CVE-2018-10602 State: PUBLISHED Published: 2018-09-26T18:00:00Z Last Updated: 2024-09-16T19:19:09.394Z Vendors: WECON Technology Co., Ltd. Products: LeviStudioU Problem Types: CWE-121 Description: WECON LeviStudio Versions 1.8.29 and 1.8.44 have multiple stack-based buffer overflow vulnerabilities that can be exploited when the application processes specially crafted project files. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-18-212-03 - http://www.securityfocus.com/bid/104935
CVE ID: CVE-2018-10603 State: PUBLISHED Published: 2018-07-31T17:00:00Z Last Updated: 2024-09-17T00:21:23.117Z Vendors: Martem Products: TELEM GW6, TELEM GWM Problem Types: CWE-306 Description: Martem TELEM GW6 and GWM devices with firmware 2018.04.18-linux_4-01-601cb47 and prior do not perform authentication of IEC-104 control commands, which may allow a rogue node a remote control of the industrial process. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-18-142-01 - http://www.securityfocus.com/bid/104286
CVE ID: CVE-2018-10604 State: PUBLISHED Published: 2018-07-24T13:00:00Z Last Updated: 2024-09-16T22:40:00.252Z Vendors: Schweitzer Engineering Laboratories, Inc. Products: Compass Problem Types: CWE-276 Description: SEL Compass version 3.0.5.1 and prior allows all users full access to the SEL Compass directory, which may allow modification or overwriting of files within the Compass installation folder, resulting in escalation of privilege and/or malicious code execution. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-18-191-02
CVE ID: CVE-2018-10605 State: PUBLISHED Published: 2018-10-01T16:00:00Z Last Updated: 2024-09-17T00:30:58.741Z Vendors: Martem Products: TELEM-GW6/GWM Problem Types: CWE-276 Description: Martem TELEM GW6/GWM versions prior to 2.0.87-4018403-k4 may allow unprivileged users to modify/upload a new system configuration or take the full control over the RTU using default credentials to connect to the RTU. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-18-142-01 - https://martem.eu/csa/Martem_CSA_Telem_1805183.pdf
CVE ID: CVE-2018-10606 State: PUBLISHED Published: 2018-09-26T18:00:00Z Last Updated: 2024-09-16T23:51:42.389Z Vendors: WECON Technology Co., Ltd. Products: LeviStudioU Problem Types: CWE-122 Description: WECON LeviStudio Versions 1.8.29 and 1.8.44 have multiple heap-based buffer overflow vulnerabilities that can be exploited when the application processes specially crafted project files. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-18-212-03 - http://www.securityfocus.com/bid/104935
CVE ID: CVE-2018-10607 State: PUBLISHED Published: 2018-07-31T17:00:00Z Last Updated: 2024-09-16T21:57:37.516Z Vendors: Martem Products: TELEM GW6, TELEM GWM Problem Types: CWE-400 Description: Martem TELEM GW6 and GWM devices with firmware 2018.04.18-linux_4-01-601cb47 and prior allow the creation of new connections to one or more IOAs, without closing them properly, which may cause a denial of service within the industrial process control channel. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-18-142-01 - http://martem.eu/csa/Martem_CSA_Telem_1805184.pdf - http://www.securityfocus.com/bid/104286
CVE ID: CVE-2018-10608 State: PUBLISHED Published: 2018-07-24T13:00:00Z Last Updated: 2024-09-16T16:42:59.382Z Vendors: Schweitzer Engineering Laboratories, Inc. Products: AcSELerator Architect Problem Types: CWE-400 Description: SEL AcSELerator Architect version 2.2.24.0 and prior can be exploited when the AcSELerator Architect FTP client connects to a malicious FTP server, which may cause denial of service via 100% CPU utilization. Restart of the application is required. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-18-191-02 - http://packetstormsecurity.com/files/152951/SEL-AcSELerator-Architect-2.2.24-Denial-Of-Service.html
CVE ID: CVE-2018-10609 State: PUBLISHED Published: 2018-07-31T17:00:00Z Last Updated: 2024-09-16T18:34:17.545Z Vendors: Martem Products: TELEM-GW6/GWM Problem Types: CWE-79 Description: Martem TELEM GW6 and GWM devices with firmware 2018.04.18-linux_4-01-601cb47 and prior allow improper sanitization of data over a Websocket which may allow cross-site scripting and client-side code execution with target user privileges. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-18-142-01 - http://martem.eu/csa/Martem_CSA_Telem_1805181.pdf - http://www.securityfocus.com/bid/104286
CVE ID: CVE-2018-10610 State: PUBLISHED Published: 2018-10-09T21:00:00Z Last Updated: 2024-09-16T21:04:28.173Z Vendors: WECON Technology Co., Ltd Products: LeviStudioU Problem Types: CWE-787 Description: An out-of-bounds vulnerability in LeviStudioU, Versions 1.8.29 and 1.8.44 can be exploited when the application processes specially crafted project files. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-18-212-03
CVE ID: CVE-2018-10611 State: PUBLISHED Published: 2018-06-04T14:00:00Z Last Updated: 2024-09-16T18:33:38.782Z Vendors: GE Products: MDS PulseNET and MDS PulseNET Enterprise Problem Types: CWE-287 Description: Java remote method invocation (RMI) input port in GE MDS PulseNET and MDS PulseNET Enterprise version 3.2.1 and prior may be exploited to allow unauthenticated users to launch applications and support remote code execution through web services. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104377 - http://www.gegridsolutions.com/app/DownloadFile.aspx?prod=pulsenet&type=9&file=1 - https://ics-cert.us-cert.gov/advisories/ICSA-18-151-02
CVE ID: CVE-2018-10612 State: PUBLISHED Published: 2019-01-29T16:00:00Z Last Updated: 2024-09-17T02:32:49.885Z Vendors: 3S-Smart Products: 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0 Problem Types: CWE-284 Description: In 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0, user access management and communication encryption is not enabled by default, which could allow an attacker access to the device and sensitive information, including user credentials. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106248 - https://ics-cert.us-cert.gov/advisories/ICSA-18-352-03
CVE ID: CVE-2018-10613 State: PUBLISHED Published: 2018-06-04T14:00:00Z Last Updated: 2024-09-16T16:52:57.226Z Vendors: GE Products: MDS PulseNET and MDS PulseNET Enterprise Problem Types: CWE-611 Description: Multiple variants of XML External Entity (XXE) attacks may be used to exfiltrate data from the host Windows platform in GE MDS PulseNET and MDS PulseNET Enterprise version 3.2.1 and prior. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104377 - http://www.gegridsolutions.com/app/DownloadFile.aspx?prod=pulsenet&type=9&file=1 - https://ics-cert.us-cert.gov/advisories/ICSA-18-151-02
CVE ID: CVE-2018-10614 State: PUBLISHED Published: 2018-10-09T21:00:00Z Last Updated: 2024-09-17T01:40:31.228Z Vendors: WECON Technology Co., Ltd Products: LeviStudioU Problem Types: CWE-611 Description: An XXE vulnerability in LeviStudioU, Versions 1.8.29 and 1.8.44 can be exploited when the application processes specially crafted project XML files. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-18-212-03
CVE ID: CVE-2018-10615 State: PUBLISHED Published: 2018-06-04T14:00:00Z Last Updated: 2024-09-16T23:51:13.413Z Vendors: GE Products: MDS PulseNET and MDS PulseNET Enterprise Problem Types: CWE-23 Description: Directory traversal may lead to files being exfiltrated or deleted on the GE MDS PulseNET and MDS PulseNET Enterprise version 3.2.1 and prior host platform. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104377 - http://www.gegridsolutions.com/app/DownloadFile.aspx?prod=pulsenet&type=9&file=1 - https://ics-cert.us-cert.gov/advisories/ICSA-18-151-02
CVE ID: CVE-2018-10616 State: PUBLISHED Published: 2018-07-18T15:00:00Z Last Updated: 2024-09-17T00:45:46.975Z Vendors: ABB Products: ABB Panel Builder 800 Problem Types: CWE-20 Description: ABB Panel Builder 800 all versions has an improper input validation vulnerability which may allow an attacker to insert and run arbitrary code on a computer where the affected product is used. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-18-198-01 - http://www.securityfocus.com/bid/104882 - http://search-ext.abb.com/library/Download.aspx?DocumentID=3BSE092089&Action=Launch
CVE ID: CVE-2018-10617 State: PUBLISHED Published: 2018-06-18T19:00:00Z Last Updated: 2024-09-16T20:22:15.988Z Vendors: Delta Electronics Products: Delta Industrial Automation DOPSoft Problem Types: CWE-122 Description: Delta Electronics Delta Industrial Automation DOPSoft version 4.00.04 and prior utilizes a fixed-length heap buffer where a value larger than the buffer can be read from a .dpa file into the buffer, causing the buffer to be overwritten. This may allow remote code execution or cause the application to crash. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104375 - https://ics-cert.us-cert.gov/advisories/ICSA-18-151-01
CVE ID: CVE-2018-10618 State: PUBLISHED Published: 2018-08-01T18:00:00Z Last Updated: 2024-09-16T19:31:23.918Z Vendors: Davolink Products: DVW-3200N Problem Types: CWE-916 Description: Davolink DVW-3200N all version prior to Version 1.00.06. The device generates a weak password hash that is easily cracked, allowing a remote attacker to obtain the password for the device. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104940 - https://ics-cert.us-cert.gov/advisories/ICSA-18-212-01 - https://www.exploit-db.com/exploits/45076/
CVE ID: CVE-2018-10619 State: PUBLISHED Published: 2018-06-07T20:00:00Z Last Updated: 2024-09-16T16:23:04.934Z Vendors: ICS-CERT Products: Rockwell Automation RSLinx Classic and FactoryTalk Linx Gateway Problem Types: CWE-428 Description: An unquoted search path or element in RSLinx Classic Versions 3.90.01 and prior and FactoryTalk Linx Gateway Versions 3.90.00 and prior may allow an authorized, but non-privileged local user to execute arbitrary code and allow a threat actor to escalate user privileges on the affected workstation. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44892/ - https://ics-cert.us-cert.gov/advisories/ICSA-18-158-
ntainer: References: - https://www.exploit-db.com/exploits/44892/ - https://ics-cert.us-cert.gov/advisories/ICSA-18-158-01 - http://www.securityfocus.com/bid/104415