Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-0743 State: PUBLISHED Published: 2014-02-27T01:00:00 Last Updated: 2024-08-06T09:27:19.609Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Certificate Authority Proxy Function (CAPF) component in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows remote attackers to bypass authentication and modify registered-device information via crafted data, aka Bug ID CSCum95468. Additional Analyst Notes: - CVE Program Container: References: - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0743 - http://www.securitytracker.com/id/1029843 - http://tools.cisco.com/security/center/viewAlert.x?alertId=33044
CVE ID: CVE-2014-0744 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2014-0745 State: PUBLISHED Published: 2014-02-27T01:00:00 Last Updated: 2024-08-06T09:27:19.144Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the Unified Serviceability subsystem in Cisco Unified Contact Center Express (Unified CCX) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCum95502. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1029842 - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0745
CVE ID: CVE-2014-0746 State: PUBLISHED Published: 2014-02-27T01:00:00 Last Updated: 2024-08-06T09:27:19.169Z Vendors: n/a Products: n/a Problem Types: n/a Description: The disaster recovery system (DRS) in Cisco Unified Contact Center Express (Unified CCX) allows remote authenticated users to obtain sensitive information by reading extraneous fields in an HTML document, aka Bug ID CSCum95536. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1029842 - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0746
CVE ID: CVE-2014-0747 State: PUBLISHED Published: 2014-02-27T01:00:00 Last Updated: 2024-08-06T09:27:19.127Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Certificate Authority Proxy Function (CAPF) CLI implementation in Cisco Unified Communications Manager (Unified CM) 10.0(1) and earlier allows local users to inject commands via unspecified CAPF programs, aka Bug ID CSCum95493. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1029843 - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0747 - http://tools.cisco.com/security/center/viewAlert.x?alertId=33048
CVE ID: CVE-2014-0748 State: PUBLISHED Published: 2014-12-27T02:00:00 Last Updated: 2024-08-06T09:27:19.442Z Vendors: n/a Products: n/a Problem Types: n/a Description: apinit on Cray devices with CLE before 4.2.UP02 and 5.x before 5.1.UP00 does not use alpsauth data to validate the UID in a launch message, which allows local users to gain privileges via a modified aprun program, aka ID FN5912. Additional Analyst Notes: - CVE Program Container: References: - https://labs.mwrinfosecurity.com/advisories/2014/01/31/cray-aprunapinit-privilege-escalation/
CVE ID: CVE-2014-0749 State: PUBLISHED Published: 2014-05-16T14:00:00 Last Updated: 2024-08-06T09:27:19.532Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in lib/Libdis/disrsi_.c in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 2.5.x through 2.5.13 allows remote attackers to execute arbitrary code via a large count value. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/adaptivecomputing/torque/commit/3ed749263abe3d69fa3626d142a5789dcb5a5684 - https://labs.mwrinfosecurity.com/advisories/2014/05/14/torque-buffer-overflow - https://github.com/adaptivecomputing/torque/pull/171 - http://p
urity.com/advisories/2014/05/14/torque-buffer-overflow - https://github.com/adaptivecomputing/torque/pull/171 - http://packetstormsecurity.com/files/126651/Torque-2.5.13-Buffer-Overflow.html - http://www.exploit-db.com/exploits/33554 - http://www.securityfocus.com/archive/1/532110/100/0/threaded - http://packetstormsecurity.com/files/126855/TORQUE-Resource-Manager-2.5.13-Buffer-Overflow.html - http://www.securityfocus.com/bid/67420 - http://osvdb.org/show/osvdb/107024 - https://labs.mwrinfosecurity.com/system/assets/662/original/torque-buffer-overflow_2014-05-14.pdf - http://www.debian.org/security/2014/dsa-2936
CVE ID: CVE-2014-0750 State: PUBLISHED Published: 2014-01-25T22:00:00 Last Updated: 2025-08-22T22:52:23.571Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: GE Products: Proficy HMI/SCADA - CIMPLICITY, Proficy Process Systems with CIMPLICITY Problem Types: CWE-22 Description: Directory traversal vulnerability in gefebt.exe in the WebView CimWeb components in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY through 8.2 SIM 24, and Proficy Process Systems with CIMPLICITY, allows remote attackers to execute arbitrary code via a crafted HTTP request, aka ZDI-CAN-1622. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisor
-CAN-1622. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-14-023-01 - http://support.ge-ip.com/support/index?page=kbchannel&id=KB15939 - http://www.securityfocus.com/bid/65124
CVE ID: CVE-2014-0751 State: PUBLISHED Published: 2014-01-25T22:00:00 Last Updated: 2025-08-22T22:51:23.718Z Severity: N/A (CVSS 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P) Vendors: GE Products: Proficy HMI/SCADA - CIMPLICITY, Proficy Process Systems with CIMPLICITY Problem Types: CWE-22 Description: The CIMPLICITY Web-based access component, CimWebServer, does not check the location of shell files being loaded into the system. By modifying the source location, an attacker could send shell code to the CimWebServer which would deploy the nefarious files as part of any SCADA project. This could allow the attacker to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - h
s could allow the attacker to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-14-023-01 - http://support.ge-ip.com/support/index?page=kbchannel&id=KB15939 - http://www.securityfocus.com/bid/65124
CVE ID: CVE-2014-0752 State: PUBLISHED Published: 2014-01-09T11:00:00 Last Updated: 2025-08-22T22:53:01.252Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Ecava Products: IntegraXor Problem Types: CWE-529 Description: The SCADA server in Ecava IntegraXor before 4.1.4369 allows remote attackers to read arbitrary project backup files via a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - http://www.integraxor.com/blog/category/security/vulnerability-note/ - https://www.cisa.gov/news-events/ics-advisories/icsa-14-008-01
CVE ID: CVE-2014-0753 State: PUBLISHED Published: 2014-01-21T01:00:00 Last Updated: 2025-08-25T23:46:30.088Z Severity: N/A (CVSS 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C) Vendors: Ecava Products: IntegraXor Problem Types: CWE-121 Description: Stack-based buffer overflow in the SCADA server in Ecava IntegraXor before 4.1.4390 allows remote attackers to cause a denial of service (system crash) by triggering access to DLL code located in the IntegraXor directory. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/102171 - http://www.integraxor.com/blog/buffer-overflow-vulnerability-note/ - https://www.cisa.gov/news-events/ics-advisories/icsa-14-016-01
CVE ID: CVE-2014-0754 State: PUBLISHED Published: 2014-10-03T18:00:00 Last Updated: 2025-08-25T23:45:03.684Z Severity: N/A (CVSS 10 AV:N/AC:L/Au:N/C:C/I:C/A:C) Vendors: Schneider Electric Products: Ethernet modules for M340, Quantum and Premium PLC ranges Problem Types: n/a Description: Directory traversal vulnerability in SchneiderWEB on Schneider Electric Modicon PLC Ethernet modules 140CPU65x Exec before 5.5, 140NOC78x Exec before 1.62, 140NOE77x Exec before 6.2, BMXNOC0401 before 2.05, BMXNOE0100 before 2.9, BMXNOE0110x Exec before 6.0, TSXETC101 Exec before 2.04, TSXETY4103x Exec before 5.7, TSXETY5103x Exec before 5.9, TSXP57x ETYPort Exec before 5.7, and TSXP57x Ethernet Copro Exec be
Y4103x Exec before 5.7, TSXETY5103x Exec before 5.9, TSXP57x ETYPort Exec before 5.7, and TSXP57x Ethernet Copro Exec before 5.5 allows remote attackers to visit arbitrary resources via a crafted HTTP request. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/70193 - https://www.cisa.gov/news-events/ics-advisories/icsa-14-273-01 - https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2014-260-01
CVE ID: CVE-2014-0755 State: PUBLISHED Published: 2014-02-05T02:00:00 Last Updated: 2025-09-19T18:46:05.180Z Severity: N/A (CVSS 6.3 AV:L/AC:M/Au:N/C:C/I:C/A:N) Vendors: Rockwell Automation Products: RSLogix 5000 software Problem Types: CWE-522 Description: Rockwell Automation RSLogix 5000 7 through 20.01, and 21.0, does not properly implement password protection for .ACD files (aka project files), which allows local users to obtain sensitive information or modify data via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/90981 - https://www.cisa.gov/news-events/ics-advisories/icsa-14-021-01 - http://osv
.xforce.ibmcloud.com/vulnerabilities/90981 - https://www.cisa.gov/news-events/ics-advisories/icsa-14-021-01 - http://osvdb.org/102858 - http://www.securityfocus.com/bid/65337 - https://rockwellautomation.custhelp.com/app/answers/detail/a_id/565204
CVE ID: CVE-2014-0756 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2014-0757 State: PUBLISHED Published: 2014-01-31T02:00:00 Last Updated: 2025-08-22T22:56:09.487Z Severity: N/A (CVSS 7.1 AV:N/AC:M/Au:N/C:N/I:N/A:C) Vendors: Smart Software Solutions (3S) Products: CoDeSys Runtime Toolkit Problem Types: CWE-476 Description: Smart Software Solutions (3S) CoDeSys Runtime Toolkit before 2.4.7.44 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-14-030-01 - http://secunia.com/advisories/56713
CVE ID: CVE-2014-0758 State: PUBLISHED Published: 2014-02-24T02:00:00 Last Updated: 2025-08-22T23:00:45.832Z Severity: N/A (CVSS 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C) Vendors: ICONICS Products: GENESIS32 Problem Types: CWE-749 Description: An ActiveX control in GenLaunch.htm in ICONICS GENESIS32 8.0, 8.02, 8.04, and 8.05 allows remote attackers to execute arbitrary programs via a crafted HTML document. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-14-051-01
CVE ID: CVE-2014-0759 State: PUBLISHED Published: 2014-02-28T02:00:00 Last Updated: 2025-09-19T18:52:00.207Z Severity: N/A (CVSS 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C) Vendors: Schneider Electric Products: Floating License Manager Problem Types: CWE-428 Description: Unquoted Windows search path vulnerability in Schneider Electric Floating License Manager 1.0.0 through 1.4.0 allows local users to gain privileges via a Trojan horse application with a name composed of an initial substring of a path that contains a space character. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-14-058-01 - http://download.schneider-electric.com/file
ferences: - https://www.cisa.gov/news-events/ics-advisories/icsa-14-058-01 - http://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202014-015-01
CVE ID: CVE-2014-0760 State: PUBLISHED Published: 2014-04-25T01:00:00 Last Updated: 2025-07-02T20:29:50.796Z Severity: N/A (CVSS 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C) Vendors: Festo Products: CECX-X-C1 Modular Master Controller with CoDeSys, CECX-X-M1 Modular Controller with CoDeSys and SoftMotion Problem Types: CWE-287 Description: The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion provide an undocumented access method involving the FTP protocol, which could allow a remote attacker to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors. Additional Analyst Notes: - CVE Program Container
cause a denial of service (application crash) via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-14-084-01
CVE ID: CVE-2014-0761 State: PUBLISHED Published: 2014-08-28T01:00:00 Last Updated: 2025-09-19T18:57:23.317Z Severity: N/A (CVSS 7.1 AV:N/AC:M/Au:N/C:N/I:N/A:C) Vendors: CG Automation Products: ePAQ-9410 Substation Gateway Problem Types: CWE-20 Description: The DNP3 driver in CG Automation ePAQ-9410 Substation Gateway allows remote attackers to cause a denial of service (infinite loop or process crash) via a crafted TCP packet. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-14-238-01 - http://mail.cgautomationusa.com/login.aspx
CVE ID: CVE-2014-0762 State: PUBLISHED Published: 2014-08-28T01:00:00 Last Updated: 2025-09-19T18:58:30.389Z Severity: N/A (CVSS 4.7 AV:L/AC:M/Au:N/C:N/I:N/A:C) Vendors: CG Automation Products: ePAQ-9410 Substation Gateway Problem Types: CWE-20 Description: The CG Automation Software DNP3 driver, used in the ePAQ-9410 Substation Gateway products, does not validate input correctly. An attacker could cause the software to go into an infinite loop, causing the process to crash. The system must be restarted manually to clear the condition. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-14-238-01 - http://mail.cgautomationusa.
m Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-14-238-01 - http://mail.cgautomationusa.com/login.aspx
CVE ID: CVE-2014-0763 State: PUBLISHED Published: 2014-04-12T01:00:00 Last Updated: 2025-09-19T19:06:29.062Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Advantech Products: WebAccess Problem Types: CWE-89 Description: An attacker using SQL injection may use arguments to construct queries without proper sanitization. The DBVisitor.dll is exposed through SOAP interfaces, and the exposed functions are vulnerable to SOAP injection. This may allow unexpected SQL action and access to records in the table of the software database or execution of arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-14-0
ditional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-14-079-03 - http://www.securityfocus.com/bid/66740 - http://webaccess.advantech.com/
CVE ID: CVE-2014-0764 State: PUBLISHED Published: 2014-04-12T01:00:00 Last Updated: 2025-09-19T19:08:27.053Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Advantech Products: WebAccess Problem Types: CWE-121 Description: By providing an overly long string to the NodeName parameter, an attacker may be able to overflow the static stack buffer. The attacker may then execute code on the target device remotely. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-14-079-03 - http://www.securityfocus.com/bid/66740 - http://webaccess.advantech.com/
CVE ID: CVE-2014-0765 State: PUBLISHED Published: 2014-04-12T01:00:00 Last Updated: 2025-09-19T19:09:15.893Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Advantech Products: WebAccess Problem Types: CWE-121 Description: To exploit this vulnerability, the attacker sends data from the GotoCmd argument to control. If the value of the argument is overly long, the static stack buffer can be overflowed. This will allow the attacker to execute arbitrary code remotely. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-14-079-03 - http://www.securityfocus.com/bid/66740 - http://webaccess.advantech.com/
CVE ID: CVE-2014-0766 State: PUBLISHED Published: 2014-04-12T01:00:00 Last Updated: 2025-09-19T19:10:40.843Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Advantech Products: WebAccess Problem Types: CWE-121 Description: An attacker can exploit this vulnerability by copying an overly long NodeName2 argument into a statically sized buffer on the stack to overflow the static stack buffer. An attacker may use this vulnerability to remotely execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-14-079-03 - http://www.securityfocus.com/bid/66740 - http://webaccess.advantech.com/
CVE ID: CVE-2014-0767 State: PUBLISHED Published: 2014-04-12T01:00:00 Last Updated: 2025-09-19T19:11:31.813Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Advantech Products: WebAccess Problem Types: CWE-121 Description: An attacker may exploit this vulnerability by passing an overly long value from the AccessCode argument to the control. This will overflow the static stack buffer. The attacker may then execute code on the target device remotely. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-14-079-03 - http://www.securityfocus.com/bid/66740 - http://webaccess.advantech.com/
CVE ID: CVE-2014-0768 State: PUBLISHED Published: 2014-04-12T01:00:00 Last Updated: 2025-09-19T19:12:29.569Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Advantech Products: WebAccess Problem Types: CWE-121 Description: An attacker may pass an overly long value from the AccessCode2 argument to the control to overflow the static stack buffer. The attacker may then remotely execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-14-079-03 - http://www.securityfocus.com/bid/66740 - http://webaccess.advantech.com/
CVE ID: CVE-2014-0769 State: PUBLISHED Published: 2014-04-25T01:00:00 Last Updated: 2025-07-02T20:26:44.615Z Severity: N/A (CVSS 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C) Vendors: Festo Products: CECX-X-C1 Modular Master Controller with CoDeSys, CECX-X-M1 Modular Controller with CoDeSys and SoftMotion Problem Types: CWE-287 Description: The Festo CECX-X-C1 Modular Master Controller with CoDeSys and CECX-X-M1 Modular Controller with CoDeSys and SoftMotion do not require authentication for connections to certain TCP ports, which allows remote attackers to (1) modify the configuration via a request to the debug service on port 4000 or (2) delete log entries via a request to the log service on port 4001.
ia a request to the debug service on port 4000 or (2) delete log entries via a request to the log service on port 4001. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-14-084-01
CVE ID: CVE-2014-0770 State: PUBLISHED Published: 2014-04-12T01:00:00 Last Updated: 2025-09-19T19:13:29.027Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Advantech Products: WebAccess Problem Types: CWE-121 Description: By providing an overly long string to the UserName parameter, an attacker may be able to overflow the static stack buffer. The attacker may then execute code on the target device remotely. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-14-079-03 - http://www.securityfocus.com/bid/66740 - http://webaccess.advantech.com/
CVE ID: CVE-2014-0771 State: PUBLISHED Published: 2014-04-12T01:00:00 Last Updated: 2025-09-19T19:15:27.669Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Advantech Products: WebAccess Problem Types: CWE-538 Description: The BWOCXRUN.BwocxrunCtrl.1 control contains a method named “OpenUrlToBuffer.” This method takes a URL as a parameter and returns its contents to the caller in JavaScript. The URLs are accessed in the security context of the current browser session. The control does not perform any URL validation and allows “file://” URLs that access the local disk. The method can be used to open a URL (including file URLs) and read file URLs through JavaScript. This method co
l disk. The method can be used to open a URL (including file URLs) and read file URLs through JavaScript. This method could also be used to reach any arbitrary URL to which the browser has access. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-14-079-03 - http://www.securityfocus.com/bid/66740 - http://webaccess.advantech.com/
CVE ID: CVE-2014-0772 State: PUBLISHED Published: 2014-04-12T01:00:00 Last Updated: 2025-09-19T19:19:40.873Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:P/I:N/A:N) Vendors: Advantech Products: WebAccess Problem Types: CWE-538 Description: The BWOCXRUN.BwocxrunCtrl.1 control contains a method named OpenUrlToBufferTimeout. This method takes a URL as a parameter and returns its contents to the caller in JavaScript. The URLs are accessed in the security context of the current browser session. The control does not perform any URL validation and allows file:// URLs that access the local disk. The method can be used to open a URL (including file URLs) and read the URLs through JavaScript. This method co
al disk. The method can be used to open a URL (including file URLs) and read the URLs through JavaScript. This method could also be used to reach any arbitrary URL to which the browser has access. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-14-079-03 - http://www.securityfocus.com/bid/66740 - http://webaccess.advantech.com/
CVE ID: CVE-2014-0773 State: PUBLISHED Published: 2014-04-12T01:00:00 Last Updated: 2025-09-19T19:18:06.695Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Advantech Products: WebAccess Problem Types: CWE-77 Description: The BWOCXRUN.BwocxrunCtrl.1 control contains a method named “CreateProcess.” This method contains validation to ensure an attacker cannot run arbitrary command lines. After validation, the values supplied in the HTML are passed to the Windows CreateProcessA API. The validation can be bypassed allowing for running arbitrary command lines. The command line can specify running remote files (example: UNC command line). A function exists at offset 100019B0 of bwocxr
ommand line can specify running remote files (example: UNC command line). A function exists at offset 100019B0 of bwocxrun.ocx. Inside this function, there are 3 calls to strstr to check the contents of the user specified command line. If “\setup.exe,” “\bwvbprt.exe,” or “\bwvbprtl.exe” are contained in the command line (strstr returns nonzero value), the command line passes validation and is then passed to CreateProcessA. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-14-079-03 - http://www.securityfocus.com/bid/66740 - http://webaccess.advantech.com/
CVE ID: CVE-2014-0774 State: PUBLISHED Published: 2014-02-28T02:00:00 Last Updated: 2025-09-24T21:10:10.144Z Severity: N/A (CVSS 6.8 AV:L/AC:L/Au:S/C:C/I:C/A:C) Vendors: Schneider Electric Products: TLXCDSUOFS33, TLXCDSTOFS33, TLXCDLUOFS33, TLXCDLTOFS33, TLXCDLFOFS33 Problem Types: CWE-121 Description: Stack-based buffer overflow in the C++ sample client in Schneider Electric OPC Factory Server (OFS) TLXCDSUOFS33 - 3.35, TLXCDSTOFS33 - 3.35, TLXCDLUOFS33 - 3.35, TLXCDLTOFS33 - 3.35, and TLXCDLFOFS33 - 3.35 allows local users to gain privileges via vectors involving a malformed configuration file. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/news-event