ICSA-19-015-01: LCDS - Leão Consultoria e Desenvolvimento de Sistemas Ltda ME LAquis SCADA
Opening a specially crafted report format file allows execution of script code, which may allow remote code execution, data exfiltration, or cause a system crash.CVE-2018-18988 has been assigned to this vulnerability. A CVSS v3 base score of 7.3 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Opening a specially crafted project file may cause an out of bounds read, which may allow data exfiltration.CVE-2018-19004 has been assigned to this vulnerability. A CVSS v3 base score of 3.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N). Opening a specially crafted project file may cause improper control of generation of code, which may allow remote code execution, data exfiltration, or cause a system crash.CVE-2018-19002 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). An attacker using a specially crafted project file can supply a pointer for a controlled memory address, which may allow remote code execution, data exfiltration, or cause a system crash.CVE-2018-19029 has been assigned to this vulnerability. A CVSS v3 base score of 7.3 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Opening specially crafted report format file may cause an out of bounds read, which may cause a system crash, allow data exfiltration, or remote code execution.CVE-2018-18986 has been assigned to this vulnerability. A CVSS v3 base score of 7.3 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose sensitive information under the context of the web server process.CVE-2018-18990 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Opening specially crafted project file may cause an out of bounds read, which may cause a system crash or allow data exfiltration.CVE-2018-18994 has been assigned to this vulnerability. A CVSS v3 base score of 7.3 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Taking in user input without proper sanitation may allow an attacker to execute remote code on the server.CVE-2018-18992 has been assigned to this vulnerability. A CVSS v3 base score of 6.3 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L). Taking in user input without proper authorization or sanitation may allow an attacker to execute remote code on the server.CVE-2018-18996 has been assigned to this vulnerability. A CVSS v3 base score of 7.3 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Use of hard coded credentials may allow an attacker unauthorized access to the system with high-privileges.CVE-2018-18998 has been assigned to this vulnerability. A CVSS v3 base score of 7.3 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). An authentication bypass is possible, which may allow an attacker access to sensitive data.CVE-2018-19000 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
CVSS v3.0: 5.3