Vendor

AVEVA

63 known vulnerabilities.

Products

Process Optimization 7 Edge 7 AVEVA System Platform 6 AVEVA System Platform 2020 6 AVEVA InTouch 2020 6 AVEVA Historian 2020 6 AVEVA Communication Drivers Pack 2020 6 AVEVA Batch Management 2020 6 AVEVA MES 2014 6 InTouch 5 PI Server 4 Pipeline Integrity Monitor 4 Application Server 4 Historian 3 Communication Drivers Pack 3 Batch Management 3 PI Data Archive 2 PI Connector for CygNet 2 PI Web API 2 SystemPlatform 2 Enterprise Licensing (formerly known as License Manager) 2 Manufacturing Execution System (formerly known as Wonderware MES) 2 Recipe Management 2 Edge (formerly known as Indusoft Web Studio) 2 Worktasks (formerly known as Workflow Management) 2 Plant SCADA (formerly known as Citect) 2 Mobile Operator (formerly known as IntelaTrac Mobile Operator Rounds) 2 Telemetry Server 2 PI Integrator 2 Wonderware System Platform 1 AVEVA Edge 1 InTouch Access Anywhere 1 Reports for Operations 1 Vijeo Citect and Citect SCADA 1 AVEVA Plant SCADA 1 AVEVA Telemetry Server 1 SuiteLink Server 1 PI Asset Framework Client 1 PI Data Archive PI Server 1 Pipeline Simulation 2025 1

All Critical High Medium Low Exploited only Public exploit

63 results · Feed

Medium 5.5

CVE-2022-36969 EPSS 14%

This vulnerability allows remote attackers to disclose sensitive information on affected installations of AVEVA Edge 20…

AVEVA Edge Browsers

Mar 29, 2023
Critical 9.8

CVE-2023-1256

CVE-2023-1256

The listed versions of AVEVA Plant SCADA and AVEVA Telemetry Server are vulnerable to an improper authorization exploit which could allow an unauthenticated user to remotely read data, cause denial of service, and tamper with alarm states.

AVEVA AVEVA Plant SCADA AVEVA Telemetry Server

Mar 16, 2023
High 7.5

CVE-2022-23854 Public exploit Scanner template EPSS 50%

AVEVA InTouch Access Anywhere versions 2020 R2 and older are vulnerable to a path traversal exploit that could allow an…

AVEVA InTouch Access Anywhere

Dec 23, 2022
High 7.3

CVE-2021-38410

AVEVA PCS Portal Uncontrolled Search Path Element

AVEVA Software Platform Common Services (PCS) Portal versions 4.5.2, 4.5.1, 4.5.0, and 4.4.6 are vulnerable to DLL hijacking through an uncontrolled search path element, which may allow an attacker control to one or more locations in the search path.

AVEVA Platform Common Services (PCS) Portal

Jul 27, 2022
High 7.4

CVE-2022-1467

AVEVA InTouch Access Anywhere Exposure of Resource to Wrong Sphere

Windows OS can be configured to overlay a “language bar” on top of any application. When this OS functionality is enabled, the OS language bar UI will be viewable in the browser alongside the AVEVA InTouch Access Anywhere and Plant SCADA Access Anywhere appli…

AVEVA AVEVA InTouch Access Anywhere AVEVA Plant SCADA Access Anywhere

May 23, 2022
High 8.1

CVE-2022-0835

AVEVA System Platform Cleartext Storage of Sensitive Information in Memory

AVEVA System Platform 2020 stores sensitive information in cleartext, which may allow access to an attacker or a low-privileged user.

AVEVA AVEVA System Platform

Apr 11, 2022
High 8.8

CVE-2021-33008

AVEVA System Platform Missing Authentication for Critical Function

AVEVA System Platform versions 2017 through 2020 R2 P01 does not perform any authentication for functionality that requires a provable user identity.

AVEVA AVEVA System Platform

Apr 4, 2022
High 7.2

CVE-2021-32981

AVEVA System Platform Path Traversal

AVEVA System Platform versions 2017 through 2020 R2 P01 uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize specia…

AVEVA AVEVA System Platform

Apr 4, 2022
High 7.2

CVE-2021-32985

AVEVA System Platform Origin Validation Error

AVEVA System Platform versions 2017 through 2020 R2 P01 does not properly verify that the source of data or communication is valid.

AVEVA AVEVA System Platform

Apr 4, 2022
High 7.5

CVE-2021-33010

AVEVA System Platform Uncaught Exception

An exception is thrown from a function in AVEVA System Platform versions 2017 through 2020 R2 P01, but it is not caught, which may cause a denial-of-service condition.

AVEVA AVEVA System Platform

Apr 4, 2022
High 7.2

CVE-2021-32977

AVEVA System Platform Improper Verification of Cryptographic Signature

AVEVA System Platform versions 2017 through 2020 R2 P01 does not verify, or incorrectly verifies, the cryptographic signature for data.

AVEVA AVEVA System Platform

Apr 4, 2022
High 7.5

CVE-2021-32987

AVEVA SuiteLink Server Null Pointer Dereference

Null pointer dereference in SuiteLink server while processing command 0x0b

AVEVA AVEVA System Platform 2020 AVEVA Historian 2020 AVEVA Batch Management 2020

Sep 23, 2021
High 7.5

CVE-2021-32999

AVEVA SuiteLink Server Improper Handling of Exceptional Conditions

Improper handling of exceptional conditions in SuiteLink server while processing command 0x01

AVEVA AVEVA MES 2014 AVEVA System Platform 2020 AVEVA Historian 2020

Sep 23, 2021
High 7.5

CVE-2021-32979

AVEVA SuiteLink Server Null Pointer Dereference

Null pointer dereference in SuiteLink server while processing commands 0x04/0x0a

AVEVA AVEVA System Platform 2020 AVEVA Historian 2020 AVEVA Batch Management 2020

Sep 23, 2021
High 7.5

CVE-2021-32971

AVEVA SuiteLink Server Null Pointer Dereference

Null pointer dereference in SuiteLink server while processing command 0x07

AVEVA AVEVA MES 2014 AVEVA System Platform 2020 AVEVA Historian 2020

Sep 23, 2021
High 8.1

CVE-2021-32959

AVEVA SuiteLink Server Buffer Overflow

Heap-based buffer overflow in SuiteLink server while processing commands 0x05/0x06

AVEVA AVEVA MES 2014 AVEVA System Platform 2020 AVEVA Historian 2020

Sep 23, 2021
High 7.5

CVE-2021-32963

AVEVA SuiteLink Server Null Pointer Dereference

Null pointer dereference in SuiteLink server while processing commands 0x03/0x10

AVEVA AVEVA System Platform 2020 AVEVA Historian 2020 AVEVA Batch Management 2020

Sep 23, 2021
Medium 6.6

CVE-2021-32942

The vulnerability could expose cleartext credentials from AVEVA InTouch Runtime 2020 R2 and all prior versions (WindowV…

AVEVA InTouch

Jun 9, 2021
Unscored —

CVE-2019-13537

The IEC870IP driver for AVEVA’s Vijeo Citect and Citect SCADA and Schneider Electric’s Power SCADA Operation has a buff…

AVEVA Vijeo Citect and Citect SCADA

Jan 14, 2020
Unscored —

CVE-2019-10981

In Vijeo Citect 7.30 and 7.40, and CitectSCADA 7.30 and 7.40, a vulnerability has been identified that may allow an aut…

AVEVA AVEVA Vijeo Citect and CitectSCADA

May 31, 2019
Unscored —

CVE-2019-6525

AVEVA Wonderware System Platform 2017 Update 2 and prior uses an ArchestrA network user account for authentication of s…

AVEVA Wonderware System Platform

Apr 11, 2019
Unscored —

CVE-2018-10628

AVEVA InTouch 2014 R2 SP1 and prior, InTouch 2017, InTouch 2017 Update 1, and InTouch 2017 Update 2 allow an unauthenti…

AVEVA InTouch

Jul 24, 2018
Unscored —

CVE-2018-10620

AVEVA InduSoft Web Studio v8.1 and v8.1SP1, and InTouch Machine Edition v2017 8.1 and v2017 8.1 SP1 a remote user could…

AVEVA InduSoft Web Studio InTouch Machine Edition

Jul 19, 2018

AVEVA

Products

This vulnerability allows remote attackers to disclose sensitive information on affected installations of AVEVA Edge 20…

CVE-2023-1256

AVEVA InTouch Access Anywhere versions 2020 R2 and older are vulnerable to a path traversal exploit that could allow an…

AVEVA PCS Portal Uncontrolled Search Path Element

AVEVA InTouch Access Anywhere Exposure of Resource to Wrong Sphere

AVEVA System Platform Cleartext Storage of Sensitive Information in Memory

AVEVA System Platform Missing Authentication for Critical Function

AVEVA System Platform Path Traversal

AVEVA System Platform Origin Validation Error

AVEVA System Platform Uncaught Exception

AVEVA System Platform Improper Verification of Cryptographic Signature

AVEVA SuiteLink Server Null Pointer Dereference

AVEVA SuiteLink Server Improper Handling of Exceptional Conditions

AVEVA SuiteLink Server Null Pointer Dereference

AVEVA SuiteLink Server Null Pointer Dereference

AVEVA SuiteLink Server Buffer Overflow

AVEVA SuiteLink Server Null Pointer Dereference

The vulnerability could expose cleartext credentials from AVEVA InTouch Runtime 2020 R2 and all prior versions (WindowV…

The IEC870IP driver for AVEVA’s Vijeo Citect and Citect SCADA and Schneider Electric’s Power SCADA Operation has a buff…

In Vijeo Citect 7.30 and 7.40, and CitectSCADA 7.30 and 7.40, a vulnerability has been identified that may allow an aut…

AVEVA Wonderware System Platform 2017 Update 2 and prior uses an ArchestrA network user account for authentication of s…

AVEVA InTouch 2014 R2 SP1 and prior, InTouch 2017, InTouch 2017 Update 1, and InTouch 2017 Update 2 allow an unauthenti…

AVEVA InduSoft Web Studio v8.1 and v8.1SP1, and InTouch Machine Edition v2017 8.1 and v2017 8.1 SP1 a remote user could…