Skip to content
OpenAdvisories

Vendor

Dassault Systèmes

113 known vulnerabilities.

Products

ENOVIA Collaborative Industry Innovator 20 SOLIDWORKS eDrawings 16 3DSwymer 15 DELMIA Apriso 10 Tuleap Enterprise Edition 9 SOLIDWORKS Desktop 4 eDrawings 4 Teamwork Cloud - Standard Edition 3 Teamwork Cloud - Business Edition 3 Teamwork Cloud - Business Pro Edition 3 Teamwork Cloud - Enterprise Edition 3 Product Manager 3 ENOVIA Live Collaboration 2 Station Launcher App in 3DEXPERIENCE platform 2 DELMIA Service Process Engineer 2 Project Portfolio Manager 2 DELMIA Factory Resource Manager 2 Collaborative Industry Innovator 2 City Referential Manager 2 SIMULIA 3DOrchestrate 1 3DEXPERIENCE 1 Magic Collaboration Studio 1 SOLIDWORKS Visualize 1 ENOVIAvpm Web Access 1 ENOVIA Product Manager 1 Multidisciplinary Optimization Engineer 1 Documentation server 1 ENOVIA Specification Manager 1 GEOVIA Geospatial Data Manager 1 ENOVIA Change Manager 1 ENOVIA Product Engineering Specialist 1 SIMULIA Execution Engine 1 BIOVIA Workbook 1 Service Process Engineer 1 BIOVIA Materials Studio products 1
All Critical High Medium Low Exploited only Public exploit

113 results · Feed

  • High 8.7
    CVE-2024-6380

    Reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x

    A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

    Dassault Systèmes ENOVIA Collaborative Industry Innovator
  • High 8.7
    CVE-2024-7737

    Stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x

    A stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

    Dassault Systèmes 3DSwymer
  • High 8.7
    CVE-2024-7736

    Reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x

    A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

    Dassault Systèmes ENOVIA Collaborative Industry Innovator
  • High 8.7
    CVE-2024-8004

    Stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x

    A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

    Dassault Systèmes ENOVIA Collaborative Industry Innovator
  • High 8.7
    CVE-2024-7939

    Stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2024x

    A stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

    Dassault Systèmes 3DSwymer
  • High 8.7
    CVE-2024-7938

    Stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024x

    A stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

    Dassault Systèmes 3DSwymer
  • High 8.7
    CVE-2024-7932

    Stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer on Release 3DEXPERIENCE R2024x

    A stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

    Dassault Systèmes 3DSwymer
  • High 8.1
    CVE-2024-6377

    URL redirection to untrusted site (open redirect) vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x

    An URL redirection to untrusted site (open redirect) vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to redirect users to an arbitrary website via a crafted URL.

    Dassault Systèmes 3DSwymer
  • High 8.7
    CVE-2024-6378

    Reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x

    A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

    Dassault Systèmes ENOVIA Collaborative Industry Innovator
  • High 7.7
    CVE-2024-6379

    Reflected Cross-site Scripting (XSS) vulnerability affecting 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x

    A reflected Cross-site Scripting (XSS) vulnerability affecting 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.

    Dassault Systèmes 3DSwymer
  • Critical 9.0
    CVE-2024-3300 Scanner template

    Pre-authentication Unsafe .NET object deserialization vulnerability affecting DELMIA Apriso Release 2019 through Release 2024

    An unsafe .NET object deserialization vulnerability in DELMIA Apriso Release 2019 through Release 2024 could lead to pre-authentication remote code execution.

    Dassault Systèmes DELMIA Apriso
  • High 8.5
    CVE-2024-3301

    Post-authentication Unsafe .NET object deserialization vulnerability affecting DELMIA Apriso Release 2019 through Release 2024

    An unsafe .NET object deserialization vulnerability in DELMIA Apriso Release 2019 through Release 2024 could lead to post-authentication remote code execution.

    Dassault Systèmes DELMIA Apriso
  • Medium 5.4
    CVE-2023-5597

    Stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024x

    A stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code.

    Dassault Systèmes 3DSwymer
  • High 7.8
    CVE-2024-3299

    Out-Of-Bounds Write, Use of Uninitialized Resource and Use-After-Free vulnerabilities exist in the SLDDRW and SLDPRT file reading procedure in eDrawings from Release SOLIDWORKS 2023 through Release SOLIDWORKS 2024

    Out-Of-Bounds Write, Use of Uninitialized Resource and Use-After-Free vulnerabilities exist in the file reading procedure in eDrawings from Release SOLIDWORKS 2023 through Release SOLIDWORKS 2024. These vulnerabilities could allow an attacker to execute arbit…

    Dassault Systèmes eDrawings
  • High 7.8
    CVE-2024-3298

    Out-Of-Bounds Write and Type Confusion vulnerabilities exist in the DWG and DXF file reading procedure in eDrawings from Release SOLIDWORKS 2023 through Release SOLIDWORKS 2024

    Out-Of-Bounds Write and Type Confusion vulnerabilities exist in the file reading procedure in eDrawings from Release SOLIDWORKS 2023 through Release SOLIDWORKS 2024. These vulnerabilities could allow an attacker to execute arbitrary code while opening a speci…

    Dassault Systèmes eDrawings
  • High 7.8
    CVE-2024-1848

    Multiple vulnerabilities exist in file reading procedure in SOLIDWORKS Desktop on Release SOLIDWORKS 2024

    Heap-based Buffer Overflow, Memory Corruption, Out-Of-Bounds Read, Out-Of-Bounds Write, Stack-based Buffer Overflow, Type Confusion, Uninitialized Variable, Use-After-Free vulnerabilities exist in the file reading procedure in SOLIDWORKS Desktop on Release SO…

    Dassault Systèmes SOLIDWORKS Desktop
  • Critical 9.4
    CVE-2024-1624

    OS Command Injection vulnerability affecting documentation server on certain Releases of 3DEXPERIENCE, SIMULIA Abaqus, SIMULIA Isight and CATIA Composer

    An OS Command Injection vulnerability affecting documentation server on 3DEXPERIENCE from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x, SIMULIA Abaqus from Release 2022 through Release 2024, SIMULIA Isight from Release 2022 through Release …

    Dassault Systèmes Documentation server
  • High 7.8
    CVE-2024-1847

    Multiple vulnerabilities exist in file reading procedure in eDrawings from Release SOLIDWORKS 2023 through Release SOLIDWORKS 2024

    Heap-based Buffer Overflow, Memory Corruption, Out-Of-Bounds Read, Out-Of-Bounds Write, Stack-based Buffer Overflow, Type Confusion, Uninitialized Variable, Use-After-Free vulnerabilities exist in the file reading procedure in eDrawings from Release SOLIDWORK…

    Dassault Systèmes eDrawings
  • Medium 4.4
    CVE-2024-0935

    Insertion of Sensitive Information into Log File vulnerabilities affecting DELMIA Apriso Release 2019 through Release 2024

    Insertion of Sensitive Information into Log File vulnerabilities are affecting DELMIA Apriso Release 2019 through Release 2024

    Dassault Systèmes DELMIA Apriso
  • High 8.8
    CVE-2023-6078

    OS Command Injection vulnerability affecting BIOVIA Materials Studio products from Release BIOVIA 2021 through Release BIOVIA 2023

    An OS Command Injection vulnerability exists in BIOVIA Materials Studio products from Release BIOVIA 2021 through Release BIOVIA 2023. Upload of a specially crafted perl script can lead to arbitrary command execution.

    Dassault Systèmes BIOVIA Materials Studio products
  • Medium 5.4
    CVE-2023-5598

    Stored Cross-site Scripting (XSS) vulnerabilities affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2023x

    Stored Cross-site Scripting (XSS) vulnerabilities affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2023x allow an attacker to execute arbitrary script code.

    Dassault Systèmes 3DSwymer
  • Medium 5.4
    CVE-2023-5599

    Stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2023x

    A stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2023x allows an attacker to execute arbitrary script code.

    Dassault Systèmes 3DSwymer
  • Medium 6.8
    CVE-2023-3589

    Cross-Site Request Forgery (CSRF) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x

    A Cross-Site Request Forgery (CSRF) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x could allow with some very specific conditions an attacker to send a specifically crafted query to the server.

    Dassault Systèmes Teamwork Cloud - Business Edition Teamwork Cloud - Enterprise Edition Teamwork Cloud - Standard Edition
  • Medium 5.4
    CVE-2023-3588

    Stored Cross-site Scripting (XSS) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x

    A stored Cross-site Scripting (XSS) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x allows an attacker to execute arbitrary script code.

    Dassault Systèmes Teamwork Cloud - Business Pro Edition Teamwork Cloud - Business Edition Teamwork Cloud - Enterprise Edition
  • High 8.8
    CVE-2023-1997

    OS Command Injection vulnerability affecting SIMULIA 3DOrchestrate from Release 3DEXPERIENCE R2021x through Release 3DEXPERIENCE R2023x

    An OS Command Injection vulnerability exists in SIMULIA 3DOrchestrate from Release 3DEXPERIENCE R2021x through Release 3DEXPERIENCE R2023x. A specially crafted HTTP request can lead to arbitrary command execution.

    Dassault Systèmes SIMULIA 3DOrchestrate
  • High 7.8
    CVE-2023-2763

    Use-After-Free, Out-of-bounds Write and Heap-based Buffer Overflow vulnerabilities exist in the DWG and DXF file reading procedure in SOLIDWORKS Desktop from Release SOLIDWORKS 2021 through Release SOLIDWORKS 2023

    Use-After-Free, Out-of-bounds Write and Heap-based Buffer Overflow vulnerabilities exist in the DWG and DXF file reading procedure in SOLIDWORKS Desktop from Release SOLIDWORKS 2021 through Release SOLIDWORKS 2023. These vulnerabilities could allow an attacke…

    Dassault Systèmes SOLIDWORKS Desktop
  • High 7.8
    CVE-2023-2762

    Use-After-Free vulnerability in SLDPRT file reading procedure affecting SOLIDWORKS Desktop from Release SOLIDWORKS 2021 through Release SOLIDWORKS 2023

    A Use-After-Free vulnerability in SLDPRT file reading procedure exists in SOLIDWORKS Desktop from Release SOLIDWORKS 2021 through Release SOLIDWORKS 2023. This vulnerability could allow an attacker to execute arbitrary code while opening a specially crafted S…

    Dassault Systèmes SOLIDWORKS Desktop
  • Medium 6.1
    CVE-2023-1996

    Reflected Cross-site Scripting (XSS) vulnerability affecting Release 3DEXPERIENCE R2018x through Release 3DEXPERIENCE R2023x

    A reflected Cross-site Scripting (XSS) vulnerability in Release 3DEXPERIENCE R2018x through Release 3DEXPERIENCE R2023x allows an attacker to execute arbitrary script code.

    Dassault Systèmes 3DEXPERIENCE
  • High 8.5
    CVE-2023-2141

    Unsafe .NET object deserialization affecting DELMIA Apriso Release 2017 through Release 2022

    An unsafe .NET object deserialization in DELMIA Apriso Release 2017 through Release 2022 could lead to post-authentication remote code execution.

    Dassault Systèmes DELMIA Apriso
  • High 7.5
    CVE-2023-2140

    Server-Side Request Forgery vulnerability affecting DELMIA Apriso Release 2017 through Release 2022

    A Server-Side Request Forgery vulnerability in DELMIA Apriso Release 2017 through Release 2022 could allow an unauthenticated attacker to issue requests to arbitrary hosts on behalf of the server running the DELMIA Apriso application.

    Dassault Systèmes DELMIA Apriso
  • Medium 5.4
    CVE-2023-2139

    Reflected Cross-site Scripting vulnerability affecting DELMIA Apriso Release 2017 through Release 2022

    A reflected Cross-site Scripting (XSS) Vulnerability in DELMIA Apriso Release 2017 through Release 2022 allows an attacker to execute arbitrary script code.

    Dassault Systèmes DELMIA Apriso
  • Medium 6.8
    CVE-2023-1288

    ENOVIA Live Collaboration V6R2013xE is affected by an XML External Entity injection (XXE) vulnerability

    An XML External Entity injection (XXE) vulnerability in ENOVIA Live Collaboration V6R2013xE allows an attacker to read local files on the server.

    Dassault Systèmes ENOVIA Live Collaboration
  • Critical 9.0
    CVE-2023-1287

    ENOVIA Live Collaboration V6R2013xE is affected by an XSL template injection vulnerability

    An XSL template vulnerability in ENOVIA Live Collaboration V6R2013xE allows Remote Code Execution.

    Dassault Systèmes ENOVIA Live Collaboration