Description
Cross-site scripting (XSS) vulnerability in Invensys Wonderware HMI Reports 3.42.835.0304 and earlier, as used in Ocean Data Systems Dream Report before 4.0 and other products, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
Advisories 1
- ICSA-12-024-01 Ocean Data Systems Dream Reports XSS and Write Access Violation Vulnerabilities CISA ICS & IT advisories · Jun 9, 2025
References
- http://www.us-cert.gov/control_systems/pdf/ICSA-12-024-01.pdf
- http://www.us-cert.gov/control_systems/pdf/ICSA-12-039-01.pdf
- 47742 third-party-advisory
- 47933 third-party-advisory