Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

16 records

Vendor: B&R Industrial Automation Component: Industrial Automation Aprol Clear all filters
TI-2024-05221 CVE-2024-5624 · GHSA-8423-fqh5-4pfr

Cross-site scripting in B&R APROL

Priority LOW 23

Reflected Cross-Site Scripting (XSS) in Shift Logbook application of B&R APROL <= R 4.4-00P3 may allow a network-based attacker to execute arbitrary JavaScript code in the context of the user's browser session

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00253 Published 2024-08-29 No fix listed CWE-79
TI-2024-05220 CVE-2024-5623 · GHSA-mvj8-h6fp-pcrp

Untrusted search path vulnerability in B&R APROL

Priority LOW 26

An untrusted search path vulnerability in B&R APROL <= R 4.4-00P3 may be used by an authenticated local attacker to get other users to execute arbitrary code under their privileges.

CVSS 4.0MEDIUM 5.4 Local Low privileges User interaction EPSS 0.00168 Published 2024-08-29 No fix listed CWE-250
TI-2024-05219 CVE-2024-5622 · GHSA-364p-86w3-x6rv

Untrusted search path vulnerability in the AprolConfigureCCServices of B&R APROL

Priority LOW 33

An untrusted search path vulnerability in the AprolConfigureCCServices of B&R APROL <= R 4.2.-07P3 and <= R 4.4-00P3 may allow an authenticated local attacker to execute arbitrary code with elevated privileges.

CVSS 4.0HIGH 7.3 Local Low privileges No interaction EPSS 0.00168 Published 2024-08-29 No fix listed CWE-250
TI-2022-21499 CVE-2022-43765 · GHSA-9fr2-r98v-qc2f

DoS in APROLs Tbase server

Priority MEDIUM 40

B&R APROL versions < R 4.2-07 doesn’t process correctly specially formatted data packages sent to port 55502/tcp, which may allow a network based attacker to cause an application Denial-of-Service.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00616 Published 2023-02-08 No fix listed CWE-252
TI-2022-21498 CVE-2022-43764 · GHSA-pmw8-p4g8-wr53

Buffer overflow when changing configuration on Tbase Server

Priority MEDIUM 50

Insufficient validation of input parameters when changing configuration on Tbase server in B&R APROL versions < R 4.2-07 could result in buffer overflow.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00776 Published 2023-02-08 No fix listed CWE-121
TI-2022-21497 CVE-2022-43763 · GHSA-x3q4-892x-xrc9

Lack of checking preconditions in APROL

Priority MEDIUM 40

Insufficient check of preconditions could lead to Denial of Service conditions when calling commands on the Tbase server of B&R APROL versions < R 4.2-07.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00616 Published 2023-02-08 No fix listed CWE-252
TI-2022-21496 CVE-2022-43762 · GHSA-56vg-qgwv-6h64

Memory leak when receiving messages in APROL Tbase server

Priority MEDIUM 49

Lack of verification in B&R APROL Tbase server versions < R 4.2-07 may lead to memory leaks when receiving messages

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00619 Published 2023-02-08 No fix listed CWE-119
TI-2022-21495 CVE-2022-43761 · GHSA-p9q7-pf62-483h

Lack of authentication when managing APROL database

Priority MEDIUM 49

Missing authentication when creating and managing the B&R APROL database in versions < R 4.2-07 allows reading and changing the system configuration.

CVSS 3.1CRITICAL 9.4 Network No auth No interaction EPSS 0.00551 Published 2023-02-08 No fix listed CWE-306