Export limit exceeded: 389165 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (81 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-81824 | 1 Aveva | 1 Pipeline Integrity Monitor | 2026-09-08 | 4.7 Medium |
| The vulnerability, if exploited, could allow a miscreant to run arbitrary JavaScript code in a browser session of a PIMBoards user who was socially engineered to click on a malicious link. | ||||
| CVE-2026-81823 | 1 Aveva | 1 Pipeline Integrity Monitor | 2026-09-08 | 5.3 Medium |
| The vulnerability, if exploited, could allow an unauthenticated miscreant to perform read operations intended only for PIMBoards users, resulting in information disclosure. Write operations are not impacted. | ||||
| CVE-2026-81822 | 1 Aveva | 1 Pipeline Integrity Monitor | 2026-09-08 | 8.4 High |
| The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to reverse engineer PIMBoards users’ app-native passwords through computational brute-forcing of weak hashes, potentially allowing elevation to a PIMBoards administrator user. | ||||
| CVE-2026-81821 | 1 Aveva | 1 Pipeline Integrity Monitor | 2026-09-08 | 8.4 High |
| The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to decrypt and view sensitive information. | ||||
| CVE-2025-7639 | 1 Aveva | 6 Aveva Enterprise Scada, Aveva Enterprise Scada Hmi, Aveva Pipeline Integrity Monitor (delivered On Pipeline Simulation Media) and 3 more | 2026-08-17 | 7.1 High |
| The vulnerability, if exploited, could allow an authenticated miscreant with "DNA Authority - Operator" privilege to tamper with serialized data, potentially resulting in code execution during deserialization under the privilege of Enterprise SCADA security group "DNA Apps". | ||||
| CVE-2026-1495 | 1 Aveva | 1 Pi To Connect Agent | 2026-04-18 | 6.5 Medium |
| The vulnerability, if exploited, could allow an attacker with Event Log Reader (S-1-5-32-573) privileges to obtain proxy details, including URL and proxy credentials, from the PI to CONNECT event log files. This could enable unauthorized access to the proxy server. | ||||
| CVE-2026-1507 | 1 Aveva | 1 Pi Data Archive Pi Server | 2026-04-17 | 7.5 High |
| The affected products are vulnerable to an uncaught exception that could allow an unauthenticated attacker to remotely crash core PI services resulting in a denial-of-service. | ||||
| CVE-2026-5387 | 1 Aveva | 1 Pipeline Simulation 2025 | 2026-04-17 | N/A |
| The vulnerability, if exploited, could allow an unauthenticated miscreant to perform operations intended only for Simulator Instructor or Simulator Developer (Administrator) roles, resulting in privilege escalation with potential for modification of simulation parameters, training configuration, and training records. | ||||
| CVE-2024-6619 | 2 Aveva, Ocean Data Systems | 2 Reports For Operations 2023, Dream Report 2023 | 2026-04-15 | N/A |
| In Ocean Data Systems Dream Report, an incorrect permission vulnerability could allow a local unprivileged attacker to escalate their privileges and could cause a denial-of-service. | ||||
| CVE-2024-6456 | 1 Aveva | 1 Historian | 2026-04-15 | N/A |
| AVEVA Historian Server has a vulnerability, if exploited, could allow a malicious SQL command to execute under the privileges of an interactive Historian REST Interface user who had been socially engineered by a miscreant into opening a specially crafted URL. | ||||
| CVE-2025-9317 | 1 Aveva | 1 Edge | 2026-04-15 | 8.4 High |
| The vulnerability, if exploited, could allow a miscreant with read access to Edge Project files or Edge Offline Cache files to reverse engineer Edge users' app-native or Active Directory passwords through computational brute-forcing of weak hashes. | ||||
| CVE-2025-8386 | 1 Aveva | 1 Application Server | 2026-04-15 | 6.9 Medium |
| The vulnerability, if exploited, could allow an authenticated miscreant (with privilege of "aaConfigTools") to tamper with App Objects' help files and persist a cross-site scripting (XSS) injection that when executed by a victim user, can result in horizontal or vertical escalation of privileges. The vulnerability can only be exploited during config-time operations within the IDE component of Application Server. Run-time components and operations are not affected. | ||||
| CVE-2024-6618 | 2 Aveva, Ocean Data Systems | 2 Reports For Operations 2023, Dream Report 2023 | 2026-04-15 | N/A |
| In Ocean Data Systems Dream Report, a path traversal vulnerability could allow an attacker to perform remote code execution through the injection of a malicious dynamic-link library (DLL). | ||||
| CVE-2025-61937 | 1 Aveva | 1 Process Optimization | 2026-01-22 | 10 Critical |
| The vulnerability, if exploited, could allow an unauthenticated miscreant to achieve remote code execution under OS system privileges of “taoimr” service, potentially resulting in complete compromise of the model application server. | ||||
| CVE-2025-61943 | 1 Aveva | 2 Historian, Process Optimization | 2026-01-22 | 8.4 High |
| The vulnerability, if exploited, could allow an authenticated miscreant (Process Optimization Standard User) to tamper with queries in Captive Historian and achieve code execution under SQL Server administrative privileges, potentially resulting in complete compromise of the SQL Server. | ||||
| CVE-2025-64691 | 1 Aveva | 1 Process Optimization | 2026-01-22 | 8.8 High |
| The vulnerability, if exploited, could allow an authenticated miscreant (OS standard user) to tamper with TCL Macro scripts and escalate privileges to OS system, potentially resulting in complete compromise of the model application server. | ||||
| CVE-2025-64729 | 1 Aveva | 1 Process Optimization | 2026-01-22 | 8.1 High |
| The vulnerability, if exploited, could allow an authenticated miscreant (OS Standard User) to tamper with Process Optimization project files, embed code, and escalate their privileges to the identity of a victim user who subsequently interacts with the project files. | ||||
| CVE-2025-65117 | 1 Aveva | 1 Process Optimization | 2026-01-22 | 7.4 High |
| The vulnerability, if exploited, could allow an authenticated miscreant (Process Optimization Designer User) to embed OLE objects into graphics, and escalate their privileges to the identity of a victim user who subsequently interacts with the graphical elements. | ||||
| CVE-2025-65118 | 1 Aveva | 2 Application Server, Process Optimization | 2026-01-22 | 8.8 High |
| The vulnerability, if exploited, could allow an authenticated miscreant (OS Standard User) to trick Process Optimization services into loading arbitrary code and escalate privileges to OS System, potentially resulting in complete compromise of the Model Application Server. | ||||
| CVE-2025-64769 | 1 Aveva | 1 Process Optimization | 2026-01-22 | 7.1 High |
| The Process Optimization application suite leverages connection channels/protocols that by-default are not encrypted and could become subject to hijacking or data leakage in certain man-in-the-middle or passive inspection scenarios. | ||||