Arcinfo Pcvue
24 CVEs affecting Arcinfo Pcvue. Latest disclosed: 2026-07-07. Critical: 1, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-26867 | Critical | 9.8 | 2020-10-12 | ARC Informatique PcVue prior to version 12.0.17 is vulnerable due to the deserialization of untrusted data, which may allow an attacker to remotely execute arb… |
CVE-2026-1693 | High | 7.5 | 2026-02-26 | The OAuth grant type Resource Owner Password Credentials (ROPC) flow is still used by the werbservices used by the WebVue, WebScheduler, TouchVue and Snapvue f… |
CVE-2020-26869 | High | 7.5 | 2020-10-12 | ARC Informatique PcVue prior to version 12.0.17 is vulnerable to information exposure, allowing unauthorized users to access session data of legitimate users… |
CVE-2020-26868 | High | 7.5 | 2020-10-12 | ARC Informatique PcVue prior to version 12.0.17 is vulnerable to a denial-of-service attack due to the ability of an unauthorized user to modify information us… |
CVE-2026-1697 | Medium | 6.5 | 2026-02-26 | The Secure and SameSite attribute are missing in the GraphicalData web services and WebClient web app of PcVue in version 12.0.0 through 16.3.3 included. |
CVE-2026-1698 | Medium | 6.1 | 2026-02-26 | A HTTP Host header attack vulnerability affects WebClient and the WebScheduler web apps of PcVue in version 15.0.0 through 16.3.3 included, allowing a remote a… |
CVE-2026-1696 | Medium | 6.1 | 2026-02-26 | Some HTTP security headers are not properly set by the web server when sending responses to the client application. |
CVE-2026-1695 | Medium | 6.1 | 2026-02-26 | An XSS vulnerability affects the OAuth web services used by the WebVue, WebScheduler, TouchVue and SnapVue features of PcVue in version 12.0.0 through 16.3.3 i… |
CVE-2026-1692 | Medium | 6.1 | 2026-02-26 | A missing origin validation in WebSockets vulnerability affects the GraphicalData web services used by the WebVue, WebScheduler, TouchVue and SnapVue features… |
CVE-2026-14868 | Medium | 5.5 | 2026-07-07 | The encryption algorithm used to protect the configuration of user accounts, stored in the built-in user directory of PcVue projects, all versions prior to 17… |
CVE-2026-14867 | Medium | 5.5 | 2026-07-07 | Credentials of built-in users are insecurely stored in the User directory of PcVue projects, all versions prior to 17.0.0. A local attacker could retrieve user… |
CVE-2022-4312 | Medium | 5.5 | 2022-12-12 | A cleartext storage of sensitive information vulnerability exists in PcVue versions 8.10 through 15.2.3. This could allow an unauthorized user with access the… |
CVE-2022-2569 | Medium | 5.5 | 2022-08-24 | The affected device stores sensitive information in cleartext, which may allow an authenticated user to access session data stored in the OAuth database belong… |
CVE-2022-4311 | Medium | 4.7 | 2022-12-12 | An insertion of sensitive information into log file vulnerability exists in PcVue versions 15 through 15.2.2. This could allow a user with access to the log f… |
CVE-2026-1694 | Medium | 4.3 | 2026-02-26 | HTTP headers are added by the default configuration of IIS and ASP.net, and are not removed at the deployment phase of the webservices used by the WebVue, WebS… |
CVE-2025-9999 | | 2025-09-05 | Some payload elements of the messages sent between two stations in a networking architecture are not properly checked on the receiving station allowing an atta… | |
CVE-2025-9998 | | 2025-09-05 | The sequence of packets received by a Networking server are not correctly checked. An attacker could exploit this vulnerability to send specially crafted mess… | |
CVE-2025-4384 | | 2025-05-06 | The MQTT add-on of PcVue fails to verify that a remote device’s certificate has not already expired or has not yet become valid. This allows malicious devices… | |
CVE-2024-12057 | | 2024-12-09 | User credentials (login & password) are inserted into log files when a user tries to authenticate using a version of a Web client that is not compatible with t… | |
CVE-2024-12056 | | 2024-12-04 | The Client secret is not checked when using the OAuth Password grant type. By exploiting this vulnerability, an attacker could connect to a web server using a… |