Codesys
Page 2 of 2 — Codesys CVEs from a corpus of 105, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-34585 | High | 7.5 | 2021-10-26 | In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests can trigger a parser error. Since the parser result is not checked under all condit… |
CVE-2021-34584 | Critical | 9.1 | 2021-10-26 | Crafted web server requests can be utilised to read partial stack or heap memory or may trigger a denial-of- service condition due to a crash in the CODESYS V2… |
CVE-2021-34583 | High | 7.5 | 2021-10-26 | Crafted web server requests may cause a heap-based buffer overflow and could therefore trigger a denial-of- service condition due to a crash in the CODESYS V2… |
CVE-2021-21869 | High | 7.8 | 2021-08-25 | An unsafe deserialization vulnerability exists in the Engine.plugin ProfileInformation ProfileData functionality of CODESYS GmbH CODESYS Development System 3.5… |
CVE-2021-21868 | High | 7.8 | 2021-08-18 | An unsafe deserialization vulnerability exists in the ObjectManager.plugin Project.get_MissingTypes() functionality of CODESYS GmbH CODESYS Development System… |
CVE-2021-21867 | High | 7.8 | 2021-08-18 | An unsafe deserialization vulnerability exists in the ObjectManager.plugin ObjectStream.ProfileByteArray functionality of CODESYS GmbH CODESYS Development Syst… |
CVE-2021-21863 | High | 7.8 | 2021-08-05 | A unsafe deserialization vulnerability exists in the ComponentModel Profile.FromFile() functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5… |
CVE-2021-36765 | High | 7.5 | 2021-08-04 | In CODESYS EtherNetIP before 4.1.0.0, specific EtherNet/IP requests may cause a null pointer dereference in the downloaded vulnerable EtherNet/IP stack that is… |
CVE-2021-36764 | High | 7.5 | 2021-08-04 | In CODESYS Gateway V3 before 3.5.17.10, there is a NULL Pointer Dereference. Crafted communication requests may cause a Null pointer dereference in the affecte… |
CVE-2021-36763 | High | 7.5 | 2021-08-03 | In CODESYS V3 web server before 3.5.17.10, files or directories are accessible to External Parties. |
CVE-2021-33486 | High | 7.5 | 2021-08-03 | All versions of the CODESYS V3 Runtime Toolkit for VxWorks from version V3.5.8.0 and before version V3.5.17.10 have Improper Handling of Exceptional Conditions. |
CVE-2021-33485 | Critical | 9.8 | 2021-08-03 | CODESYS Control Runtime system before 3.5.17.10 has a Heap-based Buffer Overflow. |
CVE-2021-21866 | High | 7.8 | 2021-08-02 | A unsafe deserialization vulnerability exists in the ObjectManager.plugin ProfileInformation.ProfileData functionality of CODESYS GmbH CODESYS Development Syst… |
CVE-2021-21865 | High | 7.8 | 2021-08-02 | A unsafe deserialization vulnerability exists in the PackageManagement.plugin ExtensionMethods.Clone() functionality of CODESYS GmbH CODESYS Development System… |
CVE-2021-21864 | High | 7.8 | 2021-08-02 | A unsafe deserialization vulnerability exists in the ComponentModel ComponentManager.StartupCultureSettings functionality of CODESYS GmbH CODESYS Development S… |
CVE-2021-30195 | High | 7.5 | 2021-05-25 | CODESYS V2 runtime system before 2.4.7.55 has Improper Input Validation. |
CVE-2021-30194 | Critical | 9.1 | 2021-05-25 | CODESYS V2 Web-Server before 1.1.9.20 has an Out-of-bounds Read. |
CVE-2021-30193 | Critical | 9.8 | 2021-05-25 | CODESYS V2 Web-Server before 1.1.9.20 has an Out-of-bounds Write. |
CVE-2021-30192 | Critical | 9.8 | 2021-05-25 | CODESYS V2 Web-Server before 1.1.9.20 has an Improperly Implemented Security Check. |
CVE-2021-30191 | High | 7.5 | 2021-05-25 | CODESYS V2 Web-Server before 1.1.9.20 has a a Buffer Copy without Checking the Size of the Input. |
CVE-2021-30190 | Critical | 9.8 | 2021-05-25 | CODESYS V2 Web-Server before 1.1.9.20 has Improper Access Control. |
CVE-2021-30189 | Critical | 9.8 | 2021-05-25 | CODESYS V2 Web-Server before 1.1.9.20 has a Stack-based Buffer Overflow. |
CVE-2021-30188 | Critical | 9.8 | 2021-05-25 | CODESYS V2 runtime system SP before 2.4.7.55 has a Stack-based Buffer Overflow. |
CVE-2021-30186 | High | 7.5 | 2021-05-25 | CODESYS V2 runtime system SP before 2.4.7.55 has a Heap-based Buffer Overflow. |
CVE-2021-30187 | Medium | 5.3 | 2021-05-25 | CODESYS V2 runtime system SP before 2.4.7.55 has Improper Neutralization of Special Elements used in an OS Command. |
CVE-2021-29240 | High | 7.8 | 2021-05-04 | The Package Manager of CODESYS Development System 3 before 3.5.17.0 does not check the validity of packages before installation and may be used to install CODE… |
CVE-2021-29242 | High | 7.3 | 2021-05-03 | CODESYS Control Runtime system before 3.5.17.0 has improper input validation. Attackers can send crafted communication packets to change the router's addressin… |
CVE-2021-29241 | High | 7.5 | 2021-05-03 | CODESYS Gateway 3 before 3.5.16.70 has a NULL pointer dereference that may result in a denial of service (DoS). |
CVE-2021-29239 | High | 7.8 | 2021-05-03 | CODESYS Development System 3 before 3.5.17.0 displays or executes malicious documents or files embedded in libraries without first checking their validity. |
CVE-2021-29238 | High | 8.8 | 2021-05-03 | CODESYS Automation Server before 1.16.0 allows cross-site request forgery (CSRF). |
CVE-2020-15806 | High | 7.5 | 2020-07-22 | CODESYS Control runtime system before 3.5.16.10 allows Uncontrolled Memory Allocation. |
CVE-2020-12068 | Medium | 6.5 | 2020-05-14 | An issue was discovered in CODESYS Development System before 3.5.16.0. CODESYS WebVisu and CODESYS Remote TargetVisu are susceptible to privilege escalation. |
CVE-2020-6081 | High | 8.8 | 2020-05-07 | An exploitable code execution vulnerability exists in the PLC_Task functionality of 3S-Smart Software Solutions GmbH CODESYS Runtime 3.5.14.30. A specially cra… |
CVE-2019-5105 | High | 7.5 | 2020-03-26 | An exploitable memory corruption vulnerability exists in the Name Service Client functionality of 3S-Smart Software Solutions CODESYS GatewayService. A special… |
CVE-2020-10245 | Critical | 9.8 | 2020-03-26 | CODESYS V3 web server before 3.5.15.40, as used in CODESYS Control runtime systems, has a buffer overflow. |
CVE-2020-7052 | Medium | 6.5 | 2020-01-24 | CODESYS Control V3, Gateway V3, and HMI V3 before 3.5.15.30 allow uncontrolled memory allocation which can result in a remote denial of service condition. |
CVE-2019-19789 | Medium | 6.5 | 2019-12-20 | 3S-Smart CODESYS SP Realtime NT before V2.3.7.28, CODESYS Runtime Toolkit 32 bit full before V2.4.7.54, and CODESYS PLCWinNT before V2.4.7.54 allow a NULL poin… |
CVE-2019-18858 | Critical | 9.8 | 2019-11-20 | CODESYS 3 web server before 3.5.15.20, as distributed with CODESYS Control runtime systems, has a Buffer Overflow. |
CVE-2019-16265 | Critical | 9.8 | 2019-10-25 | CODESYS V2.3 ENI server up to V3.2.2.24 has a Buffer Overflow. |
CVE-2019-13538 | High | 8.6 | 2019-09-17 | 3S-Smart Software Solutions GmbH CODESYS V3 Library Manager, all versions prior to 3.5.16.0, allows the system to display active library content without checki… |
CVE-2019-13542 | Medium | 6.5 | 2019-09-17 | 3S-Smart Software Solutions GmbH CODESYS V3 OPC UA Server, all versions 3.5.11.0 to 3.5.15.0, allows an attacker to send crafted requests from a trusted OPC UA… |
CVE-2019-9009 | High | 7.5 | 2019-09-17 | An issue was discovered in 3S-Smart CODESYS before 3.5.15.0 . Crafted network packets cause the Control Runtime to crash. |
CVE-2019-9008 | High | 8.8 | 2019-09-17 | An issue was discovered in 3S-Smart CODESYS V3 through 3.5.12.30. A user with low privileges can take full control over the runtime. |
CVE-2019-13548 | Critical | 9.8 | 2019-09-13 | CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which could cause a stack overflow… |
CVE-2019-13532 | High | 7.5 | 2019-09-13 | CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which may allow access to files out… |
CVE-2019-9012 | High | 7.5 | 2019-08-15 | An issue was discovered in 3S-Smart CODESYS V3 products. A crafted communication request may cause uncontrolled memory allocations in the affected CODESYS prod… |
CVE-2019-9010 | Critical | 9.8 | 2019-08-15 | An issue was discovered in 3S-Smart CODESYS V3 products. The CODESYS Gateway does not correctly verify the ownership of a communication channel. All variants o… |
CVE-2019-9013 | High | 8.8 | 2019-08-15 | An issue was discovered in 3S-Smart CODESYS V3 products. The application may utilize non-TLS based encryption, which results in user credentials being insuffic… |
CVE-2018-20026 | High | 7.5 | 2019-02-19 | Improper Communication Address Filtering exists in CODESYS V3 products versions prior V3.5.14.0. |
CVE-2018-20025 | High | 7.5 | 2019-02-19 | Use of Insufficiently Random Values exists in CODESYS V3 products versions prior V3.5.14.0. |
CVE-2018-10612 | Critical | 9.8 | 2019-01-29 | In 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0, user access management and communication encryption is not enabled b… |
CVE-2017-6027 | Critical | 9.8 | 2017-05-19 | An Arbitrary File Upload issue was discovered in 3S-Smart Software Solutions GmbH CODESYS Web Server. The following versions of CODESYS Web Server, part of the… |
CVE-2017-6025 | Critical | 9.8 | 2017-05-19 | A Stack Buffer Overflow issue was discovered in 3S-Smart Software Solutions GmbH CODESYS Web Server. The following versions of CODESYS Web Server, part of the… |
CVE-2015-6460 | | 2015-09-18 | Multiple heap-based buffer overflows in 3S-Smart CODESYS Gateway Server before 2.3.9.34 allow remote attackers to execute arbitrary code via opcode (1) 0x3ef o… |