Sergey Temnikov

O problema ocorre quando o analisador XML do Apache Xerces Java (XercesJ) processa cargas de documentos XML especialmente criadas para o efeito, fazendo com que entre em um loop infinito. Esse loop pode consumir recursos do sistema por um período prolongado.

O problema está relacionado a uma vulnerabilidade de validação inadequada de entrada no Parquet-MR do Apache Parquet, permitindo que um invasor execute um ataque de negação de serviço (DoS) usando arquivos Parquet maliciosos.

The issue is related to insufficient input validation, allowing an attacker with access to the project file to execute arbitrary system commands with the privileges of the local database server. This could impact the confidentiality, integrity, and availability of the affected system. At the time of advisory publication, no public exploitation of this security issue was known.

A specially crafted script may be run, allowing arbitrary remote code execution.

The issue allows non-administrative users to modify executable and library files on the affected products.

An attacker with network access to the ClearSCADA server can send specially crafted sequences of commands and data packets to the ClearSCADA server, causing the ClearSCADA server process and ClearSCADA communications driver processes to terminate.

The issue is related to a factory account with hard-coded passwords in SICAM PAS installations. This could allow attackers to gain privileged access to the database over Port 2638/TCP. The vulnerability might be exploited by a remote attacker to obtain privileged access to the database.

The issue allows remote attackers to execute arbitrary SQL commands via crafted traffic to the TCP port 4410. This can be achieved by sending malicious input to the affected system, potentially leading to unauthorized data access or modification.

The issue allows remote attackers to cause a denial of service, resulting in an ALM service outage, by sending crafted packets to TCP port 4410.

The issue allows remote attackers to perform unauthorized file system modifications, including writing to files, renaming files, creating directories, or deleting directories, by sending crafted packets.

The issue allows remote attackers to cause a denial of service, specifically an OPC UA service outage, by sending crafted TCP packets.