Muffin

This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The flaw exists within the parsing of APP files due to the lack of proper validation of user-supplied data, resulting in deserialization of untrusted data. An attacker can leverage this to execute code in the context of the current process.

An issue was discovered in Inductive Automation Ignition that allows remote attackers to execute arbitrary code by supplying a Python script using the `ScriptInvoke` function.

This issue allows remote attackers to execute arbitrary code on affected installations. Although authentication is required to exploit this issue, the existing authentication mechanism can be bypassed. The specific flaw exists within the Restore Workspace feature, resulting from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this issue to execute code in the context of SYSTEM.

The parsing mechanism that processes certain file types does not provide input sanitation, which may allow an attacker to use specially crafted files to traverse the file system, modify or expose sensitive data, or execute arbitrary code.

This issue allows remote attackers to create a denial-of-service condition on affected installations. Authentication is not required to exploit this issue. The specific flaw exists within the handling of sessions, resulting from the lack of proper locking when performing operations on an object. An attacker can leverage this issue to create a denial-of-service condition against the application.