Ignition vulnerabilities

19 known vulnerabilities in Ignition from Inductiveautomation. 19 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

19vulnerabilities

4critical

15high

0exploited

8.7average CVSS score

Latest first

8.8 High severity
Ignition: Improper Limitation of a Pathname to a Restricted Directory
CVE-2023-50233May 3, 2024Inductive AutomationEPSS 2.08%
Inductive Automation Ignition getJavaExecutable Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. User interaction is requir
8.8 High severity
Ignition: Improper Neutralization of Argument Delimiters in a Command
CVE-2023-50232May 3, 2024Inductive AutomationEPSS 1.39%
Inductive Automation Ignition getParams Argument Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. User interaction is required to exp
8.8 High severity
Ignition: Deserialization of Untrusted Data
CVE-2023-50223May 3, 2024Inductive AutomationEPSS 54.9%
Inductive Automation Ignition ExtendedDocumentCodec Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authenti
8.8 High severity
Ignition: Deserialization of Untrusted Data
CVE-2023-50222May 3, 2024Inductive AutomationEPSS 1.15%
Inductive Automation Ignition ResponseParser Notification Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Us
8.8 High severity
Ignition: Deserialization of Untrusted Data
CVE-2023-50221May 3, 2024Inductive AutomationEPSS 1.15%
Inductive Automation Ignition ResponseParser SerializedResponse Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Igniti
8.8 High severity
Ignition: Deserialization of Untrusted Data
CVE-2023-50220May 3, 2024Inductive AutomationEPSS 1.85%
Inductive Automation Ignition Base64Element Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authentication i
8.8 High severity
Ignition: Deserialization of Untrusted Data
CVE-2023-50219May 3, 2024Inductive AutomationEPSS 1.5%
Inductive Automation Ignition RunQuery Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authentication is req
8.8 High severity
Ignition: Deserialization of Untrusted Data
CVE-2023-50218May 3, 2024Inductive AutomationEPSS 55%
Inductive Automation Ignition ModuleInvoke Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authentication is
7.5 High severity
Ignition: Uncontrolled Resource Consumption
CVE-2023-39477May 3, 2024Inductive AutomationEPSS 1.54%
Inductive Automation Ignition ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Inductive Automation Ignition. Authentication is
9.8 Critical severity
Ignition: Deserialization of Untrusted Data
CVE-2023-39476May 3, 2024Inductive AutomationEPSS 2.23%
Inductive Automation Ignition JavaSerializationCodec Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authent
9.8 Critical severity
Ignition: Deserialization of Untrusted Data
CVE-2023-39475May 3, 2024Inductive AutomationEPSS 64.1%
Inductive Automation Ignition ParameterVersionJavaSerializationCodec Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation I
8.8 High severity
Ignition: Download of Code Without Integrity Check
CVE-2023-39474May 3, 2024Inductive Automation
Inductive Automation Ignition downloadLaunchClientJar Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. User interaction is required to exploit
8.8 High severity
Ignition: Deserialization of Untrusted Data
CVE-2023-39473May 3, 2024Inductive AutomationEPSS 62.5%
Inductive Automation Ignition AbstractGatewayFunction Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authen
8.8 High severity
Ignition: Exposed Dangerous Method or Function
CVE-2023-38124May 3, 2024Inductive AutomationEPSS 59.6%
Inductive Automation Ignition OPC UA Quick Client Task Scheduling Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. A
8.8 High severity
Ignition: Missing Authentication for Critical Functionality
CVE-2023-38123May 3, 2024Inductive AutomationEPSS 1.17%
Inductive Automation Ignition OPC UA Quick Client Missing Authentication for Critical Function Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Inductive Automation Ignition.
7.2 High severity
Ignition: Permissive Cross-domain Security Policy with Untrusted Domains
CVE-2023-38122May 3, 2024Inductive AutomationEPSS 1.88%
Inductive Automation Ignition OPC UA Quick Client Permissive Cross-domain Policy Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Although auth
9.0 Critical severity
Ignition: Improper Neutralization of Input During Web Page Generation
CVE-2023-38121May 3, 2024Inductive AutomationEPSS 1.24%
Inductive Automation Ignition OPC UA Quick Client Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. User interaction is req
7.2 High severity
Ignition: Incorrect Authorization
CVE-2022-36126Jul 16, 2022InductiveautomationEPSS 2.68%
An issue was discovered in Inductive Automation Ignition before 7.9.20 and 8.x before 8.1.17. The ScriptInvoke function allows remote attackers to execute arbitrary code by supplying a Python script.
9.8 Critical severity
Ignition: Incorrect Authorization
CVE-2022-35890Jul 15, 2022InductiveautomationEPSS 1.97%
An issue was discovered in Inductive Automation Ignition before 7.9.20 and 8.x before 8.1.17. Designer and Vision Client Session IDs are mishandled. An attacker can determine which session IDs were generated in the past and then hijack sessions assigned to the