OAS Platform vulnerabilities

12 known vulnerabilities in OAS Platform from Open Automation Software. 12 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  OAS Platform: Improper Authentication

  CVE-2023-34998Sep 5, 2023Open Automation SoftwareEPSS 1.2%

  An authentication bypass vulnerability exists in the OAS Engine functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted series of network requests can lead to arbitrary authentication. An attacker can sniff network traffic to tr

• 7.5 High severity

  OAS Platform: Use of Insufficiently Random Values

  CVE-2023-34353Sep 5, 2023Open Automation SoftwareEPSS 1.21%

  An authentication bypass vulnerability exists in the OAS Engine authentication functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted network sniffing can lead to decryption of sensitive information. An attacker can sniff netwo

• 8.1 High severity

  OAS Platform: Externally Controlled Reference to a Resource in Another Sphere

  CVE-2023-32615Sep 5, 2023Open Automation Software

  A file write vulnerability exists in the OAS Engine configuration functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted series of network requests can lead to arbitrary file creation or overwrite. An attacker can send a sequen

• 9.8 Critical severity

  OAS Platform: Improper Authentication

  CVE-2023-31242Sep 5, 2023Open Automation SoftwareEPSS 3.48%

  An authentication bypass vulnerability exists in the OAS Engine functionality of Open Automation Software OAS Platform v18.00.0072. A specially-crafted series of network requests can lead to arbitrary authentication. An attacker can send a sequence of requests

• 7.5 High severity

  OAS Platform: Missing Authentication for Critical Functionality

  CVE-2022-27169May 25, 2022Open Automation SoftwareEPSS 1.74%

  An information disclosure vulnerability exists in the OAS Engine SecureBrowseFile functionality of Open Automation Software OAS Platform V16.00.0112. A specially-crafted network request can lead to a disclosure of sensitive information. An attacker can send a

• 9.4 Critical severity

  OAS Platform: Missing Authentication for Critical Functionality

  CVE-2022-26833May 25, 2022Open Automation SoftwareEPSS 37.6%

  An improper authentication vulnerability exists in the REST API functionality of Open Automation Software OAS Platform V16.00.0121. A specially-crafted series of HTTP requests can lead to unauthenticated use of the REST API. An attacker can send a series of HT

• 7.5 High severity

  OAS Platform: Missing Authentication for Critical Functionality

  CVE-2022-26303May 25, 2022Open Automation SoftwareEPSS 1.28%

  An external config control vulnerability exists in the OAS Engine SecureAddUser functionality of Open Automation Software OAS Platform V16.00.0112. A specially-crafted series of network requests can lead to the creation of an OAS user account. An attacker can

• 9.8 Critical severity

  OAS Platform: Missing Authentication for Critical Functionality

  CVE-2022-26082May 25, 2022Open Automation SoftwareEPSS 20.1%

  A file write vulnerability exists in the OAS Engine SecureTransferFiles functionality of Open Automation Software OAS Platform V16.00.0112. A specially-crafted series of network requests can lead to remote code execution. An attacker can send a sequence of req

• 7.5 High severity

  OAS Platform: Cleartext Transmission of Sensitive Information

  CVE-2022-26077May 25, 2022Open Automation SoftwareEPSS 1.16%

  A cleartext transmission of sensitive information vulnerability exists in the OAS Engine configuration communications functionality of Open Automation Software OAS Platform V16.00.0112. A targeted network sniffing attack can lead to a disclosure of sensitive i

• 7.5 High severity

  OAS Platform: Missing Authentication for Critical Functionality

  CVE-2022-26067May 25, 2022Open Automation SoftwareEPSS 1.36%

  An information disclosure vulnerability exists in the OAS Engine SecureTransferFiles functionality of Open Automation Software OAS Platform V16.00.0112. A specially-crafted series of network requests can lead to arbitrary file read. An attacker can send a sequ

• 7.5 High severity

  OAS Platform: Missing Authentication for Critical Functionality

  CVE-2022-26043May 25, 2022Open Automation SoftwareEPSS 1.28%

  An external config control vulnerability exists in the OAS Engine SecureAddSecurity functionality of Open Automation Software OAS Platform V16.00.0112. A specially-crafted series of network requests can lead to the creation of a custom Security Group. An attac

• 7.5 High severity

  OAS Platform: Missing Authentication for Critical Functionality

  CVE-2022-26026May 25, 2022Open Automation SoftwareEPSS 1.22%

  A denial of service vulnerability exists in the OAS Engine SecureConfigValues functionality of Open Automation Software OAS Platform V16.00.0112. A specially-crafted network request can lead to loss of communications. An attacker can send a network request to