Vulnerabilities (CVE)

Join the Common Vulnerabilities and Exposures (CVE) community and start to get notified about new vulnerabilities.

Filtered by vendor Mitsubishielectric Subscribe
Filtered by product Mc Works64
Total 13 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2022-33315 2 Iconics, Mitsubishielectric 2 Genesis64, Mc Works64 2022-07-27 N/A 7.8 HIGH
Deserialization of Untrusted Data vulnerability in ICONICS GENESIS64 versions 10.97.1 and prior and Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior allows an unauthenticated attacker to execute an arbitrary malicious code by leading a user to load a monitoring screen file including malicious XAML codes.
CVE-2022-33316 2 Iconics, Mitsubishielectric 2 Genesis64, Mc Works64 2022-07-27 N/A 7.8 HIGH
Deserialization of Untrusted Data vulnerability in ICONICS GENESIS64 versions 10.97.1 and prior and Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior allows an unauthenticated attacker to execute an arbitrary malicious code by leading a user to load a monitoring screen file including malicious XAML codes.
CVE-2022-33317 2 Iconics, Mitsubishielectric 2 Genesis64, Mc Works64 2022-07-27 N/A 7.8 HIGH
Inclusion of Functionality from Untrusted Control Sphere vulnerability in ICONICS GENESIS64 versions 10.97.1 and prior and Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior allows an unauthenticated attacker to execute an arbitrary malicious code by leading a user to load a monitoring screen file including malicious script codes.
CVE-2022-33318 2 Iconics, Mitsubishielectric 2 Genesis64, Mc Works64 2022-07-27 N/A 9.8 CRITICAL
Deserialization of Untrusted Data vulnerability in ICONICS GENESIS64 versions 10.97.1 and prior and Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior allows a remote unauthenticated attacker to execute an arbitrary malicious code by sending specially crafted packets to the GENESIS64 server.
CVE-2022-33319 2 Iconics, Mitsubishielectric 2 Genesis64, Mc Works64 2022-07-27 N/A 9.1 CRITICAL
Out-of-bounds Read vulnerability in ICONICS GENESIS64 versions 10.97.1 and prior and Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior allows a remote unauthenticated attacker to disclose information on memory or cause a Denial of Service (DoS) condition by sending specially crafted packets to the GENESIS64 server.
CVE-2022-33320 2 Iconics, Mitsubishielectric 2 Genesis64, Mc Works64 2022-07-27 N/A 7.8 HIGH
Deserialization of Untrusted Data vulnerability in ICONICS GENESIS64 versions 10.97.1 and prior and Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior allows an unauthenticated attacker to execute an arbitrary malicious code by leading a user to load a project configuration file including malicious XML codes.
CVE-2021-27041 3 Autodesk, Iconics, Mitsubishielectric 13 Advance Steel, Autocad, Autocad Architecture and 10 more 2022-05-13 6.8 MEDIUM 7.8 HIGH
A maliciously crafted DWG file can be used to write beyond the allocated buffer while parsing DWG files. This vulnerability can be exploited to execute arbitrary code
CVE-2021-27040 3 Autodesk, Iconics, Mitsubishielectric 13 Advance Steel, Autocad, Autocad Architecture and 10 more 2022-05-13 4.3 MEDIUM 3.3 LOW
A maliciously crafted DWG file can be forced to read beyond allocated boundaries when parsing the DWG file. This vulnerability can be exploited to execute arbitrary code.
CVE-2022-23130 2 Iconics, Mitsubishielectric 3 Genesis64, Hyper Historian, Mc Works64 2022-01-27 4.3 MEDIUM 5.5 MEDIUM
Buffer Over-read vulnerability in Mitsubishi Electric MC Works64 versions 4.00A (10.95.201.23) to 4.04E (10.95.210.01), ICONICS GENESIS64 versions 10.97 and prior and ICONICS Hyper Historian versions 10.97 and prior allows an attacker to cause a DoS condition in the database server by getting a legitimate user to import a configuration file containing specially crafted stored procedures into GENESIS64 or MC Works64 and execute commands against the database from GENESIS64 or MC Works64.
CVE-2022-23128 2 Iconics, Mitsubishielectric 5 Analytix, Genesis64, Hyper Historian and 2 more 2022-01-27 7.5 HIGH 9.8 CRITICAL
Incomplete List of Disallowed Inputs vulnerability in Mitsubishi Electric MC Works64 versions 4.00A (10.95.201.23) to 4.04E (10.95.210.01), ICONICS GENESIS64 versions 10.95.3 to 10.97, ICONICS Hyper Historian versions 10.95.3 to 10.97, ICONICS AnalytiX versions 10.95.3 to 10.97 and ICONICS MobileHMI versions 10.95.3 to 10.97 allows a remote unauthenticated attacker to bypass the authentication of MC Works64, GENESIS64, Hyper Historian, AnalytiX and MobileHMI, and gain unauthorized access to the products, by sending specially crafted WebSocket packets to FrameWorX server, one of the functions of the products.
CVE-2022-23129 2 Iconics, Mitsubishielectric 2 Genesis64, Mc Works64 2022-01-27 2.1 LOW 5.5 MEDIUM
Plaintext Storage of a Password vulnerability in Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior and ICONICS GENESIS64 versions 10.90 to 10.97 allows a local authenticated attacker to gain authentication information and to access the database illegally. This is because when configuration information of GridWorX, a database linkage function of GENESIS64 and MC Works64, is exported to a CSV file, the authentication information is saved in plaintext, and an attacker who can access this CSV file can gain the authentication information.
CVE-2022-23127 2 Iconics, Mitsubishielectric 2 Mobilehmi, Mc Works64 2022-01-27 4.3 MEDIUM 6.1 MEDIUM
Cross-site Scripting vulnerability in Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior and ICONICS MobileHMI versions 10.96.2 and prior allows a remote unauthenticated attacker to gain authentication information of an MC Works64 or MobileHMI and perform any operation using the acquired authentication information, by injecting a malicious script in the URL of a monitoring screen delivered from the MC Works64 server or MobileHMI server to an application for mobile devices and leading a legitimate user to access this URL.
CVE-2020-12013 2 Iconics, Mitsubishielectric 11 Bizviz, Energy Analytix, Facility Analytix and 8 more 2021-11-04 6.4 MEDIUM 9.1 CRITICAL
A specially crafted WCF client that interfaces to the may allow the execution of certain arbitrary SQL commands remotely. This affects: Mitsubishi Electric MC Works64 Version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 Version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server v10.96 and prior; ICONICS GenBroker32 v9.5 and prior.