Search Results (Refine Search)
- Results Type: Overview
- Keyword (text search): niagara
- Search Type: Search All
- CPE Name Search: false
Vuln ID | Summary | CVSS Severity |
---|---|---|
CVE-2024-1309 |
Uncontrolled Resource Consumption vulnerability in Honeywell Niagara Framework on Windows, Linux, QNX allows Content Spoofing.This issue affects Niagara Framework: before Niagara AX 3.8.1, before Niagara 4.1. Published: February 13, 2024; 9:15:46 AM -0500 |
V3.x:(not available) V2.0:(not available) |
CVE-2020-14483 |
A timeout during a TLS handshake can result in the connection failing to terminate. This can result in a Niagara thread hanging and requires a manual restart of Niagara (Versions 4.6.96.28, 4.7.109.20, 4.7.110.32, 4.8.0.110) and Niagara Enterprise Security (Versions 2.4.31, 2.4.45, 4.8.0.35) to correct. Published: August 13, 2020; 11:15:12 AM -0400 |
V3.1: 4.3 MEDIUM V2.0: 3.3 LOW |
CVE-2019-13528 |
A specific utility may allow an attacker to gain read access to privileged files in the Niagara AX 3.8u4 (JACE 3e, JACE 6e, JACE 7, JACE-8000), Niagara 4.4u3 (JACE 3e, JACE 6e, JACE 7, JACE-8000), and Niagara 4.7u1 (JACE-8000, Edge 10). Published: September 24, 2019; 6:15:13 PM -0400 |
V3.1: 4.4 MEDIUM V2.0: 2.1 LOW |
CVE-2018-18985 |
Tridium Niagara Enterprise Security 2.3u1, all versions prior to 2.3.118.6, Niagara AX 3.8u4, all versions prior to 3.8.401.1, Niagara 4.4u2, all versions prior to 4.4.93.40.2, and Niagara 4.6, all versions prior to 4.6.96.28.4 a cross-site scripting vulnerability has been identified that may allow a remote attacker to inject code to some web pages affecting confidentiality. Published: January 29, 2019; 11:29:00 AM -0500 |
V3.0: 5.4 MEDIUM V2.0: 3.5 LOW |
CVE-2017-16748 |
An attacker can log into the local Niagara platform (Niagara AX Framework Versions 3.8 and prior or Niagara 4 Framework Versions 4.4 and prior) using a disabled account name and a blank password, granting the attacker administrator access to the Niagara system. Published: August 20, 2018; 5:29:00 PM -0400 |
V3.0: 9.8 CRITICAL V2.0: 7.5 HIGH |
CVE-2017-16744 |
A path traversal vulnerability in Tridium Niagara AX Versions 3.8 and prior and Niagara 4 systems Versions 4.4 and prior installed on Microsoft Windows Systems can be exploited by leveraging valid platform (administrator) credentials. Published: August 20, 2018; 5:29:00 PM -0400 |
V3.0: 7.2 HIGH V2.0: 6.5 MEDIUM |
CVE-2012-4701 |
Directory traversal vulnerability in Tridium Niagara AX 3.5, 3.6, and 3.7 allows remote attackers to read sensitive files, and consequently execute arbitrary code, by leveraging (1) valid credentials or (2) the guest feature. Published: February 15, 2013; 7:09:27 AM -0500 |
V3.x:(not available) V2.0: 9.3 HIGH |
CVE-2012-3025 |
The default configuration of Tridium Niagara AX Framework through 3.6 uses a cleartext base64 format for transmission of credentials in cookies, which allows remote attackers to obtain sensitive information by sniffing the network. Published: August 16, 2012; 6:38:04 AM -0400 |
V3.x:(not available) V2.0: 5.0 MEDIUM |
CVE-2012-3024 |
Tridium Niagara AX Framework through 3.6 uses predictable values for (1) session IDs and (2) keys, which might allow remote attackers to bypass authentication via a brute-force attack. Published: August 16, 2012; 6:38:04 AM -0400 |
V3.x:(not available) V2.0: 5.0 MEDIUM |
CVE-2012-4028 |
Tridium Niagara AX Framework does not properly store credential data, which allows context-dependent attackers to bypass intended access restrictions by using the stored information for authentication. Published: July 16, 2012; 4:55:05 PM -0400 |
V3.x:(not available) V2.0: 7.8 HIGH |
CVE-2012-4027 |
Directory traversal vulnerability in Tridium Niagara AX Framework allows remote attackers to read files outside of the intended images, nav, and px folders by leveraging incorrect permissions, as demonstrated by reading the config.bog file. Published: July 16, 2012; 4:55:04 PM -0400 |
V3.x:(not available) V2.0: 5.0 MEDIUM |