Ivan Poliyanchuk

**Name of the Vulnerable Software and Affected Versions** Invensys Wonderware Information Server (WIS) versions 4.0 SP1 through 5.0 **Description** A SQL injection issue allows remote attackers to execute arbitrary SQL commands. **Recommendations** For Invensys Wonderware Information Server (WIS) versions 4.0 SP1 through 5.0, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Invensys Wonderware Information Server (WIS) versions 4.0 SP1 through 5.0 **Description** The issue allows remote attackers to execute arbitrary code or cause a denial of service due to unrestricted size and amount values. **Recommendations** For versions 4.0 SP1 through 5.0, restrict size and amount values to prevent remote attackers from executing arbitrary code or causing a denial of service.

**Name of the Vulnerable Software and Affected Versions** Invensys Wonderware Information Server (WIS) versions 4.0 SP1 through 5.0 **Description** The issue allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. **Recommendations** For versions 4.0 SP1 through 5.0, as a temporary workaround, consider restricting access to XML documents or disabling the processing of external entities until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Invensys Wonderware Information Server (WIS) version 4.0 SP1 Invensys Wonderware Information Server (WIS) versions 4.5 through 5.0 **Description** A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. **Recommendations** For Invensys Wonderware Information Server (WIS) version 4.0 SP1, update to a version that includes a fix for this issue. For Invensys Wonderware Information Server (WIS) versions 4.5 through 5.0, update to a version that includes a fix for this issue.