20Urdjk

**Name of the Vulnerable Software and Affected Versions** Inductive Automation Ignition (affected versions not specified) **Description** This issue allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. User interaction is required to exploit this issue, where the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the `id` parameter provided to the Inductive Automation Ignition web interface, resulting from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this issue to execute arbitrary code in the context of SYSTEM. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Inductive Automation Ignition (affected versions not specified) **Description** This issue allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Although authentication is required to exploit this issue, the existing authentication mechanism can be bypassed. The specific flaw exists within the configuration of the web server, resulting from the lack of appropriate Content Security Policy headers. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of SYSTEM. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Inductive Automation Ignition (affected versions not specified) **Description** The issue is related to the use of dangerous methods or functions in the Inductive Automation Ignition software, which can be exploited by a remote attacker to execute arbitrary code on the target system or cause a denial of service. The specific flaw exists within the Ignition Gateway server and results from the exposure of a dangerous function. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Authentication is required to exploit this vulnerability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Inductive Automation Ignition OPC UA Quick Client (affected versions not specified) **Description** This issue allows remote attackers to bypass authentication on affected installations of Inductive Automation Ignition. The specific flaw exists within the server configuration, resulting from the lack of authentication prior to allowing access to password change functionality. An attacker can leverage this vulnerability to bypass authentication on the system. User interaction is required to exploit this vulnerability, such as visiting a malicious page or opening a malicious file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Unified Automation OPC UA C++ Demo Server version 1.7.6-537 **Description** This issue allows remote attackers to create a denial-of-service condition on affected installations. Authentication is not required to exploit this issue. The specific flaw exists within the `OpcUa SecureListener ProcessSessionCallRequest` method. A crafted OPC UA message can force the server to incorrectly update a reference count, allowing an attacker to create a denial-of-service condition on the system. **Recommendations** For Unified Automation OPC UA C++ Demo Server version 1.7.6-537, as a temporary workaround, consider disabling the `OpcUa SecureListener ProcessSessionCallRequest` method until a patch is available. Restrict access to the server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Inductive Automation Ignition version 8.1.15 (b2022030114) **Description** This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a malicious file. The flaw exists within the processing of ZIP files, where crafted data can cause the application to execute arbitrary Python scripts. The user interface fails to provide sufficient indication of the hazard, and an attacker can leverage this to execute code in the context of SYSTEM. **Recommendations** For Inductive Automation Ignition version 8.1.15 (b2022030114), consider disabling the processing of ZIP files until a patch is available to prevent the execution of arbitrary Python scripts. Restrict access to the user interface to minimize the risk of exploitation. Avoid using crafted ZIP files in the affected application until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.