Vulnerabilities (CVE)

Filtered by vendor Ptc Subscribe
Total 34 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2018-20092 1 Ptc 1 Thingworx Platform 2024-11-21 5.0 MEDIUM 7.5 HIGH
PTC ThingWorx Platform through 8.3.0 is vulnerable to a directory traversal attack on ZIP files via a POST request.
CVE-2018-17218 1 Ptc 1 Thingworx Platform 2024-11-21 3.5 LOW 5.4 MEDIUM
An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2. There is reflected XSS in the SQUEAL search function.
CVE-2018-17217 1 Ptc 1 Thingworx Platform 2024-11-21 5.0 MEDIUM 7.5 HIGH
An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2. There is a hardcoded encryption key.
CVE-2018-17216 1 Ptc 1 Thingworx Platform 2024-11-21 4.0 MEDIUM 6.5 MEDIUM
An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2. There is password hash exposure to privileged users.
CVE-2015-2061 1 Ptc 1 Creo View 2024-11-21 7.5 HIGH N/A
Heap-based buffer overflow in the browser plugin for PTC Creo View allows remote attackers to execute arbitrary code via vectors involving setting a large buffer to an unspecified attribute.
CVE-2014-9267 1 Ptc 1 Isoview 2024-11-21 6.8 MEDIUM N/A
Heap-based buffer overflow in the PTC IsoView ActiveX control allows remote attackers to execute arbitrary code via a crafted ViewPort property value.
CVE-2007-4600 1 Ptc 1 Mathcad 2024-11-21 4.6 MEDIUM N/A
The "Protect Worksheet" functionality in Mathsoft Mathcad 12 through 13.1, and PTC Mathcad 14, implements file access restrictions via a protection element in a gzipped XML file, which allows attackers to bypass these restrictions by removing this element.
CVE-2023-29446 1 Ptc 3 Kepware Kepserverex, Thingworx Industrial Connectivity, Thingworx Kepware Server 2024-10-08 N/A 4.7 MEDIUM
An improper input validation vulnerability has been discovered that could allow an adversary to inject a UNC path via a malicious project file. This allows an adversary to capture NLTMv2 hashes and potentially crack them offline.
CVE-2024-40395 1 Ptc 1 Thingworx 2024-08-30 N/A 6.5 MEDIUM
An Insecure Direct Object Reference (IDOR) in PTC ThingWorx v9.5.0 allows attackers to view sensitive information, including PII, regardless of access level.
CVE-2023-29447 1 Ptc 3 Kepware Kepserverex, Thingworx Industrial Connectivity, Thingworx Kepware Server 2024-02-28 N/A 5.3 MEDIUM
An insufficiently protected credentials vulnerability in KEPServerEX could allow an adversary to capture user credentials as the web server uses basic authentication.
CVE-2023-29445 1 Ptc 3 Kepware Kepserverex, Thingworx Industrial Connectivity, Thingworx Kepware Server 2024-02-28 N/A 7.8 HIGH
An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM.
CVE-2023-5909 4 Ge, Ptc, Rockwellautomation and 1 more 8 Industrial Gateway Server, Keepserverex, Opc-aggregator and 5 more 2024-02-28 N/A 7.5 HIGH
KEPServerEX does not properly validate certificates from clients which may allow unauthenticated users to connect.
CVE-2023-29444 1 Ptc 3 Kepware Kepserverex, Thingworx Industrial Connectivity, Thingworx Kepware Server 2024-02-28 N/A 7.3 HIGH
An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM. Alternatively, they could host a trojanized version of the software and trick victims into downloading and installing their malicious version to gain initial access and code execution.
CVE-2023-5908 4 Ge, Ptc, Rockwellautomation and 1 more 8 Industrial Gateway Server, Keepserverex, Opc-aggregator and 5 more 2024-02-28 N/A 9.1 CRITICAL
KEPServerEX is vulnerable to a buffer overflow which may allow an attacker to crash the product being accessed or leak information.
CVE-2023-27881 1 Ptc 1 Vuforia Studio 2024-02-28 N/A 9.9 CRITICAL
A user could use the “Upload Resource” functionality to upload files to any location on the disk.
CVE-2023-31200 1 Ptc 1 Vuforia Studio 2024-02-28 N/A 8.0 HIGH
PTC Vuforia Studio does not require a token; this could allow an attacker with local access to perform a cross-site request forgery attack or a replay attack.
CVE-2023-29502 1 Ptc 1 Vuforia Studio 2024-02-28 N/A 4.3 MEDIUM
Before importing a project into Vuforia, a user could modify the “resourceDirectory” attribute in the appConfig.json file to be a different path.
CVE-2023-29168 1 Ptc 1 Vuforia Studio 2024-02-28 N/A 7.5 HIGH
The local Vuforia web application does not support HTTPS, and federated credentials are passed via basic authentication.
CVE-2022-2825 4 Ge, Ptc, Rockwellautomation and 1 more 8 Industrial Gateway Server, Kepware Kepserverex, Opc-aggregator and 5 more 2024-02-28 N/A 9.8 CRITICAL
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kepware KEPServerEX 6.11.718.0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of text encoding conversions. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-18411.
CVE-2023-29152 1 Ptc 1 Vuforia Studio 2024-02-28 N/A 8.1 HIGH
By changing the filename parameter in the request, an attacker could delete any file with the permissions of the Vuforia server account.