CVE-2018-11517

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

mySCADA myPRO 7 allows remote attackers to discover all ProjectIDs in a project by sending all of the prj parameter values from 870000 to 875000 in t=0&rq=0 requests to TCP port 11010.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/EmreOvunc/mySCADA-myPRO-7-projectID-DisclosureExploit, Third Party Advisory
https://www.emreovunc.com/blog/en/mypro_enum_projectid.rbNot Applicable
https://github.com/EmreOvunc/mySCADA-myPRO-7-projectID-DisclosureExploit, Third Party Advisory
https://www.emreovunc.com/blog/en/mypro_enum_projectid.rbNot Applicable

Timeline

Published: May 28, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-115188.1A vulnerability allows a phreaking attack on HCL legacy IVR systems that do not use VoIP. These IVR systems rely on various frequencies of a CVE-2018-11526.5libjpeg-turbo 1.5.90 is vulnerable to a denial of service vulnerability caused by a divide by zero when processing a crafted BMP image.CVE-2018-115226.1Yosoro 1.0.4 has stored XSS.CVE-2018-115239.8upload.php on NUUO NVRmini 2 devices allows Arbitrary File Upload, such as upload of .php files.CVE-2018-115257.8The plugin "Advanced Order Export For WooCommerce" for WordPress (v1.5.4 and before) is vulnerable to CSV Injection.CVE-2018-115267.8The plugin "WordPress Comments Import & Export" for WordPress (v2.0.4 and before) is vulnerable to CSV Injection.CVE-2018-115278.8An issue was discovered in CScms v4.1. A Cross-site request forgery (CSRF) vulnerability in plugins/sys/admin/Sys.php allows remote attacker CVE-2018-115289.8WUZHI CMS 4.1.0 has SQL Injection via an api/sms_check.php?param= URI.CVE-2018-115298.0VideoLAN VLC media player 2.2.x is prone to a use after free vulnerability which an attacker can leverage to execute arbitrary code via craf CVE-2018-11537.4Burp Suite Community Edition 1.7.32 and 1.7.33 fail to validate the server certificate in a couple of HTTPS requests which allows a man in t CVE-2018-115319.8Exiv2 0.26 has a heap-based buffer overflow in getData in preview.cpp.CVE-2018-115326.1An issue was discovered in the ChangUonDyU Advanced Statistics plugin 1.0.2 for MyBB. changstats.php has XSS, as demonstrated by a subject f