CVE-2019-6555

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Cscape, 9.80 SP4 and prior. An improper input validation vulnerability may be exploited by processing specially crafted POC files. This may allow an attacker to read confidential information and remotely execute arbitrary code.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
ICS-CERT	Cscape	9.80 SP4 and prior.

References

http://www.securityfocus.com/bid/107087Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-19-050-03Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/107087Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-19-050-03Third Party Advisory, US Government Resource

Timeline

Published: Feb 28, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-65566.6When processing project files, the application (Omron CX-Programmer v9.70 and prior and Common Components January 2019 and prior) fails to c CVE-2019-65579.8Several buffer overflow vulnerabilities have been identified in Moxa IKS and EDS, which may allow remote code execution.CVE-2019-65587.5In Auto-Maskin RP210E Versions 3.7 and prior, DCU210E Versions 3.7 and prior and Marine Observer Pro (Android App), the software contains a CVE-2019-65596.5Moxa IKS and EDS allow remote authenticated users to cause a denial of service via a specially crafted packet, which may cause the switch to CVE-2019-65609.1In Auto-Maskin RP210E Versions 3.7 and prior, DCU210E Versions 3.7 and prior and Marine Observer Pro (Android App), the software contains a CVE-2019-65618.8Cross-site request forgery has been identified in Moxa IKS and EDS, which may allow for the execution of unauthorized actions on the device.CVE-2019-65625.4In Philips Tasy EMR, Tasy EMR Versions 3.02.1744 and prior, the software incorrectly neutralizes user-controllable input before it is placed CVE-2019-65639.8Moxa IKS and EDS generate a predictable cookie calculated with an MD5 hash, allowing an attacker to capture the administrator's password, wh CVE-2019-65647.8GE Communicator, all versions prior to 4.0.517, allows a non-administrative user to place malicious files within the installer file director CVE-2019-65656.1Moxa IKS and EDS fails to properly validate user input, giving unauthenticated and authenticated attackers the ability to perform XSS attack CVE-2019-65667.8GE Communicator, all versions prior to 4.0.517, allows a non-administrative user to replace the uninstaller with a malicious version, which CVE-2019-65675.5A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All Versions < V5.2.4), SCALANCE X-200IRT s