CVE-2023-1256

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The listed versions of AVEVA Plant SCADA and AVEVA Telemetry Server are vulnerable to an improper authorization exploit which could allow an unauthenticated user to remotely read data, cause denial of service, and tamper with alarm states.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: Mar 16, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-12576.8An attacker with physical access to the affected Moxa UC Series devices can initiate a restart of the device and gain access to its BIOS. Co CVE-2023-12585.3Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ABB Flow-X firmware on Flow-X embedded hardware (web service mod CVE-2023-12595.5The Hotjar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the hotjar_site_id in versions up to, and including, 1.0.15 CVE-2023-12608.0An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has bee CVE-2023-12615.3Missing MAC layer security in Silicon Labs Wi-SUN SDK v1.5.0 and earlier allows malicious node to route malicious messages through network.CVE-2023-12625.3Missing MAC layer security in Silicon Labs Wi-SUN Linux Border Router v1.5.2 and earlier allows malicious node to route malicious messages t CVE-2023-12635.3The CMP – Coming Soon & Maintenance plugin for WordPress is vulnerable to Information Exposure in versions up to, and including, 4.1.6 via CVE-2023-12645.5NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1392.CVE-2023-12654.5An issue has been discovered in GitLab affecting all versions starting from 11.9 before 15.9.6, all versions starting from 15.10 before 15.1 CVE-2023-12679.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ulkem Company PtteM Kart. This issue CVE-2023-12699.8Use of Hard-coded Credentials in GitHub repository alextselegidis/easyappointments prior to 1.5.0.CVE-2023-12705.4Cross-site Scripting in GitHub repository btcpayserver/btcpayserver prior to 1.8.3.