Unscored severity · published Jun 8, 2012
CVE-2012-1814
Cross-site scripting (XSS) vulnerability in Emerson DeltaV and DeltaV Workstations 9.3.1, 10.3.1, 11.3, and 11.3.1 and DeltaV ProEssentials Scientific Graph 5.0.0.6 allows remote…
–
CVSS
1.3%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in Emerson DeltaV and DeltaV Workstations 9.3.1, 10.3.1, 11.3, and 11.3.1 and DeltaV ProEssentials Scientific Graph 5.0.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DE
Deltav · Emerson
9.3.1; 10.3.1; 11.3; 11.3.1 · source: NVD
DP
Deltav Proessentials Scientific Graph · Emerson
5.0.0.6 · source: NVD
DW
Deltav Workstation · Emerson
9.3.1; 10.3.1; 11.3; 11.3.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-1814
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-1814
osvdb.org
http://osvdb.org/81996
secunia.com
http://secunia.com/advisories/49210
www.securityfocus.com
http://www.securityfocus.com/bid/53591
US Government Resource
http://www.us-cert.gov/control_systems/pdf/ICSA-12-138-01.pdf
More from Deltav
8.8
CVE-2018-14795
DeltaV Versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, and R5 is vulnerable due to improper path validation which may allow an attacker to replace executable files
8.8
CVE-2018-14793
DeltaV Versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, and R5 is vulnerable to a buffer overflow exploit through an open communication port to allow arbitrary code execution
7.8
CVE-2018-14797
Emerson DeltaV DCS versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, R5 allow a specially crafted DLL file to be placed in the search path and loaded as an internal and valid DLL, which…
7.8
CVE-2018-14791
Emerson DeltaV DCS versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, R5 may allow non-administrative users to change executable and library files on the affected products
7.3
CVE-2021-44463
Missing DLLs, if replaced by an insider, could allow an attacker to achieve local privilege escalation on the DeltaV Distributed Control System Controllers and Workstations (All…