CO
Product
Codesys
13
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 10Medium 1Low 0
Watch
Add Codesys to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-16265 | 9.8 | Oct 25 | CODESYS V2.3 ENI server up to V3.2.2.24 has a Buffer Overflow Affected: 2.3 before 2.3.9.61 |
| CVE-2021-34584 | 9.1 | Oct 26 | Crafted web server requests can be utilised to read partial stack or heap memory or may trigger a denial-of- service condition due to a crash in the CODESYS V2 web server prior to… Affected: before 1.1.9.22 |
| CVE-2019-13538 | 8.6 | Sep 17 | 3S-Smart Software Solutions GmbH CODESYS V3 Library Manager, all versions prior to 3.5.16.0, allows the system to display active library content without checking its validity,… Affected: before 3.5.16.0 |
| CVE-2021-34595 | 8.1 | Oct 26 | A crafted request with invalid offsets may cause an out-of-bounds read or write access in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56,… Affected: before 1.1.9.22 |
| CVE-2025-41700 | 7.8 | Dec 1 | An unauthenticated attacker can trick a local user into executing arbitrary code by opening a deliberately manipulated CODESYS project file with a CODESYS development system Affected: before 3.5.21.40 |
| CVE-2021-21869 | 7.8 | Aug 25 | An unsafe deserialization vulnerability exists in the Engine.plugin ProfileInformation ProfileData functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17 Affected: 3.5.16.0; 3.5.17.0 |
| CVE-2021-21868 | 7.8 | Aug 18 | An unsafe deserialization vulnerability exists in the ObjectManager.plugin Project.get_MissingTypes() functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17 Affected: 3.5.16.0; 3.5.17.0 |
| CVE-2021-21867 | 7.8 | Aug 18 | An unsafe deserialization vulnerability exists in the ObjectManager.plugin ObjectStream.ProfileByteArray functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17 Affected: 3.5.16.0; 3.5.17.0 |
| CVE-2021-34586 | 7.5 | Oct 26 | In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests may cause a Null pointer dereference in the CODESYS web server and may result in a denial-of-service… Affected: before 1.1.9.22 |
| CVE-2021-34585 | 7.5 | Oct 26 | In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests can trigger a parser error Affected: before 1.1.9.22 |
| CVE-2021-34583 | 7.5 | Oct 26 | Crafted web server requests may cause a heap-based buffer overflow and could therefore trigger a denial-of- service condition due to a crash in the CODESYS V2 web server prior to… Affected: before 1.1.9.22 |
| CVE-2019-5105 | 7.5 | Mar 26 | An exploitable memory corruption vulnerability exists in the Name Service Client functionality of 3S-Smart Software Solutions CODESYS GatewayService Affected: 3.5.13.2 |
| CVE-2021-34596 | 6.5 | Oct 26 | A crafted request may cause a read access to an uninitialized pointer in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resulting in a… Affected: before 1.1.9.22 |
Showing 13