Known vulnerabilities in AVEVA Edge 2020 R2 SP1

Vendor: AVEVA Software, LLC.

Software: AVEVA Edge

Version: 2020 R2 SP1

Software CPE: cpe:2.3:a:aveva_software:indusoft_web_studio:*:*:*:*:*:*:*:*

Website: https://www.aveva.com/

Total vulnerabilities: 10

Public exploits: 0

Known exploited (KEV): 0

Highest CVSSv4 Score: 9.3

Vulnerabilities (10)

Vulnerability	CWE-ID	CSH Severity	Public Exploit	KEV	First fixed release	Published	Bulletins
#VU69521 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVE-2021-42797	CWE-22	High	No	No	2020 R2 SP2	23.11.2022	SB2022112309
#VU69520 - Improper Access Control CVE-2021-42796	CWE-284	High	No	No	2020 R2 SP2	23.11.2022	SB2022112309
#VU69519 - Exposure of sensitive information to an unauthorized actor CVE-2021-42794	CWE-200	Medium	No	No	2020 R2 SP2	23.11.2022	SB2022112309
#VU66779 - Deserialization of Untrusted Data CVE-2022-28685	CWE-502	High	No	No	HF 2020.2.00.40	26.08.2022	SB2022082610
#VU66778 - Uncontrolled Search Path Element CVE-2022-28686	CWE-427	Medium	No	No	HF 2020.2.00.40	26.08.2022	SB2022082610
#VU66777 - Uncontrolled Search Path Element CVE-2022-28687	CWE-427	Medium	No	No	HF 2020.2.00.40	26.08.2022	SB2022082610
#VU66776 - Uncontrolled Search Path Element CVE-2022-28688	CWE-427	Medium	No	No	HF 2020.2.00.40	26.08.2022	SB2022082610
#VU66775 - Improper Restriction of XML External Entity Reference ('XXE') CVE-2022-36969	CWE-611	High	No	No	HF 2020.2.00.40	26.08.2022	SB2022082610
#VU66774 - Insufficient UI Warning of Dangerous Operations CVE-2022-36970	CWE-357	High	No	No	HF 2020.2.00.40	26.08.2022	SB2022082610
#VU40450 - Improper input validation CVE-2016-2542	CWE-20	Low	No	No	2020 R2 SP2	24.02.2016	SB2016022406 SB2022112309 SB2016062711