Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Invensys Wonderware InTouch HMI 2012 R2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Invensys Wonderware InTouch XML外部实体注入漏洞
Vulnerability Description
Invensys Wonderware InTouch是英国英维思（Invensys）公司的一套开放的、可扩展的HMI和SCADA监控解决方案。该解决方案可创建标准化的、可重复使用的可视化应用程序。 Invensys Wonderware InTouch HMI 2012 R2及之前的版本中存在XML外部实体注入漏洞。远程攻击者可借助包含外部实体声明和实体引用结合的XML文档利用该漏洞读取任意文件，发送HTTP请求到内部服务器，或造成拒绝服务（CPU和内存耗尽）。
CVSS Information
N/A
Vulnerability Type
N/A