Search criteria
6 vulnerabilities found for NS10 by Omron
VAR-201407-0239
Vulnerability from variot - Updated: 2023-12-18 12:38Cross-site scripting (XSS) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to inject arbitrary web script or HTML via crafted data. Omron NS5, NS8, NS10, NS12 and NS15 HMI Terminals are Omron's touch screen HMI programming software. There is an HTML injection vulnerability in Omron NS series HMI Terminals. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible. The following products and versions are affected: Omron NS5, NS8, NS10, NS12, NS15 HMI Terminals 8.1xx to 8.68x versions
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201407-0239",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "ns series system program",
"scope": "eq",
"trust": 2.2,
"vendor": "omron",
"version": "8.1"
},
{
"model": "ns series system program",
"scope": "eq",
"trust": 2.2,
"vendor": "omron",
"version": "8.68"
},
{
"model": "ns5 hmi terminal",
"scope": "eq",
"trust": 1.0,
"vendor": "omron",
"version": null
},
{
"model": "ns12 hmi terminal",
"scope": "eq",
"trust": 1.0,
"vendor": "omron",
"version": null
},
{
"model": "ns8 hmi terminal",
"scope": "eq",
"trust": 1.0,
"vendor": "omron",
"version": null
},
{
"model": "ns10 hmi terminal",
"scope": "eq",
"trust": 1.0,
"vendor": "omron",
"version": null
},
{
"model": "ns15 hmi terminal",
"scope": "eq",
"trust": 1.0,
"vendor": "omron",
"version": null
},
{
"model": "ns10",
"scope": null,
"trust": 0.8,
"vendor": "omron",
"version": null
},
{
"model": "ns12",
"scope": null,
"trust": 0.8,
"vendor": "omron",
"version": null
},
{
"model": "ns15",
"scope": null,
"trust": 0.8,
"vendor": "omron",
"version": null
},
{
"model": "ns5",
"scope": null,
"trust": 0.8,
"vendor": "omron",
"version": null
},
{
"model": "ns8",
"scope": null,
"trust": 0.8,
"vendor": "omron",
"version": null
},
{
"model": "ns series software",
"scope": "eq",
"trust": 0.8,
"vendor": "omron",
"version": "8.1xx to 8.68x"
},
{
"model": "ns15 hmi terminal",
"scope": null,
"trust": 0.6,
"vendor": "omron",
"version": null
},
{
"model": "ns12 hmi terminal",
"scope": null,
"trust": 0.6,
"vendor": "omron",
"version": null
},
{
"model": "ns10 hmi terminal",
"scope": null,
"trust": 0.6,
"vendor": "omron",
"version": null
},
{
"model": "ns8 hmi terminal",
"scope": null,
"trust": 0.6,
"vendor": "omron",
"version": null
},
{
"model": "ns5 hmi terminal",
"scope": null,
"trust": 0.6,
"vendor": "omron",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "ns series system program",
"version": "8.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "ns series system program",
"version": "8.68"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "ns10 hmi terminal",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "ns12 hmi terminal",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "ns15 hmi terminal",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "ns5 hmi terminal",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "ns8 hmi terminal",
"version": null
},
{
"model": "ns8",
"scope": "eq",
"trust": 0.3,
"vendor": "omron",
"version": "8.68"
},
{
"model": "ns8",
"scope": "eq",
"trust": 0.3,
"vendor": "omron",
"version": "8.1"
},
{
"model": "ns5",
"scope": "eq",
"trust": 0.3,
"vendor": "omron",
"version": "8.68"
},
{
"model": "ns5",
"scope": "eq",
"trust": 0.3,
"vendor": "omron",
"version": "8.1"
},
{
"model": "ns15",
"scope": "eq",
"trust": 0.3,
"vendor": "omron",
"version": "8.68"
},
{
"model": "ns15",
"scope": "eq",
"trust": 0.3,
"vendor": "omron",
"version": "8.1"
},
{
"model": "ns12",
"scope": "eq",
"trust": 0.3,
"vendor": "omron",
"version": "8.68"
},
{
"model": "ns12",
"scope": "eq",
"trust": 0.3,
"vendor": "omron",
"version": "8.1"
},
{
"model": "ns10",
"scope": "eq",
"trust": 0.3,
"vendor": "omron",
"version": "8.68"
},
{
"model": "ns10",
"scope": "eq",
"trust": 0.3,
"vendor": "omron",
"version": "8.1"
},
{
"model": "ns8",
"scope": "ne",
"trust": 0.3,
"vendor": "omron",
"version": "8.7"
},
{
"model": "ns5",
"scope": "ne",
"trust": 0.3,
"vendor": "omron",
"version": "8.7"
},
{
"model": "ns15",
"scope": "ne",
"trust": 0.3,
"vendor": "omron",
"version": "8.7"
},
{
"model": "ns12",
"scope": "ne",
"trust": 0.3,
"vendor": "omron",
"version": "8.7"
},
{
"model": "ns10",
"scope": "ne",
"trust": 0.3,
"vendor": "omron",
"version": "8.7"
}
],
"sources": [
{
"db": "IVD",
"id": "7d7def40-463f-11e9-b4a6-000c29342cb1"
},
{
"db": "IVD",
"id": "e2e3071c-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-04730"
},
{
"db": "BID",
"id": "68836"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003554"
},
{
"db": "NVD",
"id": "CVE-2014-2370"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-596"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:omron:ns_series_system_program_firmware:8.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:omron:ns_series_system_program_firmware:8.68:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:omron:ns10_hmi_terminal:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:omron:ns5_hmi_terminal:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:omron:ns15_hmi_terminal:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:omron:ns12_hmi_terminal:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:omron:ns8_hmi_terminal:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2014-2370"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Joel Sevilleja Febrer of S2 Grupo",
"sources": [
{
"db": "BID",
"id": "68836"
}
],
"trust": 0.3
},
"cve": "CVE-2014-2370",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "LOW",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "Single",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 3.5,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2014-2370",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Low",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"exploitabilityScore": 6.8,
"id": "CNVD-2014-04730",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "LOW",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "IVD",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"exploitabilityScore": 6.8,
"id": "7d7def40-463f-11e9-b4a6-000c29342cb1",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "LOW",
"trust": 0.2,
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "IVD",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"exploitabilityScore": 6.8,
"id": "e2e3071c-2351-11e6-abef-000c29c66e3d",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "LOW",
"trust": 0.2,
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"exploitabilityScore": 6.8,
"id": "VHN-70309",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "LOW",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:S/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2014-2370",
"trust": 1.8,
"value": "LOW"
},
{
"author": "CNVD",
"id": "CNVD-2014-04730",
"trust": 0.6,
"value": "LOW"
},
{
"author": "CNNVD",
"id": "CNNVD-201407-596",
"trust": 0.6,
"value": "LOW"
},
{
"author": "IVD",
"id": "7d7def40-463f-11e9-b4a6-000c29342cb1",
"trust": 0.2,
"value": "LOW"
},
{
"author": "IVD",
"id": "e2e3071c-2351-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "LOW"
},
{
"author": "VULHUB",
"id": "VHN-70309",
"trust": 0.1,
"value": "LOW"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "7d7def40-463f-11e9-b4a6-000c29342cb1"
},
{
"db": "IVD",
"id": "e2e3071c-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-04730"
},
{
"db": "VULHUB",
"id": "VHN-70309"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003554"
},
{
"db": "NVD",
"id": "CVE-2014-2370"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-596"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site scripting (XSS) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to inject arbitrary web script or HTML via crafted data. Omron NS5, NS8, NS10, NS12 and NS15 HMI Terminals are Omron\u0027s touch screen HMI programming software. There is an HTML injection vulnerability in Omron NS series HMI Terminals. \nSuccessful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible. The following products and versions are affected: Omron NS5, NS8, NS10, NS12, NS15 HMI Terminals 8.1xx to 8.68x versions",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-2370"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003554"
},
{
"db": "CNVD",
"id": "CNVD-2014-04730"
},
{
"db": "BID",
"id": "68836"
},
{
"db": "IVD",
"id": "7d7def40-463f-11e9-b4a6-000c29342cb1"
},
{
"db": "IVD",
"id": "e2e3071c-2351-11e6-abef-000c29c66e3d"
},
{
"db": "VULHUB",
"id": "VHN-70309"
}
],
"trust": 2.88
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2014-2370",
"trust": 3.8
},
{
"db": "ICS CERT",
"id": "ICSA-14-203-01",
"trust": 3.4
},
{
"db": "BID",
"id": "68836",
"trust": 2.0
},
{
"db": "CNNVD",
"id": "CNNVD-201407-596",
"trust": 1.1
},
{
"db": "CNVD",
"id": "CNVD-2014-04730",
"trust": 1.0
},
{
"db": "JVN",
"id": "JVNVU97798872",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003554",
"trust": 0.8
},
{
"db": "IVD",
"id": "7D7DEF40-463F-11E9-B4A6-000C29342CB1",
"trust": 0.2
},
{
"db": "IVD",
"id": "E2E3071C-2351-11E6-ABEF-000C29C66E3D",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-70309",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "7d7def40-463f-11e9-b4a6-000c29342cb1"
},
{
"db": "IVD",
"id": "e2e3071c-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-04730"
},
{
"db": "VULHUB",
"id": "VHN-70309"
},
{
"db": "BID",
"id": "68836"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003554"
},
{
"db": "NVD",
"id": "CVE-2014-2370"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-596"
}
]
},
"id": "VAR-201407-0239",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "7d7def40-463f-11e9-b4a6-000c29342cb1"
},
{
"db": "IVD",
"id": "e2e3071c-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-04730"
},
{
"db": "VULHUB",
"id": "VHN-70309"
}
],
"trust": 1.8361111166666668
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 1.0
}
],
"sources": [
{
"db": "IVD",
"id": "7d7def40-463f-11e9-b4a6-000c29342cb1"
},
{
"db": "IVD",
"id": "e2e3071c-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-04730"
}
]
},
"last_update_date": "2023-12-18T12:38:14.196000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Scalable HMI",
"trust": 0.8,
"url": "http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/default.html"
},
{
"title": "NS5, NS8, NS10, NS12, NS15, NSH5-V2",
"trust": 0.8,
"url": "http://www.fa.omron.co.jp/products/family/155/download/catalog.html"
},
{
"title": "Omron NS series HMI Terminals HTML Injection Vulnerability Patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/48043"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-04730"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003554"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-79",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-70309"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003554"
},
{
"db": "NVD",
"id": "CVE-2014-2370"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.4,
"url": "http://ics-cert.us-cert.gov/advisories/icsa-14-203-01"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/bid/68836"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-2370"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu97798872/"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-2370"
},
{
"trust": 0.3,
"url": "http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-04730"
},
{
"db": "VULHUB",
"id": "VHN-70309"
},
{
"db": "BID",
"id": "68836"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003554"
},
{
"db": "NVD",
"id": "CVE-2014-2370"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-596"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "7d7def40-463f-11e9-b4a6-000c29342cb1"
},
{
"db": "IVD",
"id": "e2e3071c-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-04730"
},
{
"db": "VULHUB",
"id": "VHN-70309"
},
{
"db": "BID",
"id": "68836"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003554"
},
{
"db": "NVD",
"id": "CVE-2014-2370"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-596"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-07-31T00:00:00",
"db": "IVD",
"id": "7d7def40-463f-11e9-b4a6-000c29342cb1"
},
{
"date": "2014-07-31T00:00:00",
"db": "IVD",
"id": "e2e3071c-2351-11e6-abef-000c29c66e3d"
},
{
"date": "2014-07-31T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-04730"
},
{
"date": "2014-07-24T00:00:00",
"db": "VULHUB",
"id": "VHN-70309"
},
{
"date": "2014-07-22T00:00:00",
"db": "BID",
"id": "68836"
},
{
"date": "2014-07-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-003554"
},
{
"date": "2014-07-24T14:55:07.317000",
"db": "NVD",
"id": "CVE-2014-2370"
},
{
"date": "2014-07-29T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201407-596"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-07-31T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-04730"
},
{
"date": "2015-10-08T00:00:00",
"db": "VULHUB",
"id": "VHN-70309"
},
{
"date": "2014-07-22T00:00:00",
"db": "BID",
"id": "68836"
},
{
"date": "2014-07-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-003554"
},
{
"date": "2015-10-08T14:59:25.633000",
"db": "NVD",
"id": "CVE-2014-2370"
},
{
"date": "2014-07-29T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201407-596"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201407-596"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Omron NS Series HMI Terminal Web Application cross-site scripting vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-003554"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "XSS",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201407-596"
}
],
"trust": 0.6
}
}
VAR-201407-0238
Vulnerability from variot - Updated: 2023-12-18 12:38Cross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors. Omron NS5, NS8, NS10, NS12 and NS15 HMI Terminals are Omron's touch screen HMI programming software. Allows remote attackers to perform unauthorized operations with specially crafted data. This may lead to further attacks. The following products are affected: Omron NS5, NS8, NS10, NS12, NS15 HMI Terminals versions 8.1xx to 8.68x
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201407-0238",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "ns series system program",
"scope": "eq",
"trust": 2.2,
"vendor": "omron",
"version": "8.1"
},
{
"model": "ns series system program",
"scope": "eq",
"trust": 2.2,
"vendor": "omron",
"version": "8.68"
},
{
"model": "ns5 hmi terminal",
"scope": "eq",
"trust": 1.0,
"vendor": "omron",
"version": null
},
{
"model": "ns12 hmi terminal",
"scope": "eq",
"trust": 1.0,
"vendor": "omron",
"version": null
},
{
"model": "ns8 hmi terminal",
"scope": "eq",
"trust": 1.0,
"vendor": "omron",
"version": null
},
{
"model": "ns10 hmi terminal",
"scope": "eq",
"trust": 1.0,
"vendor": "omron",
"version": null
},
{
"model": "ns15 hmi terminal",
"scope": "eq",
"trust": 1.0,
"vendor": "omron",
"version": null
},
{
"model": "ns10",
"scope": null,
"trust": 0.8,
"vendor": "omron",
"version": null
},
{
"model": "ns12",
"scope": null,
"trust": 0.8,
"vendor": "omron",
"version": null
},
{
"model": "ns15",
"scope": null,
"trust": 0.8,
"vendor": "omron",
"version": null
},
{
"model": "ns5",
"scope": null,
"trust": 0.8,
"vendor": "omron",
"version": null
},
{
"model": "ns8",
"scope": null,
"trust": 0.8,
"vendor": "omron",
"version": null
},
{
"model": "ns series software",
"scope": "eq",
"trust": 0.8,
"vendor": "omron",
"version": "8.1xx to 8.68x"
},
{
"model": "ns15 hmi terminal",
"scope": null,
"trust": 0.6,
"vendor": "omron",
"version": null
},
{
"model": "ns12 hmi terminal",
"scope": null,
"trust": 0.6,
"vendor": "omron",
"version": null
},
{
"model": "ns10 hmi terminal",
"scope": null,
"trust": 0.6,
"vendor": "omron",
"version": null
},
{
"model": "ns8 hmi terminal",
"scope": null,
"trust": 0.6,
"vendor": "omron",
"version": null
},
{
"model": "ns5 hmi terminal",
"scope": null,
"trust": 0.6,
"vendor": "omron",
"version": null
},
{
"model": "ns8",
"scope": "eq",
"trust": 0.3,
"vendor": "omron",
"version": "8.68"
},
{
"model": "ns8",
"scope": "eq",
"trust": 0.3,
"vendor": "omron",
"version": "8.1"
},
{
"model": "ns5",
"scope": "eq",
"trust": 0.3,
"vendor": "omron",
"version": "8.68"
},
{
"model": "ns5",
"scope": "eq",
"trust": 0.3,
"vendor": "omron",
"version": "8.1"
},
{
"model": "ns15",
"scope": "eq",
"trust": 0.3,
"vendor": "omron",
"version": "8.68"
},
{
"model": "ns15",
"scope": "eq",
"trust": 0.3,
"vendor": "omron",
"version": "8.1"
},
{
"model": "ns12",
"scope": "eq",
"trust": 0.3,
"vendor": "omron",
"version": "8.68"
},
{
"model": "ns12",
"scope": "eq",
"trust": 0.3,
"vendor": "omron",
"version": "8.1"
},
{
"model": "ns10",
"scope": "eq",
"trust": 0.3,
"vendor": "omron",
"version": "8.68"
},
{
"model": "ns10",
"scope": "eq",
"trust": 0.3,
"vendor": "omron",
"version": "8.1"
},
{
"model": "ns8",
"scope": "ne",
"trust": 0.3,
"vendor": "omron",
"version": "8.7"
},
{
"model": "ns5",
"scope": "ne",
"trust": 0.3,
"vendor": "omron",
"version": "8.7"
},
{
"model": "ns15",
"scope": "ne",
"trust": 0.3,
"vendor": "omron",
"version": "8.7"
},
{
"model": "ns12",
"scope": "ne",
"trust": 0.3,
"vendor": "omron",
"version": "8.7"
},
{
"model": "ns10",
"scope": "ne",
"trust": 0.3,
"vendor": "omron",
"version": "8.7"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "ns series system program",
"version": "8.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "ns series system program",
"version": "8.68"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "ns10 hmi terminal",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "ns12 hmi terminal",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "ns15 hmi terminal",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "ns5 hmi terminal",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "ns8 hmi terminal",
"version": null
}
],
"sources": [
{
"db": "IVD",
"id": "e2e5fef4-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-04727"
},
{
"db": "BID",
"id": "68834"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003553"
},
{
"db": "NVD",
"id": "CVE-2014-2369"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-595"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:omron:ns_series_system_program_firmware:8.68:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:omron:ns_series_system_program_firmware:8.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:omron:ns8_hmi_terminal:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:omron:ns15_hmi_terminal:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:omron:ns12_hmi_terminal:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:omron:ns10_hmi_terminal:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:omron:ns5_hmi_terminal:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2014-2369"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Joel Sevilleja Febrer of S2 Grupo",
"sources": [
{
"db": "BID",
"id": "68834"
}
],
"trust": 0.3
},
"cve": "CVE-2014-2369",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 6.8,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "Single",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 6.0,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2014-2369",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 6.8,
"id": "CNVD-2014-04727",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 6.8,
"id": "e2e5fef4-2351-11e6-abef-000c29c66e3d",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 6.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 6.8,
"id": "VHN-70308",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:S/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2014-2369",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNVD",
"id": "CNVD-2014-04727",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201407-595",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "e2e5fef4-2351-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-70308",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "e2e5fef4-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-04727"
},
{
"db": "VULHUB",
"id": "VHN-70308"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003553"
},
{
"db": "NVD",
"id": "CVE-2014-2369"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-595"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors. Omron NS5, NS8, NS10, NS12 and NS15 HMI Terminals are Omron\u0027s touch screen HMI programming software. Allows remote attackers to perform unauthorized operations with specially crafted data. This may lead to further attacks. The following products are affected: Omron NS5, NS8, NS10, NS12, NS15 HMI Terminals versions 8.1xx to 8.68x",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-2369"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003553"
},
{
"db": "CNVD",
"id": "CNVD-2014-04727"
},
{
"db": "BID",
"id": "68834"
},
{
"db": "IVD",
"id": "e2e5fef4-2351-11e6-abef-000c29c66e3d"
},
{
"db": "VULHUB",
"id": "VHN-70308"
}
],
"trust": 2.7
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2014-2369",
"trust": 3.6
},
{
"db": "ICS CERT",
"id": "ICSA-14-203-01",
"trust": 3.4
},
{
"db": "BID",
"id": "68834",
"trust": 1.0
},
{
"db": "CNNVD",
"id": "CNNVD-201407-595",
"trust": 0.9
},
{
"db": "CNVD",
"id": "CNVD-2014-04727",
"trust": 0.8
},
{
"db": "JVN",
"id": "JVNVU97798872",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003553",
"trust": 0.8
},
{
"db": "IVD",
"id": "E2E5FEF4-2351-11E6-ABEF-000C29C66E3D",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-70308",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "e2e5fef4-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-04727"
},
{
"db": "VULHUB",
"id": "VHN-70308"
},
{
"db": "BID",
"id": "68834"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003553"
},
{
"db": "NVD",
"id": "CVE-2014-2369"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-595"
}
]
},
"id": "VAR-201407-0238",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "e2e5fef4-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-04727"
},
{
"db": "VULHUB",
"id": "VHN-70308"
}
],
"trust": 1.6361111166666666
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "e2e5fef4-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-04727"
}
]
},
"last_update_date": "2023-12-18T12:38:14.151000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Scalable HMI",
"trust": 0.8,
"url": "http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/default.html"
},
{
"title": "NS5, NS8, NS10, NS12, NS15, NSH5-V2",
"trust": 0.8,
"url": "http://www.fa.omron.co.jp/products/family/155/download/catalog.html"
},
{
"title": "Patch for Omron NS series HMI Terminals Cross-Site Request Forgery Vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/48034"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-04727"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003553"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-352",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-70308"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003553"
},
{
"db": "NVD",
"id": "CVE-2014-2369"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.4,
"url": "http://ics-cert.us-cert.gov/advisories/icsa-14-203-01"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-2369"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu97798872/"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-2369"
},
{
"trust": 0.3,
"url": "http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-04727"
},
{
"db": "VULHUB",
"id": "VHN-70308"
},
{
"db": "BID",
"id": "68834"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003553"
},
{
"db": "NVD",
"id": "CVE-2014-2369"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-595"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "e2e5fef4-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-04727"
},
{
"db": "VULHUB",
"id": "VHN-70308"
},
{
"db": "BID",
"id": "68834"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003553"
},
{
"db": "NVD",
"id": "CVE-2014-2369"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-595"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-07-31T00:00:00",
"db": "IVD",
"id": "e2e5fef4-2351-11e6-abef-000c29c66e3d"
},
{
"date": "2014-07-31T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-04727"
},
{
"date": "2014-07-24T00:00:00",
"db": "VULHUB",
"id": "VHN-70308"
},
{
"date": "2014-07-22T00:00:00",
"db": "BID",
"id": "68834"
},
{
"date": "2014-07-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-003553"
},
{
"date": "2014-07-24T14:55:07.287000",
"db": "NVD",
"id": "CVE-2014-2369"
},
{
"date": "2014-07-29T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201407-595"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-07-31T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-04727"
},
{
"date": "2014-07-24T00:00:00",
"db": "VULHUB",
"id": "VHN-70308"
},
{
"date": "2014-07-22T00:00:00",
"db": "BID",
"id": "68834"
},
{
"date": "2014-07-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-003553"
},
{
"date": "2014-07-24T18:29:01.080000",
"db": "NVD",
"id": "CVE-2014-2369"
},
{
"date": "2014-07-29T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201407-595"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201407-595"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Omron NS series HMI Terminals Cross-Site Request Forgery Vulnerability",
"sources": [
{
"db": "IVD",
"id": "e2e5fef4-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-04727"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "cross-site request forgery",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201407-595"
}
],
"trust": 0.6
}
}
CVE-2014-2370 (GCVE-0-2014-2370)
Vulnerability from cvelistv5 – Published: 2014-07-24 14:00 – Updated: 2025-10-06 18:01
VLAI?
Title
Omron NS Series HMI Improper Neutralization of Input During Web Page Generation
Summary
Cross-site scripting (XSS) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to inject arbitrary web script or HTML via crafted data.
Severity ?
No CVSS data available.
CWE
Assigner
References
Impacted products
Credits
Joel Sevilleja Febrer of S2 Grupo
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T10:14:25.880Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-203-01"
},
{
"name": "68836",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/68836"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NS15",
"vendor": "Omron",
"versions": [
{
"lessThan": "8.68x",
"status": "affected",
"version": "8.1xx",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "NS12",
"vendor": "Omron",
"versions": [
{
"lessThan": "8.68x",
"status": "affected",
"version": "8.1xx",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "NS10",
"vendor": "Omron",
"versions": [
{
"lessThan": "8.68x",
"status": "affected",
"version": "8.1xx",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "NS8",
"vendor": "Omron",
"versions": [
{
"lessThan": "8.68x",
"status": "affected",
"version": "8.1xx",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "NS5",
"vendor": "Omron",
"versions": [
{
"lessThan": "8.68x",
"status": "affected",
"version": "8.1xx",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Joel Sevilleja Febrer of S2 Grupo"
}
],
"datePublic": "2014-07-22T06:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\nCross-site scripting (XSS) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to inject arbitrary web script or HTML via crafted data.\n\n\u003c/p\u003e"
}
],
"value": "Cross-site scripting (XSS) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to inject arbitrary web script or HTML via crafted data."
}
],
"metrics": [
{
"cvssV2_0": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-06T18:01:21.608Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-14-203-01"
},
{
"url": "https://automation.omron.com/en/us/products/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOmron Corporation has produced update, Version 8.69x for Japan and \nVersion 8.7x for other countries, that mitigates the identified \nvulnerabilities. The updates for the NS series of HMI terminals can be \ndownloaded at the following locations:\u003c/p\u003e\n\u003cp\u003eNS15 Software Update Version 8.7:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns15/default.html\"\u003ehttp://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns15/default.html\u003c/a\u003e\u003c/p\u003e\u003cp\u003eNS12 Software Update Version 8.7:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns12/default.html\"\u003ehttp://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns12/default.html\u003c/a\u003e\u003c/p\u003e\u003cp\u003eNS10 Software Update Version 8.7:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns10/default.html\"\u003ehttp://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns10/default.html\u003c/a\u003e\u003c/p\u003e\u003cp\u003eNS8 Software Update Version 8.7:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns8/default.html\"\u003ehttp://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns8/default.html\u003c/a\u003e\u003c/p\u003e\u003cp\u003eNS5 Software Update Version 8.7:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns5/default.html\"\u003ehttp://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns5/default.html\u003c/a\u003e\u003c/p\u003e\n\n\u003cbr\u003e"
}
],
"value": "Omron Corporation has produced update, Version 8.69x for Japan and \nVersion 8.7x for other countries, that mitigates the identified \nvulnerabilities. The updates for the NS series of HMI terminals can be \ndownloaded at the following locations:\n\n\nNS15 Software Update Version 8.7:\n\n\n http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns15/default.html \n\nNS12 Software Update Version 8.7:\n\n\n http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns12/default.html \n\nNS10 Software Update Version 8.7:\n\n\n http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns10/default.html \n\nNS8 Software Update Version 8.7:\n\n\n http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns8/default.html \n\nNS5 Software Update Version 8.7:\n\n\n http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns5/default.html"
}
],
"source": {
"advisory": "ICSA-14-203-01",
"discovery": "EXTERNAL"
},
"title": "Omron NS Series HMI Improper Neutralization of Input During Web Page Generation",
"x_generator": {
"engine": "Vulnogram 0.2.0"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"ID": "CVE-2014-2369",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://ics-cert.us-cert.gov/advisories/ICSA-14-203-01",
"refsource": "MISC",
"url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-203-01"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2014-2370",
"datePublished": "2014-07-24T14:00:00",
"dateReserved": "2014-03-13T00:00:00",
"dateUpdated": "2025-10-06T18:01:21.608Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-2369 (GCVE-0-2014-2369)
Vulnerability from cvelistv5 – Published: 2014-07-24 14:00 – Updated: 2025-10-06 17:59
VLAI?
Title
Omron NS Series HMI Cross-Site Request Forgery
Summary
Cross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.
Severity ?
No CVSS data available.
CWE
Assigner
References
Impacted products
Credits
Joel Sevilleja Febrer of S2 Grupo
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T10:14:25.244Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-203-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NS15",
"vendor": "Omron",
"versions": [
{
"lessThan": "8.68x",
"status": "affected",
"version": "8.1xx",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "NS12",
"vendor": "Omron",
"versions": [
{
"lessThan": "8.68x",
"status": "affected",
"version": "8.1xx",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "NS10",
"vendor": "Omron",
"versions": [
{
"lessThan": "8.68x",
"status": "affected",
"version": "8.1xx",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "NS8",
"vendor": "Omron",
"versions": [
{
"lessThan": "8.68x",
"status": "affected",
"version": "8.1xx",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "NS5",
"vendor": "Omron",
"versions": [
{
"lessThan": "8.68x",
"status": "affected",
"version": "8.1xx",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Joel Sevilleja Febrer of S2 Grupo"
}
],
"datePublic": "2014-07-22T06:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.\u003c/p\u003e"
}
],
"value": "Cross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors."
}
],
"metrics": [
{
"cvssV2_0": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-06T17:59:20.171Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-14-203-01"
},
{
"url": "https://automation.omron.com/en/us/products/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOmron Corporation has produced update, Version 8.69x for Japan and \nVersion 8.7x for other countries, that mitigates the identified \nvulnerabilities. The updates for the NS series of HMI terminals can be \ndownloaded at the following locations:\u003c/p\u003e\n\u003cp\u003eNS15 Software Update Version 8.7:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns15/default.html\"\u003ehttp://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns15/default.html\u003c/a\u003e\u003c/p\u003e\u003cp\u003eNS12 Software Update Version 8.7:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns12/default.html\"\u003ehttp://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns12/default.html\u003c/a\u003e\u003c/p\u003e\u003cp\u003eNS10 Software Update Version 8.7:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns10/default.html\"\u003ehttp://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns10/default.html\u003c/a\u003e\u003c/p\u003e\u003cp\u003eNS8 Software Update Version 8.7:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns8/default.html\"\u003ehttp://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns8/default.html\u003c/a\u003e\u003c/p\u003e\u003cp\u003eNS5 Software Update Version 8.7:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns5/default.html\"\u003ehttp://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns5/default.html\u003c/a\u003e\u003c/p\u003e\n\n\u003cbr\u003e"
}
],
"value": "Omron Corporation has produced update, Version 8.69x for Japan and \nVersion 8.7x for other countries, that mitigates the identified \nvulnerabilities. The updates for the NS series of HMI terminals can be \ndownloaded at the following locations:\n\n\nNS15 Software Update Version 8.7:\n\n\n http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns15/default.html \n\nNS12 Software Update Version 8.7:\n\n\n http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns12/default.html \n\nNS10 Software Update Version 8.7:\n\n\n http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns10/default.html \n\nNS8 Software Update Version 8.7:\n\n\n http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns8/default.html \n\nNS5 Software Update Version 8.7:\n\n\n http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns5/default.html"
}
],
"source": {
"advisory": "ICSA-14-203-01",
"discovery": "UNKNOWN"
},
"title": "Omron NS Series HMI Cross-Site Request Forgery",
"x_generator": {
"engine": "Vulnogram 0.2.0"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"ID": "CVE-2014-2369",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://ics-cert.us-cert.gov/advisories/ICSA-14-203-01",
"refsource": "MISC",
"url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-203-01"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2014-2369",
"datePublished": "2014-07-24T14:00:00",
"dateReserved": "2014-03-13T00:00:00",
"dateUpdated": "2025-10-06T17:59:20.171Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-2370 (GCVE-0-2014-2370)
Vulnerability from nvd – Published: 2014-07-24 14:00 – Updated: 2025-10-06 18:01
VLAI?
Title
Omron NS Series HMI Improper Neutralization of Input During Web Page Generation
Summary
Cross-site scripting (XSS) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to inject arbitrary web script or HTML via crafted data.
Severity ?
No CVSS data available.
CWE
Assigner
References
Impacted products
Credits
Joel Sevilleja Febrer of S2 Grupo
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T10:14:25.880Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-203-01"
},
{
"name": "68836",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/68836"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NS15",
"vendor": "Omron",
"versions": [
{
"lessThan": "8.68x",
"status": "affected",
"version": "8.1xx",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "NS12",
"vendor": "Omron",
"versions": [
{
"lessThan": "8.68x",
"status": "affected",
"version": "8.1xx",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "NS10",
"vendor": "Omron",
"versions": [
{
"lessThan": "8.68x",
"status": "affected",
"version": "8.1xx",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "NS8",
"vendor": "Omron",
"versions": [
{
"lessThan": "8.68x",
"status": "affected",
"version": "8.1xx",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "NS5",
"vendor": "Omron",
"versions": [
{
"lessThan": "8.68x",
"status": "affected",
"version": "8.1xx",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Joel Sevilleja Febrer of S2 Grupo"
}
],
"datePublic": "2014-07-22T06:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\nCross-site scripting (XSS) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to inject arbitrary web script or HTML via crafted data.\n\n\u003c/p\u003e"
}
],
"value": "Cross-site scripting (XSS) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to inject arbitrary web script or HTML via crafted data."
}
],
"metrics": [
{
"cvssV2_0": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-06T18:01:21.608Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-14-203-01"
},
{
"url": "https://automation.omron.com/en/us/products/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOmron Corporation has produced update, Version 8.69x for Japan and \nVersion 8.7x for other countries, that mitigates the identified \nvulnerabilities. The updates for the NS series of HMI terminals can be \ndownloaded at the following locations:\u003c/p\u003e\n\u003cp\u003eNS15 Software Update Version 8.7:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns15/default.html\"\u003ehttp://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns15/default.html\u003c/a\u003e\u003c/p\u003e\u003cp\u003eNS12 Software Update Version 8.7:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns12/default.html\"\u003ehttp://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns12/default.html\u003c/a\u003e\u003c/p\u003e\u003cp\u003eNS10 Software Update Version 8.7:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns10/default.html\"\u003ehttp://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns10/default.html\u003c/a\u003e\u003c/p\u003e\u003cp\u003eNS8 Software Update Version 8.7:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns8/default.html\"\u003ehttp://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns8/default.html\u003c/a\u003e\u003c/p\u003e\u003cp\u003eNS5 Software Update Version 8.7:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns5/default.html\"\u003ehttp://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns5/default.html\u003c/a\u003e\u003c/p\u003e\n\n\u003cbr\u003e"
}
],
"value": "Omron Corporation has produced update, Version 8.69x for Japan and \nVersion 8.7x for other countries, that mitigates the identified \nvulnerabilities. The updates for the NS series of HMI terminals can be \ndownloaded at the following locations:\n\n\nNS15 Software Update Version 8.7:\n\n\n http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns15/default.html \n\nNS12 Software Update Version 8.7:\n\n\n http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns12/default.html \n\nNS10 Software Update Version 8.7:\n\n\n http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns10/default.html \n\nNS8 Software Update Version 8.7:\n\n\n http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns8/default.html \n\nNS5 Software Update Version 8.7:\n\n\n http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns5/default.html"
}
],
"source": {
"advisory": "ICSA-14-203-01",
"discovery": "EXTERNAL"
},
"title": "Omron NS Series HMI Improper Neutralization of Input During Web Page Generation",
"x_generator": {
"engine": "Vulnogram 0.2.0"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"ID": "CVE-2014-2369",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://ics-cert.us-cert.gov/advisories/ICSA-14-203-01",
"refsource": "MISC",
"url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-203-01"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2014-2370",
"datePublished": "2014-07-24T14:00:00",
"dateReserved": "2014-03-13T00:00:00",
"dateUpdated": "2025-10-06T18:01:21.608Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-2369 (GCVE-0-2014-2369)
Vulnerability from nvd – Published: 2014-07-24 14:00 – Updated: 2025-10-06 17:59
VLAI?
Title
Omron NS Series HMI Cross-Site Request Forgery
Summary
Cross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.
Severity ?
No CVSS data available.
CWE
Assigner
References
Impacted products
Credits
Joel Sevilleja Febrer of S2 Grupo
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T10:14:25.244Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-203-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NS15",
"vendor": "Omron",
"versions": [
{
"lessThan": "8.68x",
"status": "affected",
"version": "8.1xx",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "NS12",
"vendor": "Omron",
"versions": [
{
"lessThan": "8.68x",
"status": "affected",
"version": "8.1xx",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "NS10",
"vendor": "Omron",
"versions": [
{
"lessThan": "8.68x",
"status": "affected",
"version": "8.1xx",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "NS8",
"vendor": "Omron",
"versions": [
{
"lessThan": "8.68x",
"status": "affected",
"version": "8.1xx",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "NS5",
"vendor": "Omron",
"versions": [
{
"lessThan": "8.68x",
"status": "affected",
"version": "8.1xx",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Joel Sevilleja Febrer of S2 Grupo"
}
],
"datePublic": "2014-07-22T06:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.\u003c/p\u003e"
}
],
"value": "Cross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors."
}
],
"metrics": [
{
"cvssV2_0": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-06T17:59:20.171Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-14-203-01"
},
{
"url": "https://automation.omron.com/en/us/products/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOmron Corporation has produced update, Version 8.69x for Japan and \nVersion 8.7x for other countries, that mitigates the identified \nvulnerabilities. The updates for the NS series of HMI terminals can be \ndownloaded at the following locations:\u003c/p\u003e\n\u003cp\u003eNS15 Software Update Version 8.7:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns15/default.html\"\u003ehttp://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns15/default.html\u003c/a\u003e\u003c/p\u003e\u003cp\u003eNS12 Software Update Version 8.7:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns12/default.html\"\u003ehttp://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns12/default.html\u003c/a\u003e\u003c/p\u003e\u003cp\u003eNS10 Software Update Version 8.7:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns10/default.html\"\u003ehttp://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns10/default.html\u003c/a\u003e\u003c/p\u003e\u003cp\u003eNS8 Software Update Version 8.7:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns8/default.html\"\u003ehttp://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns8/default.html\u003c/a\u003e\u003c/p\u003e\u003cp\u003eNS5 Software Update Version 8.7:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns5/default.html\"\u003ehttp://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns5/default.html\u003c/a\u003e\u003c/p\u003e\n\n\u003cbr\u003e"
}
],
"value": "Omron Corporation has produced update, Version 8.69x for Japan and \nVersion 8.7x for other countries, that mitigates the identified \nvulnerabilities. The updates for the NS series of HMI terminals can be \ndownloaded at the following locations:\n\n\nNS15 Software Update Version 8.7:\n\n\n http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns15/default.html \n\nNS12 Software Update Version 8.7:\n\n\n http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns12/default.html \n\nNS10 Software Update Version 8.7:\n\n\n http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns10/default.html \n\nNS8 Software Update Version 8.7:\n\n\n http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns8/default.html \n\nNS5 Software Update Version 8.7:\n\n\n http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns5/default.html"
}
],
"source": {
"advisory": "ICSA-14-203-01",
"discovery": "UNKNOWN"
},
"title": "Omron NS Series HMI Cross-Site Request Forgery",
"x_generator": {
"engine": "Vulnogram 0.2.0"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"ID": "CVE-2014-2369",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://ics-cert.us-cert.gov/advisories/ICSA-14-203-01",
"refsource": "MISC",
"url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-203-01"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2014-2369",
"datePublished": "2014-07-24T14:00:00",
"dateReserved": "2014-03-13T00:00:00",
"dateUpdated": "2025-10-06T17:59:20.171Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}