CVE-2022-29490

Improper Authorization vulnerability exists in the Workplace X WebUI of the Hitachi Energy MicroSCADA X SYS600 allows an authenticated user to execute any MicroSCADA internal scripts irrespective of the authenticated user's role. This issue affects: Hitachi Energy MicroSCADA X SYS600 version 10 to version 10.3.1. cpe:2.3:a:hitachienergy:microscada_x_sys600:10:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.1.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3.1:*:*:*:*:*:*:*

• CWE-285

• https://search.abb.com/library/Download.aspx?DocumentID=8DBD000106&LanguageCode=en&DocumentPartId=&Action=LaunchVendor Advisory
• https://search.abb.com/library/Download.aspx?DocumentID=8DBD000106&LanguageCode=en&DocumentPartId=&Action=LaunchVendor Advisory

Published

Sep 12, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-29485Cross-site scripting vulnerability in SHIRASAGI v1.0.0 to v1…6.1
• CVE-2022-29486Improper buffer restrictions in the Hyperscan library mainta…9.8
• CVE-2022-29487Cross-site scripting vulnerability in Cybozu Office 10.0.0 t…6.1
• CVE-2022-29488The affected product is vulnerable to an out-of-bounds read …7.8
• CVE-2022-29489Cross-Site Request Forgery (CSRF) vulnerability in Sucuri Se…4.3
• CVE-2022-2949 Altair HyperView Player versions 2021.1.0.27 and prior ar…7.8
• CVE-2022-29491On F5 BIG-IP LTM, Advanced WAF, ASM, or APM 16.1.x versions …7.5
• CVE-2022-29492Improper Input Validation vulnerability in the handling of a…7.5
• CVE-2022-29493Uncaught exception in webserver for the Integrated BMC in so…4.9
• CVE-2022-29494Improper input validation in firmware for OpenBMC in some In…6.5
• CVE-2022-29495Cross-Site Request Forgery (CSRF) vulnerability in Sygnoos P…4.3
• CVE-2022-29496A stack-based buffer overflow vulnerability exists in the Bl…9.8