Ptc
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in any Ptc product.
RSS Feeds for Ptc security vulnerabilities
Create a CVE RSS feed including security vulnerabilities found in Ptc products with stack.watch. Just hit watch, then grab your custom RSS feed url.
Products by Ptc Sorted by Most Security Vulnerabilities since 2018
By the Year
In 2026 there have been 0 vulnerabilities in Ptc. Ptc did not have any published security vulnerabilities last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 0 | 0.00 |
| 2025 | 0 | 0.00 |
| 2024 | 5 | 6.32 |
| 2023 | 12 | 8.02 |
| 2022 | 7 | 8.03 |
| 2021 | 0 | 0.00 |
| 2020 | 0 | 0.00 |
| 2019 | 0 | 0.00 |
| 2018 | 4 | 6.47 |
It may take a day or so for new Ptc vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Ptc Security Vulnerabilities
| CVE | Date | Vulnerability | Products |
|---|---|---|---|
| CVE-2024-40395 | Aug 27, 2024 |
IDOR in PTC ThingWorx v9.5.0 allows PII leakAn Insecure Direct Object Reference (IDOR) in PTC ThingWorx v9.5.0 allows attackers to view sensitive information, including PII, regardless of access level. |
Thingworx
|
| CVE-2023-29445 | Jan 10, 2024 |
Windows DLL Hijacking: Uncontrolled Search Path Element for Priv EscalationAn uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM. |
Kepware Kepserverex
Thingworx Kepware Server
Thingworx Industrial Connectivity
And others... |
| CVE-2023-29446 | Jan 10, 2024 |
MS VS UNC Path Injection via Malicious Project Captures NTLMv2 HashesAn improper input validation vulnerability has been discovered that could allow an adversary to inject a UNC path via a malicious project file. This allows an adversary to capture NLTMv2 hashes and potentially crack them offline. |
Kepware Kepserverex
Thingworx Kepware Server
Thingworx Industrial Connectivity
And others... |
| CVE-2023-29447 | Jan 10, 2024 |
KEPServerEX: Insufficiently Protected Credentials in Web Basic AuthAn insufficiently protected credentials vulnerability in KEPServerEX could allow an adversary to capture user credentials as the web server uses basic authentication. |
Kepware Kepserverex
Thingworx Kepware Server
Thingworx Industrial Connectivity
And others... |
| CVE-2023-29444 | Jan 10, 2024 |
Microsoft Windows DLL Hijacking Elevation via Uncontrolled Search PathAn uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM. Alternatively, they could host a trojanized version of the software and trick victims into downloading and installing their malicious version to gain initial access and code execution. |
Kepware Kepserverex
Thingworx Kepware Server
Thingworx Industrial Connectivity
And others... |
| CVE-2023-5908 | Nov 30, 2023 |
KEPServerEX Buffer Overflow Enables Crash / Info LeakKEPServerEX is vulnerable to a buffer overflow which may allow an attacker to crash the product being accessed or leak information. |
Thingworx Industrial Connectivity
Thingworx Kepware Edge
Opc Aggregator
And others... |
| CVE-2023-5909 | Nov 30, 2023 |
KEPServerEX Unvalidated Client Certs Enable Unauth ConnectionsKEPServerEX does not properly validate certificates from clients which may allow unauthenticated users to connect. |
Thingworx Industrial Connectivity
Thingworx Kepware Edge
Opc Aggregator
And others... |
| CVE-2023-27881 | Jun 07, 2023 |
Moodle Arbitrary File Upload via Upload Resource (CVE-2023-27881)A user could use the Upload Resource functionality to upload files to any location on the disk. |
Vuforia Studio
|
| CVE-2023-29168 | Jun 07, 2023 |
Vuforia Web App: Unencrypted Basic Auth Credentials Exposed (CVE-2023-29168)The local Vuforia web application does not support HTTPS, and federated credentials are passed via basic authentication. |
Vuforia Studio
|
| CVE-2023-31200 | Jun 07, 2023 |
PTC Vuforia Studio No-Token Auth Allows CSRF / Replay AttackPTC Vuforia Studio does not require a token; this could allow an attacker with local access to perform a cross-site request forgery attack or a replay attack. |
Vuforia Studio
|
| CVE-2023-29152 | Jun 07, 2023 |
Vuforia Server Filename Param Allows Deletion of Arbitrary FilesBy changing the filename parameter in the request, an attacker could delete any file with the permissions of the Vuforia server account. |
Vuforia Studio
|
| CVE-2023-24476 | Jun 07, 2023 |
Local Traffic Replay Enables Unauthorized Request Execution (CVE-2023-24476)An attacker with local access to the machine could record the traffic, which could allow them to resend requests without the server authenticating that the user or session are valid. |
Vuforia Studio
|
| CVE-2023-29502 | Jun 07, 2023 |
Vuforia: resourceDirectory Path Manipulation in appConfig.jsonBefore importing a project into Vuforia, a user could modify the resourceDirectory attribute in the appConfig.json file to be a different path. |
Vuforia Studio
|
| CVE-2022-2825 | Mar 29, 2023 |
Remote Code Exec via Stack Buffer Overflow in Kepware KEPServerEX 6.11This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kepware KEPServerEX 6.11.718.0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of text encoding conversions. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-18411. |
Thingworx Industrial Connectivity
Thingworx Kepware Edge
Opc Aggregator
And others... |
| CVE-2022-2848 | Mar 29, 2023 |
RCE in Kepware KEPServerEX 6.11.718.0 via Encoding Buffer OverflowThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Kepware KEPServerEX 6.11.718.0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of text encoding conversions. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-16486. |
Thingworx Industrial Connectivity
Thingworx Kepware Edge
Opc Aggregator
And others... |
| CVE-2023-0754 | Feb 23, 2023 |
Integer Overflow in Unknown Server RCE & Crash (CVE-2023-0754)The affected products are vulnerable to an integer overflow or wraparound, which could allow an attacker to crash the server and remotely execute arbitrary code. |
Thingworx Kepware Edge
Thingworx Net Sdk
Thingworx Edge C Sdk
And others... |
| CVE-2023-0755 | Feb 23, 2023 |
Improper Array Index Validation Enables Remote Code ExecutionThe affected products are vulnerable to an improper validation of array index, which could allow an attacker to crash the server and remotely execute arbitrary code. |
Thingworx Industrial Connectivity
Thingworx Kepware Edge
Thingworx Net Sdk
And others... |
| CVE-2022-25246 | Mar 16, 2022 |
Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) uses hard-coded credentials for its UltraVNC installationAxeda agent (All versions) and Axeda Desktop Server for Windows (All versions) uses hard-coded credentials for its UltraVNC installation. Successful exploitation of this vulnerability could allow a remote authenticated attacker to take full remote control of the host operating system. |
Axeda Agent
Axeda Desktop Server
|
| CVE-2022-25247 | Mar 16, 2022 |
Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) mayAxeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send certain commands to a specific port without authentication. Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to obtain full file-system access and remote code execution. |
Axeda Agent
Axeda Desktop Server
|
| CVE-2022-25248 | Mar 16, 2022 |
When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) supplies the event log of the specific service.When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) supplies the event log of the specific service. |
Axeda Agent
Axeda Desktop Server
|
| CVE-2022-25249 | Mar 16, 2022 |
When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) (disregarding Axeda agent v6.9.2 and v6.9.3) is vulnerable to directory traversal, which couldWhen connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) (disregarding Axeda agent v6.9.2 and v6.9.3) is vulnerable to directory traversal, which could allow a remote unauthenticated attacker to obtain file system read access via web server.. |
Axeda Agent
Axeda Desktop Server
|
| CVE-2022-25250 | Mar 16, 2022 |
When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) mayWhen connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send a certain command to a specific port without authentication. Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to shut down a specific service. |
Axeda Agent
Axeda Desktop Server
|
| CVE-2022-25251 | Mar 16, 2022 |
When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) mayWhen connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send certain XML messages to a specific port without proper authentication. Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to read and modify the affected products configuration. |
Axeda Agent
Axeda Desktop Server
|
| CVE-2022-25252 | Mar 16, 2022 |
When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) when receiving certain input throws an exceptionWhen connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) when receiving certain input throws an exception. Services using said function do not handle the exception. Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to crash the affected product. |
Axeda Agent
Axeda Desktop Server
|
| CVE-2018-20092 | Dec 17, 2018 |
PTC ThingWorx Platform through 8.3.0 is vulnerable to a directory traversal attack on ZIP filesPTC ThingWorx Platform through 8.3.0 is vulnerable to a directory traversal attack on ZIP files via a POST request. |
Thingworx Platform
|
| CVE-2018-17216 | Oct 01, 2018 |
An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2. There is password hash exposure to privileged users. |
Thingworx Platform
|
| CVE-2018-17218 | Oct 01, 2018 |
An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2. There is reflected XSS in the SQUEAL search function. |
Thingworx Platform
|
| CVE-2018-17217 | Oct 01, 2018 |
An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2. There is a hardcoded encryption key. |
Thingworx Platform
|