The Data Archiver service in GE Intelligent Platforms Proficy Historian 4.5 and earlier allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted session on TCP port 14000 to (1) ihDataArchiver.exe or (2) ihDataArchiverx64.exe.
Cross-site scripting (XSS) vulnerability in the Web Administrator component in GE Intelligent Platforms Proficy Historian 4.x and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
Stack-based buffer overflow in the Data Archiver service in GE Intelligent Platforms Proficy Historian before 3.5 SIM 17 and 4.x before 4.0 SIM 12 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via crafted TCP message traffic.
An unauthorized user with network access and the decryption key could decrypt sensitive data, such as usernames and passwords.
An unauthorized user could possibly delete any file on the system.
An unauthorized user could be able to read any file on the system, potentially exposing sensitive information.
An unauthorized user could alter or write files with full control over the path and content of the file.
Even if the authentication fails for local service authentication, the requested command could still execute regardless of authentication status.