Multiple untrusted search path vulnerabilities in RealFlex RealWin before 2.1.13, FlexView before 3.1.86, and RealWinDemo before 2.1.13 allow local users to gain privileges via a Trojan horse (1) realwin.dll or (2) keyhook.dll file in the current working directory.

Multiple stack-based buffer overflows in the HMI application in DATAC RealFlex RealWin 2.1 (Build 6.1.10.10) and earlier allow remote attackers to execute arbitrary code via (1) a long username in an OnFCCONNECTFCSLOGIN packet, and crafted (2) OnFCCTAGLISTFCSCADDTAG, (3) OnFCCTAGLISTFCSCDELTAG, (4) OnFCCTAGLISTFCSADDTAGMS, (5) OnFCRFUSERFCSLOGIN, (6) unspecified "OnFCBINFILEFCSFILE", (7) OnFCCGETTAGFCSGETTELEMETRY, (8) OnFCCGETTAGFCSGETCHANNELTELEMETRY, (9) OnFCCGETTAGFCSSETTELEMETRY, (10) OnFCCGETTAGFCSSETCHANNELTELEMETRY, and (11) OnFCSCRIPTFCSSTARTPROG packets to port 910.

Multiple integer overflows in the HMI application in DATAC RealFlex RealWin 2.1 (Build 6.1.10.10) and earlier allow remote attackers to execute arbitrary code via crafted (1) OnFCMISCFCSMSGBROADCAST and (2) OnFCMISCFCSMSGSEND packets, which trigger a heap-based buffer overflow.

Multiple stack-based buffer overflows in DATAC RealWin 2.0 Build 6.1.8.10 and earlier allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) SCPCINITIALIZE, (2) SCPCINITIALIZERF, or (3) SCPCTXTEVENT packet. NOTE: it was later reported that 1.06 is also affected by one of these requests.