Xarrow maintains a narrowly focused web application product where the vulnerability profile centers on input-handling deficiencies, including cross-site scripting, improper input validation, and buffer-boundary violations. These weakness classes are characteristic of application-layer parsing and output-encoding challenges, and defenders should treat this vendor's updates as part of routine web-application security monitoring. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Xarrow over time
Signals from CVEs in this vendor scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2012-2428HIGH Integer overflow in the server in xArrow before 3.4.1 allows remote attackers to execute arbitrary code via a crafted packet that triggers an out-of-bounds read operation. | May 25, 2012 | 10.0 | 30 | NO | NO |
CVE-2012-2427HIGH Heap-based buffer overflow in the server in xArrow before 3.4.1 allows remote attackers to execute arbitrary code via packets that trigger an invalid free operation. | May 25, 2012 | 10.0 | 30 | NO | NO |
CVE-2012-2429HIGH The server in xArrow before 3.4.1 performs an invalid read operation, which allows remote attackers to execute arbitrary code via unspecified vectors. | May 25, 2012 | 10.0 | 29 | NO | NO |
CVE-2021-33025HIGH xArrow SCADA versions 7.2 and prior permits unvalidated registry keys to be run with application-level privileges. | May 16, 2022 | 7.8 | 25 | NO | NO |
CVE-2012-2426HIGH The server in xArrow before 3.4.1 does not properly allocate memory, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via unsp | May 25, 2012 | 7.8 | 25 | NO | NO |
CVE-2021-33021MEDIUM xArrow SCADA versions 7.2 and prior is vulnerable to cross-site scripting due to parameter ‘edate’ of the resource xhisalarm.htm, which may allow an unauthorized attacker to execut | May 16, 2022 | 6.1 | 21 | NO | NO |
CVE-2021-33001MEDIUM xArrow SCADA versions 7.2 and prior is vulnerable to cross-site scripting due to parameter ‘bdate’ of the resource xhisvalue.htm, which may allow an unauthorized attacker to execut | May 16, 2022 | 6.1 | 21 | NO | NO |
Signals from CVEs in this vendor scope (7 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Xarrow.
Media articles that mention a CVE ID that affects a product developed by Xarrow — matched by CVE ID, not by vendor name.