Pcvue

The encryption algorithm used to protect the configuration of user accounts, stored in the built-in user directory of PcVue projects, all versions prior to 17.0.0, is not strong enough for the level of protection required. A local attacker could alter the existing configuration and ultimately gain privileged access to the PcVue application.

Published: 2026-07-07T09:26:55.347Z
Updated: 2026-07-07T12:07:31.124Z

Credentials of built-in users are insecurely stored in the User directory of PcVue projects, all versions prior to 17.0.0. A local attacker could retrieve users’ credentials.  Active Directory accounts are not affected by this vulnerability.

Published: 2026-07-07T09:25:57.741Z
Updated: 2026-07-07T12:09:29.277Z

A HTTP Host header attack vulnerability affects WebClient and the WebScheduler web apps of PcVue in version 15.0.0 through 16.3.3 included, allowing a remote attacker to inject harmful payloads that manipulate server-side behavior. This vulnerability only affects the endpoints /Authentication/ExternalLogin, /Authentication/AuthorizationCodeCallback and /Authentication/Logout of the WebClient and WebScheduler web apps.

Published: 2026-02-26T07:58:00.626Z
Updated: 2026-03-26T08:25:09.394Z

The Secure and SameSite attribute are missing in the GraphicalData web services and WebClient web app of PcVue in version 12.0.0 through 16.3.3 included.

Published: 2026-02-26T07:57:46.166Z
Updated: 2026-03-26T08:24:24.828Z

Some HTTP security headers are not properly set by the web server when sending responses to the client application.

Published: 2026-02-26T07:57:29.109Z
Updated: 2026-03-26T08:23:46.958Z