GCVE - cpe:2.3:a:arcinfo:pcvue:12.0.0:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:arcinfo:pcvue:12.0.0:*:*:*:*:*:*:*

part: a version: 12.0.0 update: *

Vendor	Arcinfo (`1ba980a3-533a-596f-8971-971bc8616eb1`)
Product	Pcvue (`8ea0ae23-3487-5eb4-942b-d33ae648b7a6`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-1697`	vulnerable	2026-06-08 07:49:09.384497	Use of unsecure cookies for GraphicalData web service and WebClient web app The Secure and SameSite attribute are missing in the GraphicalData web services and WebClient web app of PcVue in version 12.0.0 through 16.3.3 included. Published: 2026-02-26T07:57:46.166Z Updated: 2026-03-26T08:24:24.828Z Open on db.gcve.eu Reference links https://www.pcvue.com/security/#SB2026-2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-1696`	vulnerable	2026-06-08 07:49:09.383891	Missing security HTTP headers Some HTTP security headers are not properly set by the web server when sending responses to the client application. Published: 2026-02-26T07:57:29.109Z Updated: 2026-03-26T08:23:46.958Z Open on db.gcve.eu Reference links https://www.pcvue.com/security/#SB2026-2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-1695`	vulnerable	2026-06-08 07:49:09.383291	XSS vulnerability upon unsuccessful authentication An XSS vulnerability affects the OAuth web services used by the WebVue, WebScheduler, TouchVue and SnapVue features of PcVue in version 12.0.0 through 16.3.3 included. It might allow a remote attacker to trick a legitimate user into loading content from another site upon unsuccessful user authentication on an unknown application (unknown client_id). This vulnerability only affects the error page of the OAuth server. Published: 2026-02-26T07:57:11.931Z Updated: 2026-03-26T08:23:05.985Z Open on db.gcve.eu Reference links https://www.pcvue.com/security/#SB2026-2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-1694`	vulnerable	2026-06-08 07:49:09.382616	Server configuration details in HTTP headers HTTP headers are added by the default configuration of IIS and ASP.net, and are not removed at the deployment phase of the webservices used by the WebVue, WebScheduler, TouchVue and SnapVue features of PcVue in version 12.0.0 through 16.3.3 included. It unnecessarily exposes sensitive information about the server configuration. Published: 2026-02-26T07:56:57.048Z Updated: 2026-03-26T08:22:30.221Z Open on db.gcve.eu Reference links https://www.pcvue.com/security/#SB2026-2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-1693`	vulnerable	2026-06-08 07:49:09.381861	Use of vulnerable Resource Owner Password Credentials flow The OAuth grant type Resource Owner Password Credentials (ROPC) flow is still used by the werbservices used by the WebVue, WebScheduler, TouchVue and Snapvue features of PcVue in version 12.0.0 through 16.3.3 included despite being deprecated. It might allow a remote attacker to steal user credentials. Published: 2026-02-26T07:56:10.326Z Updated: 2026-03-26T08:20:52.634Z Open on db.gcve.eu Reference links https://www.pcvue.com/security/#SB2026-2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-1692`	vulnerable	2026-06-08 07:49:09.379821	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.