Lucene search

K

I Security Vulnerabilities

cve
cve

CVE-2017-1000234

I, Librarian version <=4.6 & 4.7 is vulnerable to Directory Enumeration in the jqueryFileTree.php resulting in attacker enumerating directories simply by navigating through the "dir"...

5.3CVSS

5.2AI Score

0.001EPSS

2022-10-03 04:23 PM
25
cve
cve

CVE-2018-20159

i-doit open 1.11.2 allows Remote Code Execution because ZIP archives are mishandled. It has an upload feature that allows an authenticated user with the administrator role to upload arbitrary files to the main website directory. Exploitation involves uploading a ".php" file within a ".zip" file...

7.2CVSS

7.2AI Score

0.021EPSS

2022-10-03 04:22 PM
26
cve
cve

CVE-2018-1000137

I, Librarian version 4.8 and earlier contains a Cross site Request Forgery (CSRF) vulnerability in users.php that can result in the password of the admin being forced to be changed without the administrator's...

8.8CVSS

8.8AI Score

0.001EPSS

2022-10-03 04:21 PM
22
cve
cve

CVE-2018-1000139

I, Librarian version 4.8 and earlier contains a Cross Site Scripting (XSS) vulnerability in "id" parameter in stable.php that can result in an attacker using the XSS to send a malicious script to an unsuspecting...

6.1CVSS

5.7AI Score

0.001EPSS

2022-10-03 04:21 PM
23
cve
cve

CVE-2018-1000138

I, Librarian version 4.8 and earlier contains a SSRF vulnerability in "url" parameter of getFromWeb in functions.php that can result in the attacker abusing functionality on the server to read or update internal...

9.1CVSS

8.9AI Score

0.002EPSS

2022-10-03 04:21 PM
31
cve
cve

CVE-2018-1000141

I, Librarian version 4.9 and earlier contains an Incorrect Access Control vulnerability in ajaxdiscussion.php that can result in any users gaining unauthorized access (read, write and delete) to project...

9.1CVSS

9.1AI Score

0.002EPSS

2022-10-03 04:21 PM
23
cve
cve

CVE-2018-1000124

I Librarian I-librarian version 4.8 and earlier contains a XML External Entity (XXE) vulnerability in line 154 of importmetadata.php(simplexml_load_string) that can result in an attacker reading the contents of a file and SSRF. This attack appear to be exploitable via posting xml in the Parameter.....

10CVSS

9.2AI Score

0.003EPSS

2022-10-03 04:21 PM
25
cve
cve

CVE-2010-4557

Buffer overflow in the lm_tcp service in Invensys Wonderware InBatch 8.1 and 9.0, as used in Invensys Foxboro I/A Series Batch 8.1 and possibly other products, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted request to port...

8.2AI Score

0.041EPSS

2022-10-03 04:21 PM
19
cve
cve

CVE-2014-2231

Cross-site scripting (XSS) vulnerability in the API in synetics i-doit pro before 1.2.5 allows remote attackers to inject arbitrary web script or HTML via a property...

5.8AI Score

0.001EPSS

2022-10-03 04:20 PM
20
cve
cve

CVE-2012-2022

Multiple cross-site scripting (XSS) vulnerabilities in HP Network Node Manager i (NNMi) 8.x, 9.0x, 9.1x, and 9.20 allow remote attackers to inject arbitrary web script or HTML via unspecified...

5.8AI Score

0.002EPSS

2022-10-03 04:15 PM
24
cve
cve

CVE-2012-2516

An ActiveX control in KeyHelp.ocx in KeyWorks KeyHelp Module (aka the HTML Help component), as used in GE Intelligent Platforms Proficy Historian 3.1, 3.5, 4.0, and 4.5; Proficy HMI/SCADA iFIX 5.0 and 5.1; Proficy Pulse 1.0; Proficy Batch Execution 5.6; SI7 I/O Driver 7.20 through 7.42; and other.....

7.7AI Score

0.905EPSS

2022-10-03 04:15 PM
122
cve
cve

CVE-2012-2515

Multiple stack-based buffer overflows in the KeyHelp.KeyCtrl.1 ActiveX control in KeyHelp.ocx 1.2.312 in KeyWorks KeyHelp Module (aka the HTML Help component), as used in EMC Documentum ApplicationXtender Desktop 5.4; EMC Captiva Quickscan Pro 4.6 SP1; GE Intelligent Platforms Proficy Historian...

7.9AI Score

0.914EPSS

2022-10-03 04:15 PM
44
cve
cve

CVE-2012-4879

The Linux Console on the WAGO I/O System 758 model 758-870, 758-874, 758-875, and 758-876 Industrial PC (IPC) devices has a default password of wago for the (1) root and (2) admin accounts, (3) a default password of user for the user account, and (4) a default password of guest for the guest...

6.9AI Score

0.004EPSS

2022-10-03 04:15 PM
27
cve
cve

CVE-2012-6442

Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and.....

6.6AI Score

0.029EPSS

2022-10-03 04:15 PM
35
cve
cve

CVE-2012-6438

Buffer overflow in Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier;....

6.9AI Score

0.027EPSS

2022-10-03 04:15 PM
35
cve
cve

CVE-2012-6440

The web-server password-authentication functionality in Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and.....

6.5AI Score

0.001EPSS

2022-10-03 04:15 PM
40
cve
cve

CVE-2012-6435

Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and.....

6.6AI Score

0.006EPSS

2022-10-03 04:15 PM
28
cve
cve

CVE-2012-6441

Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and.....

6.1AI Score

0.025EPSS

2022-10-03 04:15 PM
33
cve
cve

CVE-2012-6437

Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and.....

8.1AI Score

0.001EPSS

2022-10-03 04:15 PM
41
cve
cve

CVE-2012-6439

Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and.....

6.7AI Score

0.001EPSS

2022-10-03 04:15 PM
34
cve
cve

CVE-2012-6436

Buffer overflow in Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier;....

6.9AI Score

0.027EPSS

2022-10-03 04:15 PM
30
cve
cve

CVE-2012-3013

WAGO I/O System 758 model 758-870, 758-874, 758-875, and 758-876 Industrial PC (IPC) devices have default passwords for unspecified Web Based Management accounts, which makes it easier for remote attackers to obtain administrative access via a TCP...

6.8AI Score

0.004EPSS

2022-10-03 04:15 PM
24
cve
cve

CVE-2012-3279

Multiple cross-site scripting (XSS) vulnerabilities in HP Network Node Manager i (NNMi) 8.x, 9.0x, 9.1x, and 9.20 allow remote attackers to inject arbitrary web script or HTML via unspecified...

5.8AI Score

0.002EPSS

2022-10-03 04:15 PM
31
cve
cve

CVE-2013-2351

Unspecified vulnerability in HP Network Node Manager i (NNMi) 9.00, 9.1x, and 9.2x allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via unknown...

6.8AI Score

0.008EPSS

2022-10-03 04:15 PM
24
cve
cve

CVE-2022-22423

IBM Common Cryptographic Architecture (CCA 5.x MTM for 4767 and CCA 7.x MTM for 4769) could allow a local user to cause a denial of service due to improper input validation. IBM X-Force ID:...

5.5CVSS

5.3AI Score

0.0004EPSS

2022-09-23 06:15 PM
25
7
cve
cve

CVE-2022-34336

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...

5.4CVSS

5.1AI Score

0.001EPSS

2022-09-13 09:15 PM
28
5
cve
cve

CVE-2022-34165

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 22.0.0.9 are vulnerable to HTTP header injection, caused by improper validation. This could allow an attacker to conduct various attacks against the vulnerable system, including...

5.4CVSS

5AI Score

0.001EPSS

2022-09-09 04:15 PM
99
7
cve
cve

CVE-2021-46304

A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions), CP-8000 MASTER MODULE WITH I/O -40/+70°C (All versions), CP-8021 MASTER MODULE (All versions), CP-8022 MASTER MODULE WITH GPRS (All versions). The component allows to activate a web server module which.....

7.5CVSS

7.3AI Score

0.001EPSS

2022-08-10 12:15 PM
39
6
cve
cve

CVE-2022-35643

IBM PowerVM VIOS 3.1 could allow a remote attacker to tamper with system configuration or cause a denial of service. IBM X-Force ID:...

9.1CVSS

8.7AI Score

0.001EPSS

2022-07-29 02:15 PM
34
5
cve
cve

CVE-2022-29962

The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. FTP has hardcoded credentials (but may often be disabled in production). This affects S-series, P-series, and CIOC/EIOC nodes. NOTE: this is different from...

5.5CVSS

5.2AI Score

0.004EPSS

2022-07-26 10:15 PM
51
cve
cve

CVE-2022-29965

The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. Access to privileged operations on the maintenance port TELNET interface (23/TCP) on M-series and SIS (CSLS/LSNB/LSNG) nodes is controlled by means of utility passwords. These...

5.5CVSS

5.3AI Score

0.004EPSS

2022-07-26 10:15 PM
54
3
cve
cve

CVE-2022-29963

The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. TELNET on port 18550 provides access to a root shell via hardcoded credentials. This affects S-series, P-series, and CIOC/EIOC nodes. NOTE: this is different from...

5.5CVSS

5.2AI Score

0.004EPSS

2022-07-26 10:15 PM
63
2
cve
cve

CVE-2022-29964

The Emerson DeltaV Distributed Control System (DCS) controllers and IO cards through 2022-04-29 misuse passwords. WIOC SSH provides access to a shell as root, DeltaV, or backup via hardcoded credentials. NOTE: this is different from...

5.5CVSS

5.2AI Score

0.004EPSS

2022-07-26 10:15 PM
147
3
cve
cve

CVE-2022-22473

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information caused by improper handling of Administrative Console data. This information could be used in further attacks against the system. IBM X-Force ID:...

5.3CVSS

5.1AI Score

0.001EPSS

2022-07-14 05:15 PM
55
2
cve
cve

CVE-2022-22477

IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...

6.1CVSS

5.8AI Score

0.001EPSS

2022-07-14 05:15 PM
39
4
cve
cve

CVE-2022-34358

IBM i 7.2, 7.3, 7.4, and 7.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...

5.4CVSS

5.2AI Score

0.001EPSS

2022-07-13 05:15 PM
39
3
cve
cve

CVE-2022-29884

A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions < CPC80 V16.30), CP-8000 MASTER MODULE WITH I/O -40/+70°C (All versions < CPC80 V16.30), CP-8021 MASTER MODULE (All versions < CPC80 V16.30), CP-8022 MASTER MODULE WITH GPRS (All versions < CPC...

7.5CVSS

7.4AI Score

0.002EPSS

2022-07-12 10:15 AM
39
3
cve
cve

CVE-2022-22495

IBM i 7.3, 7.4, and 7.5 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID:...

8.8CVSS

8.7AI Score

0.001EPSS

2022-05-24 05:15 PM
55
6
cve
cve

CVE-2022-26532

A argument injection vulnerability in the 'packet-trace' CLI command of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, VPN series firmware versions 4.30 through 5.21, NSG series...

7.8CVSS

8AI Score

0.001EPSS

2022-05-24 06:15 AM
95
8
cve
cve

CVE-2022-26531

Multiple improper input validation flaws were identified in some CLI commands of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, VPN series firmware versions 4.30 through 5.21, NSG...

7.8CVSS

7.8AI Score

0.0004EPSS

2022-05-24 06:15 AM
48
7
cve
cve

CVE-2022-22481

IBM Navigator for i 7.2, 7.3, and 7.4 (heritage version) could allow a remote attacker to obtain access to the web interface without valid credentials. By modifying the sign on request, an attacker can gain visibility to the fully qualified domain name of the target system and the navigator tasks.....

5.3CVSS

5.2AI Score

0.001EPSS

2022-05-09 05:15 PM
47
4
cve
cve

CVE-2021-32976

Five buffer overflows in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote attacker to initiate a denial-of-service attack and execute arbitrary...

9.8CVSS

9.6AI Score

0.006EPSS

2022-04-01 11:15 PM
69
cve
cve

CVE-2021-32974

Improper input validation in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote attacker to execute...

9.8CVSS

9.4AI Score

0.004EPSS

2022-04-01 11:15 PM
60
cve
cve

CVE-2021-32970

Data can be copied without validation in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier, which may allow a remote attacker to cause denial-of-service...

7.5CVSS

7.4AI Score

0.002EPSS

2022-04-01 11:15 PM
70
cve
cve

CVE-2021-32968

Two buffer overflows in the built-in web server in Moxa NPort IAW5000A-I/O Series firmware version 2.2 or earlier may allow a remote attacker to cause a denial-of-service...

7.5CVSS

7.5AI Score

0.002EPSS

2022-04-01 11:15 PM
57
cve
cve

CVE-2021-22277

Improper Input Validation vulnerability in ABB 800xA, Control Software for AC 800M, Control Builder Safe, Compact Product Suite - Control and I/O, ABB Base Software for SoftControl allows an attacker to cause the denial of...

7.5CVSS

7.4AI Score

0.001EPSS

2022-04-01 11:15 PM
59
cve
cve

CVE-2021-26620

An improper authentication vulnerability leading to information leakage was discovered in iptime NAS2dual. Remote attackers are able to steal important information in the server by exploiting vulnerabilities such as insufficient authentication when accessing the shared folder and changing user’s...

7.5CVSS

7.7AI Score

0.002EPSS

2022-03-25 07:15 PM
55
cve
cve

CVE-2022-21170

Improper check for certificate revocation in i-FILTER Ver.10.45R01 and earlier, i-FILTER Ver.9.50R10 and earlier, i-FILTER Browser & Cloud MultiAgent for Windows Ver.4.93R04 and earlier, and D-SPA (Ver.3 / Ver.4) using i-FILTER allows a remote unauthenticated attacker to conduct a...

3.7CVSS

4.4AI Score

0.005EPSS

2022-03-10 05:45 PM
61
cve
cve

CVE-2020-14504

The web interface of the 1734-AENTR communication module mishandles authentication for HTTP POST requests. A remote, unauthenticated attacker can send a crafted request that may allow for modification of the configuration...

5.3CVSS

5.5AI Score

0.001EPSS

2022-02-24 07:15 PM
31
cve
cve

CVE-2020-14502

The web interface of the 1734-AENTR communication module is vulnerable to stored XSS. A remote, unauthenticated attacker could store a malicious script within the web interface that, when executed, could modify some string values on the homepage of the web...

6.1CVSS

6.2AI Score

0.001EPSS

2022-02-24 07:15 PM
27
Total number of security vulnerabilities402