Motorola Solutions MDLC

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely Vendor: Motorola Solutions Equipment: MDLC Vulnerabilities: Use of a Broken or Risky Cryptographic Algorithm, Plaintext Storage of a Password CISA is aware of a public report, known as “OT:ICEFALL” that details vulnerabilities found...

Motorola Solutions MOSCAD IP and ACE IP Gateways

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely Vendor: Motorola Solutions Equipment: MOSCAD IP Gateway and ACE IP Gateway Vulnerability: Missing Authentication for Critical Function CISA is aware of a public report, known as “OT:ICEFALL” that details vulnerabilities found in...

Security Bulletin: IBM WebSphere Application Server Liberty for IBM i is vulnerable to identity spoofing and port status query (CVE-2022-22475 CVE-2022-22393)

Summary IBM WebSphere Application Server Liberty for IBM i is vulnerable to identity spoofing by an authenticated user and the ability to obtain the status of application server ports as described in the vulnerability details section. IBM i has addressed the CVEs by providing fixes to IBM WebSphe...

AutomationDirect DirectLOGIC with Ethernet

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: AutomationDirect Equipment: DirectLOGIC with Ethernet Communication Modules Vulnerabilities: Uncontrolled Resource Consumption, Cleartext Transmission of Sensitive Information 2. UPDATE OR REPOSTED...

Mitsubishi Electric MELSEC iQ-R, Q, L Series and MELIPC Series (Update C)

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION : Exploitable remotely/low attack complexity Vendor : Mitsubishi Electric Equipment : MELSEC iQ-R, Q, and L Series CPU Module; MELIPC Series CPU Vulnerability : Improper Resource Locking 2. RISK EVALUATION Successful exploitation of this vulnerability...

Meridian Cooperative Meridian

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Meridian Cooperative Equipment: Meridian Vulnerability: Improper Access Control 2. RISK EVALUATION Successful exploitation of this vulnerability could result in a disclosure of sensitive information...

IBM i SQL Injection Vulnerability (CNVD-2022-63180)

IBM i is a set of operating systems from IBM running in IBM Power Systems and IBM PureSystems. IBM i versions 7.3, 7.4 and 7.5 have a SQL injection vulnerability, which stems from the application's lack of validation of external input SQL statements and can be used by attackers to execute illegal...

Open Automation Software Platform Engine SecureAddSecurity external config control vulnerability

Summary An external config control vulnerability exists in the OAS Engine SecureAddSecurity functionality of Open Automation Software OAS Platform V16.00.0112. A specially-crafted series of network requests can lead to the creation of a custom Security Group. An attacker can send a sequence of...

Security Bulletin: A vulnerability in IBM WebSphere Application Server Liberty affects IBM Spectrum Scale packaged in IBM Elastic Storage System (CVE-2021-39031)

Summary There is a vulnerability in IBM WebSphere Application Server Liberty, used by IBM Elastic Storage System, which could allow a remote attacker to cause a denial of service. Vulnerability Details CVEID:CVE-2021-39031 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through...

EmpireCMS SQL Injection Vulnerability

EmpireCMS Empire Content Management System is an open source content management system CMS. EmpireCMS version 7.5 is vulnerable to SQL injection, which stems from the lack of validation of external input SQL statements in AdClass.php and can be exploited to execute illegal SQL commands to steal...

Sql injection

EmpireCMS 7.5 has a SQL injection vulnerability in AdClass.php...

CVE-2022-28585

EmpireCMS 7.5 has a SQL injection vulnerability in AdClass.php...

CVE-2021-38878

IBM QRadar 7.3, 7.4, and 7.5 could allow a malicious actor to impersonate an actor due to key exchange without entity authentication. IBM X-Force ID: 208756...

Code injection

IBM QRadar SIEM 7.3, 7.4, and 7.5 in some situations may not automatically log users out after they exceede their idle timeout. IBM X-Force ID: 208341...

CVE-2021-38939

CVE-2021-38939 affects IBM QRadar SIEM 7.3, 7.4, and 7.5. It allows reading potentially sensitive information stored in log files by users with domain-creation access. The issue is an information-disclosure vulnerability in QRadar’s log handling. Impact is information exposure in logs; no code ex...

CVE-2021-38919

IBM QRadar SIEM 7.3, 7.4, and 7.5 in some senarios may reveal authorized service tokens to other QRadar users. IBM X-Force ID: 210021...

CVE-2021-38878

The CVE-2021-38878 vulnerability affects IBM QRadar SIEM versions 7.3.3 FP10, 7.4.3 FP4 (GA-FP4), and 7.5.0 GA, where a flaw in the key exchange enables impersonation due to lack of entity authentication. IBM documents the root cause as authentication weakness during key exchange. Remediation pro...

CVE-2021-38874

CVE-2021-38874 : IBM QRadar SIEM vulnerable to cross-tenant/domain information disclosure. Affected products/versions include IBM QRadar SIEM 7.5.0 GA and QRadar 7.4.3 GA – 7.4.3 FP4 and 7.3.3 GA – 7.3.3 FP10. The description notes that in some situations, users can access information across tena...

CVE-2021-38869

IBM QRadar SIEM is affected by CVE-2021-38869: in some situations it may not automatically log out idle users, extending sessions beyond idle timeout. Affected products/versions include 7.5.0 GA, 7.4.3 GA–7.4.3 FP4, and 7.3.3 GA–7.3.3 FP10. Root cause and impact are described as an idle timeout h...

CVE-2021-29776

IBM QRadar SIEM 7.3, 7.4, and 7.5 could allow an authenticated user to obtain sensitive information from another user's dashboard providing the dashboard ID of that user. IBM X-Force ID: 203030...