Siemens User Management Component (UMC)

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...

RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update (Moderate) (RHSA-2024:6428)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:6428 advisory. Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT...

[SECURITY] Fedora 40 Update: python-django4.2-4.2.16-1.fc40

Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...

[SECURITY] Fedora 39 Update: python-django4.2-4.2.16-1.fc39

Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...

Moderate: Red Hat Bug Fix Advisory: Red Hat Ansible Automation Platform 2.4 Container Release Update

An update is now available for Red Hat Ansible Automation Platform 2.4 Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams,...

Moderate: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

An update is now available for Red Hat Ansible Automation Platform 2.4 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

automation-controller: Gain access to the k8s API server via job execution with Container Group

An improper authorization flaw exists in the Ansible Automation Controller. This flaw allows an attacker using the k8S API server to send an HTTP request with a service account token mounted via automountServiceAccountToken: true, resulting in privilege escalation to a service account...

Red Hat Ansible Automation 授权问题漏洞

Red Hat Ansible Automation is a software application from the American company Red Hat, Inc. It provides a means to automate all aspects of an infrastructure, from servers and network devices to operating systems, applications, and security. An authorization issue vulnerability exists in Red Hat...

ABCD2 安全漏洞

ABCD2 is an ABCD open source software suite for library and documentation center automation. A security vulnerability exists in ABCD2 2.2.0-beta-1 and earlier versions, which originates in an unknown section of the file /common/showimage.php, where manipulation of the parameter image results in...

Webinar: Learn to Boost Cybersecurity with AI-Powered Vulnerability Management

The world of cybersecurity is in a constant state of flux. New vulnerabilities emerge daily, and attackers are becoming more sophisticated. In this high-stakes game, security leaders need every advantage they can get. That's where Artificial Intelligence AI comes in. AI isn't just a buzzword; it'...

Rockwell Automation ControlLogix, GuardLogix 5580, CompactLogix, Compact GuardLogix 5380 Improper Input Validation (CVE-2024-7507)

A denial-of-service vulnerability exists in the affected products. This vulnerability occurs when a malformed PCCC message is received, causing a fault in the controller. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

The vulnerability of the software for managing, monitoring, configuring, and automating IT infrastructure in the Hitachi Ops Center Common Services lies in its ability to bypass authentication procedures, allowing attackers to circumvent the authentication process.

The vulnerability of the software for managing, monitoring, configuring, and automating IT infrastructure of Hitachi Ops Center Common Services is related to the ability to bypass the authentication process. Exploiting this vulnerability can allow attackers to circumvent the authentication...

Generic Emailer (SMTP)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'yaml' class MetasploitModule 'Generic Emailer SMTP', 'Description' = %q This module can be used to automate email delivery. This code is based on Joshua Abraham...

CISA Releases Three Industrial Control Systems Advisories

CISA released three Industrial Control Systems ICS advisories on August 29, 2024. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-24-242-01 Rockwell Automation ThinManager ThinServer ICSA-24-242-02 Delta Electronics DT...

Rockwell Automation ThinManager ThinServer

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION : Exploitable remotely/Low attack complexity Vendor : Rockwell Automation Equipment : ThinManager ThinServer Vulnerabilities : Improper Privilege Management, Incorrect Permission Assignment for Critical Resource, Improper Input Validation 2...

B&R Industrial Automation APROL 安全漏洞

B&R Industrial Automation APROL is a production process management system from B&R Industrial Automation, Austria. A security vulnerability exists in B&R Industrial Automation APROL R version 4.4-00P3 and prior versions that stems from the inclusion of an untrusted search path vulnerability...

Rockwell Automation Micro850/870 Denial of Service Vulnerability

Rockwell Automation Micro850/870 is a programmable logic controller from Rockwell Automation. A denial of service vulnerability exists in Rockwell Automation Micro850/870 v20.011, which can be exploited by an attacker to cause CIP/Modbus communication to be interrupted for a short period of time...

Exploit for Improper Input Validation in Cacti

Cacti CVE-2024-25641 Authenticated Package Upload RCE Proof of...

Cross Site Scripting(XSS)

Khoj is vulnerable to Stored Cross-Site Scripting XSS. The vulnerability is due to insufficient sanitization of the q parameter in the /api/automation endpoint, which allows users to inject arbitrary HTML/JS into task instructions...

CVE-2024-39657

Cross-Site Request Forgery CSRF vulnerability in Sender Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce.This issue affects Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce: from n/a through 2.6.18...