CVE-2019-13527

In Rockwell Automation Arena Simulation Software Cat. 9502-Ax, Versions 16.00.00 and earlier, a maliciously crafted Arena file opened by an unsuspecting user may result in the use of a pointer that has not been initialized...

Code injection

A specific utility may allow an attacker to gain read access to privileged files in the Niagara AX 3.8u4 JACE 3e, JACE 6e, JACE 7, JACE-8000, Niagara 4.4u3 JACE 3e, JACE 6e, JACE 7, JACE-8000, and Niagara 4.7u1 JACE-8000, Edge 10...

CVE-2019-13528

A specific utility may allow an attacker to gain read access to privileged files in the Niagara AX 3.8u4 JACE 3e, JACE 6e, JACE 7, JACE-8000, Niagara 4.4u3 JACE 3e, JACE 6e, JACE 7, JACE-8000, and Niagara 4.7u1 JACE-8000, Edge 10...

CVE-2019-13528

CVE-2019-13528 is an Improper Authorization vulnerability affecting Tridium Niagara: Niagara AX 3.8u4 (JACE 3e/6e/7/JACE-8000), Niagara 4.4u3 (JACE 3e/6e/7/JACE-8000), and Niagara 4.7u1 (JACE-8000, Edge 10). A specific utility may allow a local attacker to read privileged files due to insufficien...

CVE-2019-13527

CVE-2019-13527 affects Rockwell Automation Arena Simulation Software Cat. 9502-Ax (versions 16.00.00 and earlier). The issue is a parsing flaw where a pointer is used without initialization when processing Arena DOE files, potentially enabling remote code execution. Exploitation typically require...

CVE-2019-13527

In Rockwell Automation Arena Simulation Software Cat. 9502-Ax, Versions 16.00.00 and earlier, a maliciously crafted Arena file opened by an unsuspecting user may result in the use of a pointer that has not been initialized...

PT-2019-13393

Name of the Vulnerable Software and Affected Versions Niagara AX version 3.8u4 Niagara version 4.4u3 Niagara version 4.7u1 Description A specific utility may allow an attacker to gain read access to privileged files. This issue affects various JACE and Edge devices. Recommendations For Niagara AX...

CVE-2019-13527: Access of Uninitialized Pointer

In Rockwell Automation Arena Simulation Software Cat. 9502-Ax, Versions 16.00.00 and earlier, a maliciously crafted Arena file opened by an unsuspecting user may result in the use of a pointer that has not been initialized...

CVE-2019-14335: Undefined Security Weakness

An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is post-authenticated denial of service leading to the reboot of the AP via the admin.cgi?action=%s URI...

PT-2019-13617

Name of the Vulnerable Software and Affected Versions D-Link 6600-AP and DWL-3600AP Ax version 4.2.0.14 Description An issue was discovered that allows for post-authenticated denial of service, leading to the reboot of the access point. This can be achieved via the "admin.cgi?action=%s" URI...

CVE-2019-14338

An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is a post-authentication admin.cgi?action= XSS vulnerability on the management interface...

CVE-2019-14336

An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is post-authenticated dump of all of the config files through a certain admin.cgi?action= insecure HTTP request...

CVE-2019-14338

An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is a post-authentication admin.cgi?action= XSS vulnerability on the management interface...

Input validation

An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is an ability to escape to a shell in the restricted command line interface, as demonstrated by the /bin/sh -c wget sequence...

Cross site request forgery (csrf)

An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is post-authenticated dump of all of the config files through a certain admin.cgi?action= insecure HTTP request...

Design/Logic Flaw

An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is a post-authentication admin.cgi?action= XSS vulnerability on the management interface...

CVE-2019-14338

CVE-2019-14338 affects D-Link 6600-AP and DWL-3600AP with firmware 4.2.0.14 Ax. A post-authentication XSS vulnerability exists in the management interface via admin.cgi?action= parameter. Public references (NVD, Red Hat entry, CNVD, packetstorm) corroborate an XSS issue, with CVSSv3.1 base score ...

CVE-2019-14336

An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is post-authenticated dump of all of the config files through a certain admin.cgi?action= insecure HTTP request...

CVE-2019-14336

CVE-2019-14336 affects D-Link 6600-AP and DWL-3600AP with firmware 4.2.0.14 Ax. The vulnerability enables post-authenticated dump of all configuration files via an insecure HTTP request to admin.cgi, leading to information disclosure. Multiple connected sources corroborate an authenticated access...

CVE-2019-14332

CVE-2019-14332 affects D-Link 6600-AP and DWL-3600AP (Ax 4.2.0.14). The issue is the use of weak SSH ciphers (e.g., diffie-hellman-group1-sha1) in affected firmware. Evidence in multiple sources confirms the vulnerability details and affected devices; some sources also reference related SSH brute...