CVE-2024-8313: Exposure of Sensitive System Information to an Unauthorized Control Sphere

An Exposure of Sensitive System Information to an Unauthorized Control Sphere and Initialization of a Resource with an Insecure Default vulnerability in the SNMP component of B&R APROL 4.4-00P5 may allow an unauthenticated adjacent-based attacker to read and alter configuration using SNMP...

PT-2025-12732

Name of the Vulnerable Software and Affected Versions B&R APROL versions prior to 4.4-00P5 Description The issue is related to an Allocation of Resources Without Limits or Throttling vulnerability in the operating system network configuration. This vulnerability may allow an unauthenticated...

CVE-2024-10210: External Control of File Name or Path

An External Control of File Name or Path vulnerability in the APROL Web Portal used in B&R APROL 4.4-005P may allow an authenticated network-based attacker to access data from the file system...

CVE-2024-10208: Improper Neutralization of Input During Web Page Generation

An Improper Neutralization of Input During Web Page Generation vulnerability in the APROL Web Portal used in B&R APROL 4.4-00P5 may allow an authenticated network-based attacker to insert malicious code which is then executed in the context of the user’s browser session...

CVE-2024-10209: Incorrect Permission Assignment for Critical Resource

An Incorrect Permission Assignment for Critical Resource vulnerability in the file system used in B&R APROL 4.4-01 may allow an authenticated local attacker to read and alter the configuration of another engineering or runtime user...

CVE-2024-8315: Improper Handling of Insufficient Permissions or Privileges

An Improper Handling of Insufficient Permissions or Privileges vulnerability in scripts used in B&R APROL 4.4-00P5 may allow an authenticated local attacker to read credential information...

CVE-2024-45480: Improper Control of Generation of Code

An improper control of generation of code 'Code Injection' vulnerability in the AprolCreateReport component of B&R APROL 4.4-00P5 may allow an unauthenticated network-based attacker to read files from the local system...

PT-2025-12734

Name of the Vulnerable Software and Affected Versions B&R APROL versions prior to 4.4-00P5 Description The issue is related to an incorrect implementation of the authentication algorithm and exposure of a data element to the wrong session in the session handling. This could allow an authenticated...

CVE-2024-10206: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery vulnerability in the APROL Web Portal used in B&R APROL 4.4-00P5 may allow an unauthenticated network-based attacker to force the web server to request arbitrary URLs...

CVE-2024-8314: Incorrect Implementation of Authentication Algorithm

An Incorrect Implementation of Authentication Algorithm and Exposure of Data Element to Wrong Ses-sion vulnerability in the session handling used in B&R APROL 4.4-00P5 may allow an authenticated network attacker to take over a currently active user session without login credentials...

B&R Industrial Automation B&R APROL 跨站脚本漏洞

B&R Industrial Automation B&R APROL is a process control system from B&R Industrial Automation, Austria. A cross-site scripting vulnerability exists in B&R Industrial Automation B&R APROL versions prior to 4.4-00P5, which stems from improper input neutralization in the APROL Web Portal, and could...

CVE-2024-45484: Allocation of Resources Without Limits or Throttling

An Allocation of Resources Without Limits or Throttling vulnerability in the operating system network configuration used in B&R APROL 4.4-00P5 may allow an unauthenticated adjacent attacker to per-form Denial-of-Service DoS attacks against the product...

PT-2025-12733

Name of the Vulnerable Software and Affected Versions B&R APROL versions prior to 4.4-00P5 Description The issue allows an unauthenticated adjacent-based attacker to read and alter configuration using SNMP, due to an Exposure of Sensitive System Information to an Unauthorized Control Sphere and...

CVE-2024-45483: Missing Authentication for Critical Function

A Missing Authentication for Critical Function vulnerability in the GRUB configuration used B&R APROL 4.4-01 may allow an unauthenticated physical attacker to alter the boot configuration of the operating system...

PT-2025-12735

Name of the Vulnerable Software and Affected Versions B&R APROL versions prior to 4.4-00P5 Description The issue is related to an Improper Handling of Insufficient Permissions or Privileges vulnerability in scripts used in the software. This may allow an authenticated local attacker to read...

PT-2025-12731

Name of the Vulnerable Software and Affected Versions B&R APROL versions prior to 4.4-01 Description A Missing Authentication for Critical Function vulnerability in the GRUB configuration may allow an unauthenticated physical attacker to alter the boot configuration of the operating system...

PT-2025-12729

Name of the Vulnerable Software and Affected Versions B&R APROL versions prior to 4.4-00P5 Description The issue is related to an Incomplete Filtering of Special Elements vulnerability in scripts using the SSH server, which may allow an authenticated local attacker to authenticate as another...

PT-2025-12730

Name of the Vulnerable Software and Affected Versions B&R APROL versions prior to 4.4-00P1 Description The issue is related to an Inclusion of Functionality from Untrusted Control Sphere vulnerability in the SSH server, which may allow an authenticated local attacker from a trusted remote server ...

Malicious code in my-local-b-off (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 55183046ab5c00a4004d794bf477003beb964f8267681dcd3e19c8cc97c628f6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2577 Malicious code in my-local-b-off (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 55183046ab5c00a4004d794bf477003beb964f8267681dcd3e19c8cc97c628f6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...