PT-2021-26340

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.14.15 Description: A potential issue exists in the Linux Kernel related to a deadlock when adding SPI controllers on SPI buses. The actual impact and attack plausibility have not yet been proven...

PT-2021-14846

Name of the Vulnerable Software and Affected Versions Spring Data REST versions 3.4.0 through 3.4.13 Spring Data REST versions 3.5.0 through 3.5.5 Spring Data REST older unsupported versions Description The issue affects HTTP resources implemented by custom controllers using a configured base API...

CVE-2021-22047: Exposure of Sensitive Information to an Unauthorized Actor

In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for...

CVE-2021-38450

The affected controllers do not properly sanitize the input containing code syntax. As a result, an attacker could craft code to alter the intended controller flow of the software...

CVE-2021-38450 Trane Tracer Code Injection

The affected controllers do not properly sanitize the input containing code syntax. As a result, an attacker could craft code to alter the intended controller flow of the software...

Potential Security Bypass for customized Spring Data REST Resource

In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for...

CVE-2021-42534 Trane Building Automation Controllers Cross-site Scripting

The affected product’s web application does not properly neutralize the input during webpage generation, which could allow an attacker to inject code in the input forms...

PT-2021-8052

Name of the Vulnerable Software and Affected Versions Fanuc Series 32i affected versions not specified Description The issue is related to errors in resource management within the software of Fanuc Series 32i CNC controllers. It may allow a remote attacker to gain unauthorized access to protected...

Trane HVAC Systems Controls

1. EXECUTIVE SUMMARY CVSS v3 6.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Trane Equipment: Building Automation Controllers Tracer SC Vulnerability: Cross-site Scripting 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to redirect a user...

Active-Directory-Exploitation-Cheat-Sheet

This is a cheat sheet for Windows Active Directory exploitation, containing common enumeration and attack methods. The repository is a collection of PowerShell scripts and modules that can be used to perform various attacks on Active Directory, including domain enumeration, lateral movement, and...

Siemens SINUMERIK Controllers Denial of Service Vulnerability

SINUMERIK CNCs provide automation solutions for shop floor, workshop and large volume production environments. a denial of service vulnerability exists in Siemens SINUMERIK Controllers. the vulnerability stems from the fact that the affected device fails to properly handle certain specially craft...

Medtronic recalls insulin pump controllers over life-threatening flaws

By Deeba Ahmed Medtronic has recalled the remote controllers used with some of the company’s insulin pumps because of inherent vulnerabilities that could lead to injury or death. This is a post from HackRead.com Read the original post: Medtronic recalls insulin pump controllers over...

Multiple Critical Flaws Discovered in Honeywell Experion PKS and ACE Controllers

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Tuesday released an advisory regarding multiple security vulnerabilities affecting all versions of Honeywell Experion Process Knowledge System C200, C200E, C300, and ACE controllers that could be exploited to achieve remote code...

PT-2021-4325 · Honeywell · Honeywell Experion Pks

Name of the Vulnerable Software and Affected Versions: Honeywell Experion PKS versions C200, C200E, C300, and ACE controllers Description: The issue is related to insufficient restrictions on directory path names in the operating system of Honeywell's industrial portable computers. This can be...

Honeywell Experion PKS and ACE Controllers code-related vulnerabilities

Honeywell Experion PKS and Honeywell Ace Controllers are both products of Honeywell, Inc. Honeywell Experion PKS is a process automation system. Honeywell Ace Controllers are used to execute Honeywell's Control Execution Environment Cee on a server-grade computer platform. Honeywell Ace Controlle...

Honeywell Experion PKS and Honeywell Ace Controllers have injection vulnerabilities

Honeywell Experion PKS and Honeywell Ace Controllers are both products of Honeywell, Inc. Honeywell Experion PKS is a process automation system. Honeywell Ace Controllers are used to execute Honeywell's Control Execution Environment Cee on a server-grade computer platform. Honeywell Ace Controlle...

Honeywell Experion PKS and Ace Controllers have path traversal vulnerabilities

Honeywell Experion PKS and Honeywell Ace Controllers are both products of Honeywell, Inc. Honeywell Experion PKS is a process automation system. Honeywell Ace Controllers are used to execute Honeywell's Control Execution Environment Cee on a server-grade computer platform. Honeywell Ace Controlle...

CISA Releases Security Advisory for Honeywell Experion and ACE Controllers

CISA has released an Industrial Controls Systems ICS advisory detailing multiple vulnerabilities affecting all versions of Honeywell Experion Process Knowledge System C200, C200E, C300, and ACE controllers. A remote attacker could exploit some of these vulnerabilities to take control of an affect...

Honeywell Experion PKS and ACE Controllers

1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low attack complexity Vendor: Honeywell Equipment: Experion Process Knowledge System PKS C200, C200E, C300 and ACE Controllers Vulnerabilities: Unrestricted Upload of File with Dangerous Type, Relative Path Traversal, Improper...

Cross-site scripting in application/controllers/dropbox.php in JustWriting

Cross-site scripting XSS vulnerability in application/controllers/dropbox.php in JustWriting 1.0.0 and below allow remote attackers to inject arbitrary web script or HTML via the challenge parameter...