CVE-2021-42534 Trane Building Automation Controllers Cross-site Scripting

The affected product’s web application does not properly neutralize the input during webpage generation, which could allow an attacker to inject code in the input forms...

PT-2021-8052

Name of the Vulnerable Software and Affected Versions Fanuc Series 32i affected versions not specified Description The issue is related to errors in resource management within the software of Fanuc Series 32i CNC controllers. It may allow a remote attacker to gain unauthorized access to protected...

Trane HVAC Systems Controls

1. EXECUTIVE SUMMARY CVSS v3 6.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Trane Equipment: Building Automation Controllers Tracer SC Vulnerability: Cross-site Scripting 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to redirect a user...

Active-Directory-Exploitation-Cheat-Sheet

This is a cheat sheet for Windows Active Directory exploitation, containing common enumeration and attack methods. The repository is a collection of PowerShell scripts and modules that can be used to perform various attacks on Active Directory, including domain enumeration, lateral movement, and...

Siemens SINUMERIK Controllers Denial of Service Vulnerability

SINUMERIK CNCs provide automation solutions for shop floor, workshop and large volume production environments. a denial of service vulnerability exists in Siemens SINUMERIK Controllers. the vulnerability stems from the fact that the affected device fails to properly handle certain specially craft...

Medtronic recalls insulin pump controllers over life-threatening flaws

By Deeba Ahmed Medtronic has recalled the remote controllers used with some of the company’s insulin pumps because of inherent vulnerabilities that could lead to injury or death. This is a post from HackRead.com Read the original post: Medtronic recalls insulin pump controllers over...

Multiple Critical Flaws Discovered in Honeywell Experion PKS and ACE Controllers

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Tuesday released an advisory regarding multiple security vulnerabilities affecting all versions of Honeywell Experion Process Knowledge System C200, C200E, C300, and ACE controllers that could be exploited to achieve remote code...

PT-2021-4325 · Honeywell · Honeywell Experion Pks

Name of the Vulnerable Software and Affected Versions: Honeywell Experion PKS versions C200, C200E, C300, and ACE controllers Description: The issue is related to insufficient restrictions on directory path names in the operating system of Honeywell's industrial portable computers. This can be...

CISA Releases Security Advisory for Honeywell Experion and ACE Controllers

CISA has released an Industrial Controls Systems ICS advisory detailing multiple vulnerabilities affecting all versions of Honeywell Experion Process Knowledge System C200, C200E, C300, and ACE controllers. A remote attacker could exploit some of these vulnerabilities to take control of an affect...

Honeywell Experion PKS and ACE Controllers

1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low attack complexity Vendor: Honeywell Equipment: Experion Process Knowledge System PKS C200, C200E, C300 and ACE Controllers Vulnerabilities: Unrestricted Upload of File with Dangerous Type, Relative Path Traversal, Improper...

Honeywell Experion PKS and ACE Controllers code-related vulnerabilities

Honeywell Experion PKS and Honeywell Ace Controllers are both products of Honeywell, Inc. Honeywell Experion PKS is a process automation system. Honeywell Ace Controllers are used to execute Honeywell's Control Execution Environment Cee on a server-grade computer platform. Honeywell Ace Controlle...

Honeywell Experion PKS and Ace Controllers have path traversal vulnerabilities

Honeywell Experion PKS and Honeywell Ace Controllers are both products of Honeywell, Inc. Honeywell Experion PKS is a process automation system. Honeywell Ace Controllers are used to execute Honeywell's Control Execution Environment Cee on a server-grade computer platform. Honeywell Ace Controlle...

Honeywell Experion PKS and Honeywell Ace Controllers have injection vulnerabilities

Honeywell Experion PKS and Honeywell Ace Controllers are both products of Honeywell, Inc. Honeywell Experion PKS is a process automation system. Honeywell Ace Controllers are used to execute Honeywell's Control Execution Environment Cee on a server-grade computer platform. Honeywell Ace Controlle...

Cross-site scripting in application/controllers/dropbox.php in JustWriting

Cross-site scripting XSS vulnerability in application/controllers/dropbox.php in JustWriting 1.0.0 and below allow remote attackers to inject arbitrary web script or HTML via the challenge parameter...

CVE-2021-41467

Cross-site scripting XSS vulnerability in application/controllers/dropbox.php in JustWriting 1.0.0 and below allow remote attackers to inject arbitrary web script or HTML via the challenge parameter...

CVE-2021-41467: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in application/controllers/dropbox.php in JustWriting 1.0.0 and below allow remote attackers to inject arbitrary web script or HTML via the challenge parameter...

PT-2021-23309

Name of the Vulnerable Software and Affected Versions JustWriting versions 1.0.0 and below Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the challenge parameter in the application/controllers/dropbox.php file. Recommendations For...

PT-2021-23421

Name of the Vulnerable Software and Affected Versions PlaceOS Authentication Service versions prior to 1.29.10.0 Description The issue allows for an open redirect in the app/controllers/auth/sessions controller.rb file. Recommendations For versions prior to 1.29.10.0, update to version 1.29.10.0 ...

PT-2021-10532

Name of the Vulnerable Software and Affected Versions: GilaCMS version 1.11.4 Description: The issue is related to a SQL injection vulnerability. It occurs via the $ GET parameter in the /src/core/controllers/cm.php file. This allows for potential exploitation. Recommendations: For GilaCMS versio...

[SECURITY] Fedora 35 Update: mosquitto-2.0.12-1.fc35

Mosquitto is an open source message broker that implements the MQ Telemetry Transport protocol version 3.1 and 3.1.1 MQTT provides a lightweight method of carrying out messaging using a publish/subscribe model. This makes it suitable for "machine to machine" messaging such as with low power senso...