CVE-2020-7589

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions. The vulnerability could lead to an attacker reading and modifying the device configuration and obtain project files from affected devices. The security vulnerability could be exploited by an unauthenticated...

CVE-2020-7589

CVE-2020-7589 affects Siemens LOGO! 8 BM (including SIPLUS variants). The root cause is missing authentication for a critical function, allowing an unauthenticated attacker with network access to Port 135/TCP to read/modify device configuration and access project files, impacting confidentiality ...

CVE-2020-7589

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions. The vulnerability could lead to an attacker reading and modifying the device configuration and obtain project files from affected devices. The security vulnerability could be exploited by an unauthenticated...

The vulnerability of the microprogrammed control module software for Schneider Electric Easergy T300 (HU250) automation systems in transformer substations lies in the storage and transmission of critical data in unencrypted form. This allows a intruder to obtain information about the device’s configuration.

The vulnerability of the microprogrammed control module software for Schneider Electric Easergy T300 HU250 automation systems in transformer substations relates to the storage and transmission of critical data in unencrypted form. Exploiting this vulnerability could allow an attacker, operating...

Cisco IOS XE Software Web UI Command Injection Vulnerability

A vulnerability in the web-based user interface web UI of Cisco IOS XE Software could allow an authenticated, remote attacker with read-only privileges to inject IOS commands to an affected device. The injected commands should require a higher privilege level in order to be executed. The...

CVE-2020-12017

GE Grid Solutions Reason RT Clocks, RT430, RT431, and RT434, all firmware versions prior to 08A05. The device’s vulnerability in the web application could allow multiple unauthenticated attacks that could cause serious impact. The vulnerability may allow an unauthenticated attacker to execute...

WAVLINK WL-WN530HG4 Information Disclosure Vulnerability

WAVLINK WL-WN530HG4 is a wireless network signal extender from China RuiYin Technology WAVLINK. A security vulnerability exists in the /cgi-bin/ExportALLSettings.sh file in WAVLINK WL-WN530HG4 M30HG4.V5030.191116 version. An attacker can exploit this vulnerability with the help of a specially...

CVE-2020-10974

An issue was discovered affecting a backup feature where a crafted POST request returns the current configuration of the device in cleartext, including the administrator password. No authentication is required. Affected devices: Wavlink WN575A3, Wavlink WN579G3, Wavlink WN531A6, Wavlink WN535G3,...

Information disclosure

An issue was discovered affecting a backup feature where a crafted POST request returns the current configuration of the device in cleartext, including the administrator password. No authentication is required. Affected devices: Wavlink WN575A3, Wavlink WN579G3, Wavlink WN531A6, Wavlink WN535G3,...

CVE-2020-10974

The CVE-2020-10974 entry describes an information-disclosure flaw in a device backup feature: a crafted POST request can return the current device configuration in cleartext, including the administrator password, without any authentication. Affected devices include WAVLINK WN575A3, WN579G3, WN531...

CVE-2020-12266

An issue was discovered where there are multiple externally accessible pages that do not require any sort of authentication, and store system information for internal usage. The devices automatically query these pages to update dashboards and other statistics, but the pages can be accessed...

rConfig Network Device Configuration Tool Command Injection (CVE-2019-19509)

A command injection vulnerability exists in rConfig Network Device Configuration Tool. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

Denial of Service Vulnerability in ZTE ZXR10 1800-2S (CNVD-2020-23632)

The ZTE ZXR10 1800-2S is a multi-service smart router manufactured by ZTE Corporation. A denial of service vulnerability exists in the ZTE ZXR10 1800-2S. An attacker interrupts the terminal after downloading an oversized version of a file via FTP, which leads to a command conflict on the target...

Cisco Prime Network Registrar Cross-Site Request Forgery Vulnerability

A vulnerability in the web-based interface of Cisco Prime Network Registrar CPNR could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system. The vulnerability is due to insufficient CSRF protections in the web-based interface. An...

CVE-2020-3158

A vulnerability in the High Availability HA service of Cisco Smart Software Manager On-Prem could allow an unauthenticated, remote attacker to access a sensitive part of the system with a high-privileged account. The vulnerability is due to a system account that has a default and static password...

Information disclosure

An issue was discovered on Phoenix Contact Emalytics Controller ILC 2050 BI before 1.2.3 and BI-L before 1.2.3 devices. There is an insecure mechanism for read and write access to the configuration of the device. The mechanism can be discovered by examining a link on the website of the device...

ManageEngine Network Configuration Manager 12.2 - (apiKey) SQL Injection Vulnerability

Exploit for java platform in category web applications Exploit Title: ManageEngine Network Configuration Manager 12.2 - 'apiKey' SQL Injection Exploit Author: AmirHadi Yazdani Vendor Homepage: https://www.manageengine.com/network-configuration-manager/ Software Link:...

SIEMENS SCALANCE X witches series authentication bypass vulnerability

SCALANCE X witches are used to connect industrial components such as programmable logic controllers PLCs or human machine interfaces HMIs. An authentication bypass vulnerability exists in the SIEMENS SCALANCE X witches family. An attacker could exploit this vulnerability to obtain sensitive...

CVE-2019-18340

A vulnerability has been identified in Control Center Server CCS All versions = V1.5.0, SiNVR/SiVMS Video Server All versions = V5.0.0. Both the SiVMS/SiNVR Video Server and the Control Center Server CCS store user and device passwords by applying weak cryptography. A local attacker could exploit...

Design/Logic Flaw

A vulnerability has been identified in Control Center Server CCS All versions = V1.5.0, SiNVR/SiVMS Video Server All versions = V5.0.0. Both the SiVMS/SiNVR Video Server and the Control Center Server CCS store user and device passwords by applying weak cryptography. A local attacker could exploit...