CODESYS Control Buffer Error Vulnerability

3s-smart Software Solutions CODESYS Control is a suite of industrial control program programming software from 3s-smart Software Solutions, Germany. CODESYS Control suffers from a buffer error vulnerability that arises from improper restriction of memory buffer ranges, allowing a remote attacker...

Command injection

A vulnerability has been discovered in Xiaomi routers that could allow command injection through an external interface. This vulnerability arises from inadequate filtering of responses returned from the external interface. Attackers could exploit this vulnerability by hijacking the ISP or an...

Moxa IKS, EDS Predictable From Observable State (CVE-2019-6563)

Moxa IKS and EDS generate a predictable cookie calculated with an MD5 hash, allowing an attacker to capture the administrator's password, which could lead to a full compromise of the device. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...

Moxa EDS-G516E and EDS-510E Series Ethernet Switches Stack-Based Buffer Overflow (CVE-2020-7007)

In Moxa EDS-G516E Series firmware, Version 5.2 or lower, the attacker may execute arbitrary codes or target the device, causing it to go out of service. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C...

Malicious code in fca-dong (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 869e5a7298ac33a7556237fc57e21644df6d5629aa7dcb99384fb50003fed574 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in all-in-one-web-header-footer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 686b3dfc4e5911c9132f822dba0217207a7b3da29e4b6be866a89dc2511f6309 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in proof-of-solvency-verification (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c80842c791023b79222e82ae88ac91bc92a9941cf2a6b08c29042d98fa99363b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fca-tuong (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 13d79cf7f0c8b529c853f6fad71dbc1ce8655d7f7356cf001fe8c6b5142ed7a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-35972

An authenticated remote command injection vulnerability exists in the ArubaOS web-based management interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This allows an attacker to full...

Malicious code in fc-settings-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 80e7110175cf6f8b68629a84978c209f869d83a2dab01fd1f4848340f9a2340f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in canvas-text-colorizer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 600788039845a4453efbb5e1211e0a0a6ad83330a401a748333e35e64bf15a49 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fc-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 77f6035edb9c1d932bd670b4ecd252c5ad1d38ae3ff39f0f2d3e68ca68a1d99f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in anf-core-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d2ebe249c8950dc0c80ca568e821fa11d3759cb87a76ff9e5813bcc3d5ab938b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in react-blue-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5108d06d664409328068b5859c46add10bb08c95d223960e1bf8910d507f5466 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-21404

AXIS OS 11.0.X - 11.3.x use a static RSA key in legacy LUA-components to protect Axis-specific source code. The static RSA key is not used in any other secure communication nor can it be used to compromise the device or any customer data...

Code injection

AXIS OS 11.0.X - 11.3.x use a static RSA key in legacy LUA-components to protect Axis-specific source code. The static RSA key is not used in any other secure communication nor can it be used to compromise the device or any customer data...

CVE-2023-25556

A CWE-287: Improper Authentication vulnerability exists that could allow a device to be compromised when a key of less than seven digits is entered and the attacker has access to the KNX installation...

CVE-2023-25556

CVE-2023-25556 describes an improper authentication weakness in KNX-based devices where a key of fewer than seven digits can compromise a device if an attacker has KNX access. Connected sources tie this to Schneider Electric StruxureWare/KNX implementations and Merten KNX, noting the root cause a...

SecurePoint UTM 12.x Session ID Leak

RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: SecurePoint UTM Vendor URL: https://www.securepoint.de/en/for-companies/firewall-vpn Type: Exposure of Sensitive Information to an Unauthorized Actor CWE-200 Date found: 2023-01-05 Date...

Malicious code in dreamteam11-google-oast (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a3857cd535de263c6bc08caaf87b458f00b7c3c5f19032e63513a2656618c8e0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...