CVE-2020-21733: Improper Neutralization of Input During Web Page Generation

Sagemcom F@ST3686 v1.0 HUN 3.97.0 has XSS via RgDiagnostics.asp, RgDdns.asp, RgFirewallEL.asp, RgVpnL2tpPptp.asp...

CVE-2020-15791: Insufficiently Protected Credentials

A vulnerability has been identified in SIMATIC S7-300 CPU family incl. related ET200 CPUs and SIPLUS variants All versions, SIMATIC S7-400 CPU family incl. SIPLUS variants All versions, SIMATIC WinAC RTX F 2010 All versions, SINUMERIK 840D sl All versions. The authentication protocol between a...

PT-2020-14636

Name of the Vulnerable Software and Affected Versions SIMATIC S7-300 CPU family incl. related ET200 CPUs and SIPLUS variants All versions SIMATIC S7-400 CPU family incl. SIPLUS variants All versions SIMATIC WinAC RTX F 2010 All versions SINUMERIK 840D sl All versions Description A security issue...

Siemens Industrial Products (Update F)

1. EXECUTIVE SUMMARY CVSS v3 5.5 ATTENTION: Low attack complexity Vendor: Siemens Equipment: Siemens Industrial Products containing certain processors Vulnerability: Exposure of Sensitive Information to an Unauthorized Actor 2. UPDATE INFORMATION This updated advisory is a follow-up to the...

Mitsubishi Electric MELSEC iQ-F Predictable TCP Sequence Number Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Mitsubishi Electric MELSEC iQ-F. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of ACK packets. When generating ACK packets, the...

Path Traversal in f-serv

All versions of f-serv are vulnerable to Path Traversal. Due to insufficient input sanitization in URLs, attackers can access server files by using relative paths when fetching files. Recommendation No fix is currently available. Consider using an alternative package until a fix is made available...

GHSA-VX5W-CXCH-WWC9 Path Traversal in f-serv

All versions of f-serv are vulnerable to Path Traversal. Due to insufficient input sanitization in URLs, attackers can access server files by using relative paths when fetching files. Recommendation No fix is currently available. Consider using an alternative package until a fix is made available...

PT-2020-21534

Name of the Vulnerable Software and Affected Versions f-serv versions affected versions not specified Description The issue is related to Path Traversal due to insufficient input sanitization in URLs. Attackers can access server files by using relative paths when fetching files. Recommendations A...

CVE-2020-24034

Sagemcom F@ST 5280 routers using firmware version 1.150.61 have insecure deserialization that allows any authenticated user to perform a privilege escalation to any other user. By making a request with valid sessid, nonce, and ha1 values inside of the serialized session cookie, an attacker may...

CVE-2020-24034

CVE-2020-24034 affects Sagemcom F@ST 5280 routers running firmware version 1.150.61. The issue is an insecure deserialization in the authenticated flow that lets a logged-in user alter a serialized session cookie (sess_id, nonce, ha1) to assume another user’s role, including an internal account w...

CVE-2020-24034

Sagemcom F@ST 5280 routers using firmware version 1.150.61 have insecure deserialization that allows any authenticated user to perform a privilege escalation to any other user. By making a request with valid sessid, nonce, and ha1 values inside of the serialized session cookie, an attacker may...

CVE-2020-24034: Deserialization of Untrusted Data

Sagemcom F@ST 5280 routers using firmware version 1.150.61 have insecure deserialization that allows any authenticated user to perform a privilege escalation to any other user. By making a request with valid sessid, nonce, and ha1 values inside of the serialized session cookie, an attacker may...

PT-2020-15625

Name of the Vulnerable Software and Affected Versions Sagemcom F@ST 5280 version 1.150.61 Description The issue allows any authenticated user to perform a privilege escalation to any other user due to insecure deserialization. By making a request with valid sess id, nonce, and ha1 values inside o...

Sagemcom F@ST 5280 Privilege Escalation

privilege escalation Date: 08-31-2020 Exploit Author: Ryan Delaney Author Contact: ryan.delaney owasp org Author LinkedIn: https://www.linkedin.com/in/infosecrd/ Vendor Homepage: https://sagemcom.com/en Software Link: N/A F@ST 5280 firmware not published Version: F@ST 5280 router, F/W 1.150.61,...

Sagemcom F@ST 5280 Privilege Escalation Vulnerability

Sagemcom F@ST 5280 routers using firmware version 1.150.61, and possibly others, have an insecure deserialization vulnerability that allows any authenticated user to perform a privilege escalation to any other user. By making a request with valid sessid, nonce, and ha1 values inside of the...

f-tradehk.com Cross Site Scripting vulnerability OBB-1245877

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

F-Secure PSB Computer Protection (Windows)

Binary data fsecurepsbwininstalled.nbin...

PT-2020-21857

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a stack-buffer-overflow crash. Technical details about the crash include the functions fmt setup, mrb str format, and mrb f sprintf...

Unspecified Vulnerability in F-Secure SAFE

F-Secure SAFE is a suite of antivirus software from the Finnish company F-Secure. A security vulnerability in F-Secure SAFE version 17.7 macOS exists because the program fails to properly validate the client version, which can be exploited by an attacker to execute commands on a system with the...

Unspecified Vulnerability in F-Secure SAFE (CNVD-2021-25666)

F-Secure SAFE is a suite of antivirus software from the Finnish company F-Secure. A security vulnerability exists in F-Secure SAFE version 17.7 macOS, which stems from the XPC service's use of a PID to identify the connecting client, and can be exploited by an attacker to execute commands on the...