CVE-2023-43697

Modification of Assumed-Immutable Data MAID in RDT400 in SICK APU allows an unprivileged remote attacker to make the site unable to load necessary strings via changing file paths using HTTP requests...

CVE-2023-43700

Missing Authorization in RDT400 in SICK APU allows an unprivileged remote attacker to modify data via HTTP requests that no not require authentication...

CVE-2023-43700

CVE-2023-43700 affects SICK APU: Missing Authorization in the RDT400 component allows an unprivileged remote attacker to modify data via HTTP requests that do not require authentication. This is documented across multiple feeds (NVD, Red Hat, CVE lists, and related PSIRT entries) with consistent ...

PT-2023-31724

Name of the Vulnerable Software and Affected Versions SICK APU RDT400 affected versions not specified Description The issue allows an unprivileged remote attacker to download various files from the server via HTTP requests. Recommendations At the moment, there is no information about a newer...

CVE-2023-43697: Modification of Assumed-Immutable Data (MAID)

Modification of Assumed-Immutable Data MAID in RDT400 in SICK APU allows an unprivileged remote attacker to make the site unable to load necessary strings via changing file paths using HTTP requests...

SICK APU Security Vulnerability

SICK APU is a railroad analysis system from SICK Germany. A security vulnerability exists in the SICK APU RDT400 that stems from a lack of authorization checks. An attacker could exploit the vulnerability to modify data via an HTTP request...

Hewlett Packard Enterprise MSA Controller Environment Issue Vulnerability

The Hewlett Packard Enterprise MSA Controller HPE MSA Controller is a series of controllers from Hewlett Packard Enterprise USA. A security vulnerability exists in versions prior to Hewlett Packard Enterprise MSA Controller IN210R004, which stems from a vulnerability that allows an attacker to...

PT-2023-23041 · Hewlett Packard · Hpe Msa Controller

Name of the Vulnerable Software and Affected Versions: HPE MSA Controller versions prior to IN210R004 Description: The issue allows for inconsistent interpretation of HTTP requests, which could be remotely exploited. Recommendations: For versions prior to IN210R004, update to version IN210R004 or...

PT-2023-31735

Name of the Vulnerable Software and Affected Versions SICK APU affected versions not specified Description Insufficient Control Flow Management in RDT400 allows an unprivileged remote attacker to potentially enable hidden functionality via HTTP requests. Recommendations At the moment, there is no...

PT-2023-28915

Name of the Vulnerable Software and Affected Versions SICK APU affected versions not specified Description Modification of Assumed-Immutable Data MAID in RDT400 allows an unprivileged remote attacker to make the site unable to load necessary strings via changing file paths using HTTP requests...

CVE-2023-5101: Files or Directories Accessible to External Parties

Files or Directories Accessible to External Parties in RDT400 in SICK APU allows an unprivileged remote attacker to download various files from the server via HTTP requests...

This Week in Spring - October 3rd, 2023

Hi Spring fans! Welcome to another installment of This Week in Spring! How're you doin'? I've just flown in from Singapore - where I was keynoting and presenting at SpringOne Singapore - and am now in Antwerp, Belgium for the deliriously fun Devoxx Belgium show. I've missed this show, and it's a...

CVE-2023-43323

mooSocial 3.1.8 is vulnerable to external service interaction on post function. When executed, the server sends a HTTP and DNS request to external server. The Parameters effected are multiple - messageText, datawallphoto, datauserShareVideo and datauserShareLink...

CVE-2023-42812

Galaxy is an open-source platform for FAIR data analysis. Prior to version 22.05, Galaxy is vulnerable to server-side request forgery, which allows a malicious to issue arbitrary HTTP/HTTPS requests from the application server to internal hosts and read their responses. Version 22.05 contains a...

Command injection

Command injection vulnerability in the homemng.htm endpoint in Juplink RX4-1500 Wifi router firmware versions V1.0.2, V1.0.3, V1.0.4, and V1.0.5 allows authenticated remote attackers to execute commands as root via specially crafted HTTP requests to the vulnerable endpoint...

CVE-2023-41029 Juplink RX4-1500 Command Injection Vulnerability

Command injection vulnerability in the homemng.htm endpoint in Juplink RX4-1500 Wifi router firmware versions V1.0.2, V1.0.3, V1.0.4, and V1.0.5 allows authenticated remote attackers to execute commands as root via specially crafted HTTP requests to the vulnerable endpoint...

CVE-2023-42450

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 4.2.0-beta1 and prior to version 4.2.0-rc2, by crafting specific input, attackers can inject arbitrary data into HTTP requests issued by Mastodon. This can be used to perform confused deputy attacks if...

Design/Logic Flaw

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 4.2.0-beta1 and prior to version 4.2.0-rc2, by crafting specific input, attackers can inject arbitrary data into HTTP requests issued by Mastodon. This can be used to perform confused deputy attacks if...

CVE-2023-42450 Mastodon Server-Side Request Forgery vulnerability

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 4.2.0-beta1 and prior to version 4.2.0-rc2, by crafting specific input, attackers can inject arbitrary data into HTTP requests issued by Mastodon. This can be used to perform confused deputy attacks if...

CVE-2023-42450

Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 4.2.0-beta1 and prior to version 4.2.0-rc2, by crafting specific input, attackers can inject arbitrary data into HTTP requests issued by Mastodon. This can be used to perform confused deputy attacks if...