1687 matches found
CVE-2023-38148
Mode C: CVE-2023-38148 is described in connected sources as a Windows Internet Connection Sharing (ICS) Remote Code Execution vulnerability. It is reported that an unauthenticated attacker could exploit ICS by sending a specially crafted data packet to a vulnerable system to install malware. The ...
Siemens SIMATIC IPCs
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...
Siemens Parasolid
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...
CVE-2022-47069
creationtimestamp| type| source ---|---|--- 2023-08-22 22:18:19+00:00| seen| https://t.me/cibsecurity/68972 2025-02-13 11:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-044-09...
CVE-2023-1977
The Booking Manager WordPress plugin before 2.0.29 does not validate URLs input in it's admin panel or in shortcodes for showing events from a remote .ics file, allowing an attacker with privileges as low as Subscriber to perform SSRF attacks on the sites internal network...
CVE-2023-1977
The Booking Manager WordPress plugin before 2.0.29 does not validate URLs input in it's admin panel or in shortcodes for showing events from a remote .ics file, allowing an attacker with privileges as low as Subscriber to perform SSRF attacks on the sites internal network...
CVE-2023-1977 Booking Manager < 2.0.29 - Subscriber+ SSRF
The Booking Manager WordPress plugin before 2.0.29 does not validate URLs input in it's admin panel or in shortcodes for showing events from a remote .ics file, allowing an attacker with privileges as low as Subscriber to perform SSRF attacks on the sites internal network...
Wordpress EventON Calendar 4.4 Plugin - Unauthenticated Post Access via IDOR Vulnerability
Exploit Title: Wordpress Plugin EventON Calendar 4.4 - Unauthenticated Post Access via IDOR Exploit Author: Miguel Santareno Vendor Homepage: https://www.myeventon.com/ Version: 4.4 Tested on: Google and Firefox latest version CVE : CVE-2023-3219 1. Description The plugin does not validate that t...
CVE-2023-37555
creationtimestamp| type| source ---|---|--- 2023-08-03 16:40:18+00:00| seen| https://t.me/cibsecurity/67676 2025-04-03 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-093-04 2025-04-03 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-093-...
CVE-2023-37550
creationtimestamp| type| source ---|---|--- 2023-08-03 16:39:59+00:00| seen| https://t.me/cibsecurity/67662 2025-04-03 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-093-04 2025-04-03 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-093-...
Moxa PT-7528 and PT-7828 Series Use of Hard-Coded Credentials (CVE-2020-6985)
In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, these devices use a hard-coded service code for access to the console. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...
Moxa IKS, EDS Improper Restriction of Excessive Authentication Attempts (CVE-2019-6524)
Moxa IKS and EDS do not implement sufficient measures to prevent multiple failed authentication attempts, which may allow an attacker to discover passwords via brute force attack. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...
Moxa MGate Authentication Bypass (CVE-2016-5804)
Moxa MGate MB3180 before 1.8, MGate MB3280 before 2.7, MGate MB3480 before 2.6, MGate MB3170 before 2.5, and MGate MB3270 before 2.7 use weak encryption, which allows remote attackers to bypass authentication via a brute-force series of guesses for a parameter value. This plugin only works with...
Moxa EDR-G903 series Hard-coded Credentials (CVE-2012-4712)
Moxa EDR-G903 series routers with firmware before 2.11 have a hardcoded account, which allows remote attackers to obtain unspecified device access via unknown vectors. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...
Moxa NPort 5110, 5130, and 5150 Uncontrolled Resource Consumption (CVE-2017-14028)
A Resource Exhaustion issue was discovered in Moxa NPort 5110 Version 2.2, NPort 5110 Version 2.4, NPort 5110 Version 2.6, NPort 5110 Version 2.7, NPort 5130 Version 3.7 and prior, and NPort 5150 Version 3.7 and prior. An attacker may be able to exhaust memory resources by sending a large amount ...
APSystems Altenergy Power Control
1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely / low attack complexity / public exploits available Vendor: APSystems Equipment: Altenergy Power Control Vulnerability: OS Command Injection 2. RISK EVALUATION Successful exploitation of this vulnerability may allow remote...
CVE-2023-0464
creationtimestamp| type| source ---|---|--- 2023-07-28 16:05:05+00:00| exploited| https://t.me/truesecator/4670 2025-02-13 11:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-044-09 2025-08-14 10:00:00+00:00| seen|...
Exploit for Improper Privilege Management in Deltaww Infrasuite_Device_Master
CVE-2023-30765 CVE-2023-30765 / ZDI-23-905 - Delta Electronic...
Rockwell Automation ControlLogix Bugs Expose Industrial Systems to Remote Attacks
The U.S. Cybersecurity and Infrastructure Security Agency CISA has alerted of two security flaws impacting Rockwell Automation ControlLogix EtherNet/IP ENIP communication module models that could be exploited to achieve remote code execution and denial-of-service DoS. "The results and impact of...
CVE-2023-3219
The EventON WordPress plugin before 2.1.2 does not validate that the eventid parameter in its eventonicsdownload ajax action is a valid Event, allowing unauthenticated visitors to access any Post including unpublished or protected posts content via the ics export functionality by providing the...