2111 matches found
CVE-2019-10924: Deserialization of Untrusted Data
A vulnerability has been identified in LOGO! Soft Comfort All versions V8.3. The vulnerability could allow an attacker to execute arbitrary code if the attacker tricks a legitimate user to open a manipulated project. In order to exploit the vulnerability, a valid user must open a manipulated...
CVE-2019-10921: Plaintext Storage of a Password
A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions V8.3. Unencrypted storage of passwords in the project could allow an attacker with access to port 10005/tcp to obtain passwords of the device. The security vulnerability could be exploited by an unauthenticated...
CVE-2019-10919: Missing Authentication for Critical Function
A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions V8.3. Attackers with access to port 10005/tcp could perform device reconfigurations and obtain project files from the devices. The system manual recommends to protect access to this port. The security vulnerabili...
PT-2019-2288
Name of the Vulnerable Software and Affected Versions LOGO! 8 BM versions prior to V8.3 Description The issue is related to the storage of unencrypted passwords in the project data. An attacker with network access to port 10005/tcp could exploit this to obtain device passwords. No user interactio...
PT-2019-2285
Name of the Vulnerable Software and Affected Versions LOGO! Soft Comfort versions prior to V8.3 Description A vulnerability has been identified that could allow an attacker to execute arbitrary code if a legitimate user opens a manipulated project file. No further privileges are required on the...
CVE-2019-10920: Use of Hard-coded Cryptographic Key
A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions V8.3. Project data stored on the device, which is accessible via port 10005/tcp, can be decrypted due to a hardcoded encryption key. The security vulnerability could be exploited by an unauthenticated attacker wi...
PT-2019-2287
Name of the Vulnerable Software and Affected Versions LOGO! 8 BM incl. SIPLUS variants versions prior to V8.3 Description A security issue has been identified where project data stored on the device can be decrypted due to a hardcoded encryption key. This data is accessible via port 10005/tcp. An...
Siemens LOGO! Soft Comfort (Update A)
1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low skill level to exploit Vendor: Siemens Equipment: LOGO! Soft Comfort Vulnerability: Deserialization of Untrusted Data 2. UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled ICSA-19-134-03 Siemens LOGO! Soft...
Siemens LOGO! 8 BM (Update A)
1. EXECUTIVE SUMMARY CVSS v3 9.4 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: LOGO! 8 BM Vulnerabilities: Missing Authentication for Critical Function, Improper Handling of Extra Values, Plaintext Storage of a Password 2. UPDATE INFORMATION This updated...
Siemens LOGO!8 BM Devices Man-in-the-Middle
Binary data 720104.prm...
Siemens LOGO! 24RCE PLC Detection
Binary data 762002.prm...
Siemens LOGO! 230RCE PLC Detection
Binary data 762003.prm...
Siemens LOGO! 24CE PLC Detection
Binary data 762000.prm...
Siemens LOGO!8 BM Devices < 1.81.2 Insufficiently Protected Credentials
Binary data 720103.prm...
Siemens LOGO! 24CEo PLC Detection
Binary data 762004.prm...
Cross-Site Scripting (XSS)
archiva-repository-admin-default is vulnerable to cross-site scripting. A remote authenticated attacker who has administrative access to modify the central configurations, is able to inject arbitrary Javascript into a victim's browser via the central configuration entries such as the logo URL...
CVE-2019-0213
In Apache Archiva before 2.2.4, it may be possible to store malicious XSS code into central configuration entries, i.e. the logo URL. The vulnerability is considered as minor risk, as only users with admin role can change the configuration, or the communication between the browser and the Archiva...
CVE-2019-0213: Improper Neutralization of Input During Web Page Generation
In Apache Archiva before 2.2.4, it may be possible to store malicious XSS code into central configuration entries, i.e. the logo URL. The vulnerability is considered as minor risk, as only users with admin role can change the configuration, or the communication between the browser and the Archiva...
DiliCMS Cross-Site Scripting Vulnerability (CNVD-2019-07940)
DiliCMS is a content management system CMS based on Codelgniter. A cross-site scripting vulnerability exists in the site logo text box in DiliCMS version 2.4.0. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...
