CVE-2019-10921

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions V8.3. Unencrypted storage of passwords in the project could allow an attacker with access to port 10005/tcp to obtain passwords of the device. The security vulnerability could be exploited by an unauthenticated...

CVE-2019-10920

CVE-2019-10920 affects Siemens LOGO! 8 BM (and SIPLUS variants) with all versions before 8.3. The issue is a vulnerability in which project data on the device, accessible via port 10005/tcp, can be decrypted due to a hard-coded encryption key, allowing an unauthenticated remote attacker to access...

CVE-2019-10919

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions V8.3. Attackers with access to port 10005/tcp could perform device reconfigurations and obtain project files from the devices. The system manual recommends to protect access to this port. The security vulnerabili...

CVE-2019-10920

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants All versions V8.3. Project data stored on the device, which is accessible via port 10005/tcp, can be decrypted due to a hardcoded encryption key. The security vulnerability could be exploited by an unauthenticated attacker wi...

CVE-2019-10919

Siemens LOGO! 8 BM (including SIPLUS variants) is affected by CVE-2019-10919 in all versions prior to V8.3. The issue allows an unauthenticated attacker with network access to port 10005/tcp to reconfigure the device and exfiltrate project files, affecting confidentiality, integrity, and availabi...

CVE-2019-10921

CVE-2019-10921 affects Siemens LOGO! 8 BM (incl. SIPLUS) with all versions prior to 8.3. The issue is plaintext storage of passwords in the project, allowing an unauthenticated attacker with network access to port 10005/tcp to obtain device passwords, impacting confidentiality. Public exploit det...

Siemens LOGO!8 BM Trust Management Issue Vulnerability

The Siemens LOGO!8 BM is a programmable logic controller from Siemens, Germany. A vulnerability in Siemens LOGO!8 BM all versions exists due to a trust management issue. The vulnerability stems from the lack of an effective trust management mechanism in a networked system or product. An attacker...

Siemens LOGO! Soft Comfort (Update A)

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low skill level to exploit Vendor: Siemens Equipment: LOGO! Soft Comfort Vulnerability: Deserialization of Untrusted Data 2. UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled ICSA-19-134-03 Siemens LOGO! Soft...

Siemens LOGO! 8 BM (Update A)

1. EXECUTIVE SUMMARY CVSS v3 9.4 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: LOGO! 8 BM Vulnerabilities: Missing Authentication for Critical Function, Improper Handling of Extra Values, Plaintext Storage of a Password 2. UPDATE INFORMATION This updated...

Siemens LOGO!8 BM Devices Man-in-the-Middle

Binary data 720104.prm...

Siemens LOGO!8 BM Devices < 1.81.2 Insufficiently Protected Credentials

Binary data 720103.prm...

Siemens LOGO! 24CEo PLC Detection

Binary data 762004.prm...

Siemens LOGO! 230RCE PLC Detection

Binary data 762003.prm...

Siemens LOGO! 24CE PLC Detection

Binary data 762000.prm...

Siemens LOGO! 24RCE PLC Detection

Binary data 762002.prm...

Cross-Site Scripting (XSS)

archiva-repository-admin-default is vulnerable to cross-site scripting. A remote authenticated attacker who has administrative access to modify the central configurations, is able to inject arbitrary Javascript into a victim's browser via the central configuration entries such as the logo URL...

DiliCMS Cross-Site Scripting Vulnerability (CNVD-2019-07940)

DiliCMS is a content management system CMS based on Codelgniter. A cross-site scripting vulnerability exists in the site logo text box in DiliCMS version 2.4.0. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...

CVE-2019-8440

An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the third textbox aka site logo of "System setting-site setting" of admin/index.php, aka sitelogo...

CVE-2019-8440

An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the third textbox aka site logo of "System setting-site setting" of admin/index.php, aka sitelogo...

Cross site scripting

An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the third textbox aka site logo of "System setting-site setting" of admin/index.php, aka sitelogo...