PT-2022-26026 · Delta Electronics · Infrasuite Device Master

Name of the Vulnerable Software and Affected Versions: Delta Electronics InfraSuite Device Master versions 00.00.01a and prior Description: The issue concerns a lack of proper authentication for functions that create and modify user groups. An attacker could exploit this by providing malicious...

Delta Electronics InfraSuite Device Master 访问控制错误漏洞

Delta Electronics InfraSuite Device Master is used to simplify and automate the monitoring of critical devices by Delta Electronics of Taiwan, China. The Delta Electronics InfraSuite Device Master suffers from an access control error vulnerability that stems from deserialization of untrusted data...

CVE-2022-41489: Cross-Site Request Forgery (CSRF)

WAYOS LQ09 22.03.17V was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to send crafted requests to the server from the affected device. This vulnerability is exploitable due to a lack of authentication in the component Usbupload.htm...

Xiaomi specific devices 安全漏洞

Xiaomi specific devices are a series of specific devices from the Chinese company Xiaomi. A security vulnerability exists in Xiaomi specific devices, which stems from a lack of authentication. An attacker could exploit this vulnerability to gain elevated privileges...

The vulnerability of the Valmet System 2019 software suite (Metso DNA) lies in the lack of authentication for a critical function, allowing a perpetrator to execute arbitrary codes.

The vulnerability of the Valmet System 2019 software suite Metso DNA is related to the lack of authentication for a critical function. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

PT-2022-37668

Уязвимость микропрограммного обеспечения программируемых логических контроллеров STARDOM FCN/FCJ связана с недостаточной проверкой подлинности данных. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, получить полный контроль над устройством...

ManageEngine NetFlow Analyzer getUserAPIKey Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of ManageEngine NetFlow Analyzer. Authentication is not required to exploit this vulnerability. The specific flaw exists within the getUserAPIKey function. The issue results from the lack of authenticati...

Lexmark MC3224i Firmware Downgrade Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lexmark MC3224i printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firmware upgrade feature. The issue results from the lack of...

CVE-2022-30276

The Motorola MOSCAD and ACE line of RTUs through 2022-05-02 omit an authentication requirement. They feature IP Gateway modules which allow for interfacing between Motorola Data Link Communication MDLC networks potentially over a variety of serial, RF and/or Ethernet links and TCP/IP networks...

CVE-2022-29957

The Emerson DeltaV Distributed Control System DCS through 2022-04-29 mishandles authentication. It utilizes several proprietary protocols for a wide variety of functionality. These protocols include Firmware upgrade 18508/TCP, 18518/TCP; Plug-and-Play 18510/UDP; Hawk services 18507/UDP; Managemen...

Samsung Contacts Storage path traversal vulnerability

Samsung Contacts Storage is the contact storage for Samsung SAMSUNG mobile devices.A path traversal vulnerability exists in Samsung Contacts Storage, which stems from a lack of proper authentication logic in Samsung Contacts Storage. An attacker could use this vulnerability to access arbitrary...

The vulnerability of Siemens SICAM P850 and Siemens SICAM P855 multifunctional measuring devices lies in the lack of authentication for critical functions. This allows attackers to disclose internal configuration details of the web interface or alter network settings.

The vulnerability of Siemens SICAM P850 and Siemens SICAM P855 multifunctional measuring devices lies in the lack of authentication for critical functions. Exploiting this vulnerability can allow an attacker to disclose internal configuration details of the web interface or modify network setting...

Schneider Electric IGSS Data Server 访问控制错误漏洞

The Schneider Electric IGSS Data Server is a data server for the interactive graphical Scada system from Schneider Electric, France. An Access Control Error vulnerability exists in Schneider Electric IGSS Data Server versions prior to 15.0.0.22140, which stems from the application's lack of...

The vulnerability of the SecureTransferFiles function in the kernel of the software package for working with data from IoT devices allows a hacker to execute arbitrary code.

The vulnerability of the SecureTransferFiles function in the kernel of the software package for working with data from IoT devices is related to the lack of authentication for the critical function. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

PT-2022-10185

Name of the Vulnerable Software and Affected Versions AVEVA System Platform versions 2017 through 2020 R2 P01 Description The issue concerns the lack of authentication for certain functionality that requires a provable user identity. Recommendations For AVEVA System Platform versions 2017 through...

Design/Logic Flaw

Sensitive information can be obtained through the handling of serialized data. The issue results from the lack of proper authentication required to query the server...

CVE-2020-14479

CVE-2020-14479 affects Inductive Automation Ignition (Gateway) with a vulnerability described as missing authentication for a critical function, leading to information disclosure via serialized data handling. Affected products include Ignition Gateway versions prior to 7.9.14 (7.x line) and prior...

PT-2022-8567

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned. Description The issue allows sensitive information to be obtained through the handling of serialized data due to the lack of proper authentication required to query the server. Recommendations At...

PT-2022-13528

Name of the Vulnerable Software and Affected Versions Software affected versions not specified Description The issue is related to the lack of authentication for critical system functionality. Recommendations At the moment, there is no information about a newer version that contains a fix for thi...

PT-2022-17042

Name of the Vulnerable Software and Affected Versions totolink EX300 v2 version 4.0.3c.140 B20210429 totolink EX1200T version 4.1.2cu.5230 B20210706 Description The issue is related to the lack of an authentication mechanism in the affected devices. Recommendations For totolink EX300 v2 version...