CVE-2019-3410

All versions up to UKBBWF820+1.0.0B06 of ZTE WF820+ LTE Outdoor CPE product are impacted by Cross-Site Request Forgery vulnerability,which stems from the fact that WEB applications do not adequately verify whether requests come from trusted users. An attacker can exploit this vulnerability to sen...

CVE-2019-3410

Summary: CVE-2019-3410 affects the ZTE WF820+ LTE Outdoor CPE family, up to version UKBB_WF820+_1.0.0B06. The issue is Cross-Site Request Forgery, arising from web applications not adequately verifying the source of requests from trusted users, enabling an attacker to cause unintended server acti...

CVE-2019-3409

The CVE describes a command injection in ZTE WF820+ LTE Outdoor CPE, affecting UKBB_WF820+_1.0.0B06 and earlier. The root cause is inadequate input/data filtering when constructing executable commands, allowing an attacker to control the user terminal system. Several connected sources (NVD, CNVD,...

CVE-2019-3410: Cross-Site Request Forgery (CSRF)

All versions up to UKBBWF820+1.0.0B06 of ZTE WF820+ LTE Outdoor CPE product are impacted by Cross-Site Request Forgery vulnerability,which stems from the fact that WEB applications do not adequately verify whether requests come from trusted users. An attacker can exploit this vulnerability to sen...

CVE-2019-3409: Improper Neutralization of Special Elements used in an OS Command

All versions up to UKBBWF820+1.0.0B06 of ZTE WF820+ LTE Outdoor CPE product are impacted by command injection vulnerability. Due to inadequate parameter verification, unauthorized users can take advantage of this vulnerability to control the user terminal system...

CVE-2019-11523

Anviz Global M3 Outdoor RFID Access Control executes any command received from any source. No authentication/encryption is done. Attackers can fully interact with the device: for example, send the "open door" command, download the users list which includes RFID codes and passcodes in cleartext, o...

CVE-2019-11523

The CVE-2019-11523 issue affects the Anviz M3 Outdoor RFID Access Control. The vulnerability arises from a lack of authentication and encryption in the device’s TCP/IP network communications, allowing an attacker to send commands (e.g., open door), retrieve the user list (RFID codes and plaintext...

CVE-2019-11523: Missing Authentication for Critical Function

Anviz Global M3 Outdoor RFID Access Control executes any command received from any source. No authentication/encryption is done. Attackers can fully interact with the device: for example, send the "open door" command, download the users list which includes RFID codes and passcodes in cleartext, o...

CVE-2019-6576

CVE-2019-6576 affects Siemens SIMATIC HMI Comfort Panels (4"–22"), Comfort Outdoor Panels (7"/15"), KTP Mobile Panels (KTP400F, KTP700, KTP700F, KTP900, KTP900F), WinCC Runtime Advanced/Professional, WinCC (TIA Portal) and HMI Classic Devices (all versions prior to V15.1 Update 1). Root cause: in...

CVE-2019-6572: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" All versions V15.1 Update 1, SIMATIC HMI Comfort Outdoor Panels 7" & 15" All versions V15.1 Update 1, SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F All versions V15.1 Update 1, SIMATIC WinCC...

Multiple Siemens products vulnerable to encryption issues

Siemens SIMATIC WinCC is an automated data acquisition and monitoring SCADA system, Siemens SIMATIC HMI Comfort Panels is a touch panel device, Siemens SIMATIC HMI Comfort Outdoor Panels is a touch panel device for outdoor use, and Siemens SIMATIC HMI Comfort Outdoor Panels is a touch panel devic...

CVE-2019-6576: Undefined Security Weakness

A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" All versions V15.1 Update 1, SIMATIC HMI Comfort Outdoor Panels 7" & 15" All versions V15.1 Update 1, SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F All versions V15.1 Update 1, SIMATIC WinCC...

CVE-2019-6577: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" All versions V15.1 Update 1, SIMATIC HMI Comfort Outdoor Panels 7" & 15" All versions V15.1 Update 1, SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 und KTP900F All versions V15.1 Update 1, SIMATIC WinCC...

PT-2019-2034 · Siemens · Simatic Hmi Comfort Outdoor Panels 7" & 15" +16

Name of the Vulnerable Software and Affected Versions: SIMATIC CP 443-1 OPC UA versions prior to the fixed version SIMATIC ET 200SP Open Controller CPU 1515SP PC2 versions prior to V2.7 SIMATIC HMI Comfort Outdoor Panels 7" & 15" versions prior to V15.1 Upd 4 SIMATIC HMI Comfort Panels 4" - 22"...

CVE-2018-13813

A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" All versions V15 Update 4, SIMATIC HMI Comfort Outdoor Panels 7" & 15" All versions V15 Update 4, SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F All versions V15 Update 4, SIMATIC WinCC Runtime...

CVE-2018-13813: URL Redirection to Untrusted Site

A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" All versions V15 Update 4, SIMATIC HMI Comfort Outdoor Panels 7" & 15" All versions V15 Update 4, SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F All versions V15 Update 4, SIMATIC WinCC Runtime...

CVE-2018-13812: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" All versions V15 Update 4, SIMATIC HMI Comfort Outdoor Panels 7" & 15" All versions V15 Update 4, SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F All versions V15 Update 4, SIMATIC WinCC Runtime...

californiaoutdoorproperties.com XSS vulnerability

Open Bug Bounty ID: OBB-702506 Description| Value ---|--- Affected Website:| californiaoutdoorproperties.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

outdoor-products.asia XSS vulnerability

Open Bug Bounty ID: OBB-614318 Description| Value ---|--- Affected Website:| outdoor-products.asia Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

outdoor-works.de XSS vulnerability

Open Bug Bounty ID: OBB-602683 Description| Value ---|--- Affected Website:| outdoor-works.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...