CVE-2022-43765 DoS in APROLs Tbase server

B&R APROL versions R 4.2-07 doesn’t process correctly specially formatted data packages sent to port 55502/tcp, which may allow a network based attacker to cause an application Denial-of-Service...

CVE-2022-43761

Missing authentication when creating and managing the B&R APROL database in versions R 4.2-07 allows reading and changing the system configuration...

CVE-2022-43764

CVE-2022-43764 affects B&R APROL, specifically the Tbase server. The vulnerability stems from insufficient validation of input parameters when changing configuration, which can cause a buffer overflow. Impact as documented includes Denial-of-Service conditions and potential execution of arbitrary...

CVE-2022-43763

CVE-2022-43763 affects B&R APROL prior to R 4.2-07. The vulnerability is an insufficient check of preconditions in the Tbase server that can lead to a Denial of Service when commands are called. Affected component: Tbase server within APROL; affected versions: APROL

CVE-2022-43762 Memory leak when receiving messages in APROL Tbase server

Lack of verification in B&R APROL Tbase server versions R 4.2-07 may lead to memory leaks when receiving messages...

CVE-2022-43762

CVE-2022-43762 affects B&R APROL Tbase server prior to R 4.2-07. The issue is caused by a lack of verification in the Tbase server, leading to memory leaks when receiving messages. Affected versions are before R 4.2-07. Remediation observed in sources: update to R 4.2-07 or later; as a temporary ...

CVE-2022-43761 Lack of authentication when managing APROL database

Missing authentication when creating and managing the B&R APROL database in versions R 4.2-07 allows reading and changing the system configuration...

CVE-2022-43761

CVE-2022-43761 affects B&R APROL: missing authentication when creating/managing the APROL database prior to R 4.2-07 allows reading and modifying the system configuration. Impact: potential unauthorized access to configuration data; CVSS indicates HIGH/CRITICAL depending on vector. Remediation: u...

PT-2023-1648 · B&R · B&R Aprol

Name of the Vulnerable Software and Affected Versions: B&R APROL versions prior to R 4.2-07 Description: The issue is related to insufficient validation of input parameters when changing configuration on the Tbase server, which could result in a buffer overflow. This may lead to Denial-of-Service...

PT-2023-1843 · B&R · B&R Aprol

Name of the Vulnerable Software and Affected Versions: B&R APROL versions prior to R 4.2-07 Description: The issue is related to missing authentication when creating and managing the B&R APROL database, allowing unauthorized reading and modification of system configuration. This can be exploited...

PT-2023-1845 · B&R · B&R Aprol

Name of the Vulnerable Software and Affected Versions: B&R APROL versions prior to R 4.2-07 Description: The issue is related to incorrect checking of the return value of a method or function in the Tbase database server of the B&R APROL software solution for monitoring industrial systems. This c...

DEBIAN-CVE-2022-46663

In GNU Less before 609, crafted data can result in "less -R" not filtering ANSI escape sequences sent to the terminal...

I’m Now a Full-Time Professional Open Source Maintainer

or, "Holy shit, it works!" Last May I left my job on the Go team at Google to experiment with more sustainable paths for open-source maintainers. I held on to my various maintainer hats Go cryptography, transparency tooling, age, mkcert, yubikey-agent…, iterated on the model since September, and ...

Mitsubishi Electric Multiple Factory Automation Products (Update D)

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Mitsubishi Electric Equipment: GOT2000 compatible HMI software, CC-Link IE TSN Industrial Managed Switch, MELSEC iQ-R Series OPC UA Server Module Vulnerabilities: Infinite Loop, OS Command Injection 2...

Ubuntu: Security Advisory (USN-4799-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-36657

uptimed before 0.4.6-r1 on Gentoo allows local users with access to the uptimed user account to gain root privileges by creating a hard link within the /var/spool/uptimed directory, because there is an unsafe chown -R call...

Hardcoded credentials

uptimed before 0.4.6-r1 on Gentoo allows local users with access to the uptimed user account to gain root privileges by creating a hard link within the /var/spool/uptimed directory, because there is an unsafe chown -R call...

CVE-2020-36657

uptimed before 0.4.6-r1 on Gentoo allows local users with access to the uptimed user account to gain root privileges by creating a hard link within the /var/spool/uptimed directory, because there is an unsafe chown -R call...

CVE-2022-40267 Authentication Bypass Vulnerability in Web Server Function on MELSEC Series

Predictable Seed in Pseudo-Random Number Generator PRNG vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-xMy/z x=32,64,80, y=T,R, z=ES,DS,ESS,DSS with serial number 17X or later, and versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-xMy/z...

Mitsubishi Electric MELSEC iQ-F, iQ-R Series

1. EXECUTIVE SUMMARY CVSS v3 5.9 ATTENTION: Exploitable remotely Vendor: Mitsubishi Electric Equipment: MELSEC iQ-F and iQ-R Series products Vulnerability: Predictable Seed in Pseudo-Random Number Generator PRNG 2. UPDATE OR REPOSTED INFORMATION This updated advisory is a follow-up to the...