CVE-2022-30304

FortiAnalyzer contains a cross-site scripting (XSS) vulnerability (CWE-79) that can be exploited remotely by an unauthenticated attacker via a URL parameter observed in the FortiWeb attack log view. Affects FortiAnalyzer versions prior to 7.2.1, 7.0.4 and 6.4.8; successful exploitation leads to s...

CVE-2022-41993

DENSHI NYUSATSU CORE SYSTEM v6 R4 and earlier is affected by CVE-2022-41993, a Cross-site Scripting (CWE-79) vulnerability. The issue allows a remote unauthenticated attacker to inject arbitrary scripts, potentially impacting users who log in or access the system. Connected sources confirm the af...

CVE-2022-3270

The CVE-2022-3270 issue affects Festo automation controllers that use the FGMC protocol. A remote, unauthenticated attacker can invoke functions exposed by an undocumented protocol, potentially rebooting devices and causing a complete loss of confidentiality, integrity, and availability (DoS). Re...

Design/Logic Flaw

Insufficiently Protected Credentials vulnerability in Mitsubishi Electric Corporation GX Works3 versions 1.015R and later allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated users could access to MELSEC safety CPU modules illgally...

Cross site scripting

Out-of-bounds Read vulnerability in ICONICS GENESIS64 versions 10.97.1 and prior and Mitsubishi Electric MC Works64 versions 4.04E 10.95.210.01 and prior allows a remote unauthenticated attacker to disclose information on memory or cause a Denial of Service DoS condition by sending specially...

Design/Logic Flaw

Improper Resource Locking vulnerability in Mitsubishi Electric MELSEC iQ-R Series R12CCPU-V firmware versions "16" and prior, Mitsubishi Electric MELSEC-Q Series Q03UDECPU the first 5 digits of serial No. "24061" and prior, Mitsubishi Electric MELSEC-Q Series Q04/06/10/13/20/26/50/100UDEHCPU the...

CVE-2022-25162

Improper Input Validation vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U-xMy/zx=32,64,80, y=T,R, z=ES,DS,ESS,DSS with serial number 17X or later and versions prior to 1.270, Mitsubishi Electric Mitsubishi Electric MELSEC iQ-F series FX5U-xMy/zx=32,64,80, y=T,R, z=ES,DS,ESS,DSS with...

CVE-2022-25162: Improper Input Validation

Improper Input Validation vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U-xMy/zx=32,64,80, y=T,R, z=ES,DS,ESS,DSS with serial number 17X or later and versions prior to 1.270, Mitsubishi Electric Mitsubishi Electric MELSEC iQ-F series FX5U-xMy/zx=32,64,80, y=T,R, z=ES,DS,ESS,DSS with...

CVE-2020-25180: Use of Hard-coded Cryptographic Key

Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x includes the functionality of setting a password that is required to execute privileged commands. The password value passed to ISaGRAF Runtime is the result of encryption performed with a fixed key value using the tiny encryption algorithm...

CVE-2021-45468: Inconsistent Interpretation of HTTP Requests

Imperva Web Application Firewall WAF before 2021-12-23 allows remote unauthenticated attackers to use "Content-Encoding: gzip" to evade WAF security controls and send malicious HTTP POST requests to web servers behind the WAF...

CVE-2021-20610: Improper Handling of Length Parameter Inconsistency

Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric MELSEC iQ-R Series R00/01/02CPU, MELSEC iQ-R Series R04/08/16/32/120ENCPU, MELSEC iQ-R Series R08/16/32/120SFCPU, MELSEC iQ-R Series R08/16/32/120PCPU, MELSEC iQ-R Series R08/16/32/120PSFCPU, MELSEC iQ-R Seri...

CVE-2021-31851

A Reflected Cross-Site Scripting vulnerability in McAfee Policy Auditor prior to 6.5.2 allows a remote unauthenticated attacker to inject arbitrary web script or HTML via the profileNodeID request parameters. The malicious script is reflected unmodified into the Policy Auditor web-based interface...

CVE-2021-20600: Uncontrolled Resource Consumption

Uncontrolled resource consumption in Mitsubishi Electric MELSEC iQ-R series C Controller Module R12CCPU-V Firmware Versions "16" and prior allows a remote unauthenticated attacker to cause a denial-of-service DoS condition by sending a large number of packets in a short time while the module...

CVE-2021-20589

The CVE-2021-20589 vulnerability affects Mitsubishi Electric GOT2000, GOT SIMPLE GS21, GT SoftGOT2000, and LE7-40GU-L MODBUS/TCP implementations. Root cause: Buffer access with an incorrect length value (CWE-805) in the MODBUS/TCP slave function allows a remote, unauthenticated attacker to stop t...

CVE-2021-27194: Cleartext Transmission of Sensitive Information

Cleartext transmission of sensitive information in Netop Vision Pro up to and including 9.7.1 allows a remote unauthenticated attacker to gather credentials including Windows login usernames and passwords...

CVE-2020-5141

The CVE-2020-5141 entry covers SonicOS SSLVPN: a remote, unauthenticated attacker can brute-force the Virtual Assist ticket ID in the SSLVPN service. Affected software includes SonicOS Gen 5 (5.9.1.7, 5.9.1.13), Gen 6 (6.5.4.7, 6.5.1.12, 6.0.5.3), SonicOSv 6.5.4.v, and Gen 7 (SonicOS 7.0.0.0). Th...

CVE-2020-19880: Improper Neutralization of Input During Web Page Generation

DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function form 'Name' in dbhcms\types.php, A remote unauthenticated attacker can exploit this vulnerability to hijack other users...

CVE-2020-5609

Directory traversal vulnerability in CAMS for HIS CENTUM CS 3000 includes CENTUM CS 3000 Small R3.08.10 to R3.09.50, CENTUM VP includes CENTUM VP Small, Basic R4.01.00 to R6.07.00, B/M9000CS R5.04.01 to R5.05.01, and B/M9000 VP R6.01.01 to R8.03.01 allows a remote unauthenticated attacker to crea...

CVE-2019-3723: Improper Input Validation

Dell EMC OpenManage Server Administrator OMSA versions prior to 9.1.0.3 and prior to 9.2.0.4 contain a web parameter tampering vulnerability. A remote unauthenticated attacker could potentially manipulate parameters of web requests to OMSA to create arbitrary files with empty content or delete th...

CVE-2017-16743: Improper Authorization

An Improper Authorization issue was discovered in PHOENIX CONTACT FL SWITCH 3xxx, 4xxx, and 48xxx Series products running firmware Version 1.0 to 1.32. A remote unauthenticated attacker may be able to craft special HTTP requests allowing an attacker to bypass web-service authentication allowing t...