CVE-2023-35698

Observable Response Discrepancy in the SICK ICR890-4 could allow a remote attacker to identify valid usernames for the FTP server from the response given during a failed login attempt...

SICK ICR890-4 安全漏洞

The SICK ICR890-4 is a track and trace system from SICK, Germany. A security vulnerability exists in the SICK ICR890-4 that stems from an observable response discrepancy when attempting to log into an FTP server...

Milesight UR32L 缓冲区错误漏洞

The Milesight UR32L is a 4G industrial router from China-based Milesight. A security vulnerability exists in the Milesight UR32L version v32.3.0.5, which stems from the use of an insecure sprintf pattern. An attacker could exploit the vulnerability to cause a buffer overflow via a specially craft...

nodejs 安全漏洞

Node.js is an open source, cross-platform JavaScript runtime environment. A security vulnerability exists in nodejs that stems from not strictly using CRLF sequences to delimit HTTP requests, which could lead to HTTP request smuggling HRS...

CLSA-2023-1687795531 Fix CVE(s): CVE-2021-38371

SECURITY UPDATE: Response injection buffering during MTA SMTP sending - debian/patches/CVE-2021-38371.patch: Enforce STARTTLS sync point, client side in src/transports/smtp.c - CVE-2021-38371...

The vulnerability of the monitoring system for critical equipment, StruxureWare Data Center Expert, is related to insufficient protection of the website structure. This allows attackers to carry out cross-site scripting attacks.

The vulnerability of the StruxureWare Data Center Exper monitoring system relates to insufficient protection of the website structure. Exploiting this vulnerability allows a malicious actor to carry out a cross-site scripting attack at the final download point of a DCE file, by modifying paramete...

PT-2023-20629 · Ox Software Gmbh +1 · Ox App Suite +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue arises when adding an external mail account, as the processing of SMTP "capabilities" responses is not limited to plausible sizes. An attacker...

apache-commons-net: FTP client trusts the host from PASV response by default

A flaw was found in Apache Commons Net's FTP, where the client trusts the host from PASV response by default. A malicious server could redirect the Commons Net code to use a different host, but the user has to connect to the malicious server in the first place. This issue could lead to leakage of...

The vulnerability of the microprogrammed servo system software of Kinetix 5500 allows a intruder to gain unauthorized access to the device.

The vulnerability of the Kinetix 5500 servo-controller software-related microprogramming systems is related to deficiencies in access control. Exploiting this vulnerability could allow an intruder, operating locally, to gain unauthorized access to the device using network protocols like telnet or...

The vulnerability of the FTP server function of microprogrammed logic controllers MELSEC RJ71EIP91, SW1DNN-EIPCT-BD, FX5-ENET/IP, SW1DNN-EIPCTFX5-BD allows a intruder to gain unauthorized access to protected information.

The vulnerability of the FTP server functions of microprogrammed logic controllers such as MELSEC RJ71EIP91, SW1DNN-EIPCT-BD, FX5-ENET/IP, and SW1DNN-EIPCTFX5-BD is related to the use of fixed password encoding. Exploiting this vulnerability can allow an intruder to gain unauthorized access to...

Mitsubishi Electric MELSEC 信任管理问题漏洞

The Mitsubishi Electric MELSEC iQ-R series and the Mitsubishi Electric MELSEC iQ-F series are both programmable logic controllers from Mitsubishi Electric Japan. A security vulnerability exists in the Mitsubishi Electric MELSEC that stems from the use of hard-coded passwords. An attacker could...

PT-2023-3766 · Mitsubishi · Melsec Iq-F Series Ethernet/Ip Module Fx5-Enet/Ip +1

Name of the Vulnerable Software and Affected Versions: MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 affected versions not specified MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP affected versions not specified Description: The issue is related to an unrestricted upload of files with...

PT-2023-3007 · Mitsubishi · Melsec Iq-F Series Ethernet/Ip Module Fx5-Enet/Ip +1

Name of the Vulnerable Software and Affected Versions: MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 affected versions not specified MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP affected versions not specified Description: The issue is related to the use of hard-coded passwords in the FTP...

PT-2023-3094 · Mitsubishi · Melsec Iq-R Series Ethernet/Ip Module Rj71Eip91 +3

Name of the Vulnerable Software and Affected Versions: Mitsubishi Electric Corporation EtherNet/IP configuration tools SW1DNN-EIPCT-BD and SW1DNN-EIPCTFX5-BD MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP Description: The issue is related to...

CVE-2023-31594

IC Realtime ICIP-P2012T 2.420 is vulnerable to Incorrect Access Control via an exposed HTTP channel using VLC network...

WFTPD 安全漏洞

WFTPD is an FTP service. A security vulnerability exists in WFTPD version 3.25 that stems from username and password hashes stored in a publicly viewable wftpd.ini configuration file in the WFTPD directory...

PT-2023-23399

Name of the Vulnerable Software and Affected Versions IC Realtime ICIP-P2012T version 2.420 Description The issue concerns an Incorrect Access Control vulnerability. It can be exploited via an exposed HTTP channel using the VLC network. Recommendations For IC Realtime ICIP-P2012T version 2.420,...

The vulnerability in the web interface of the Cisco Identity Services Engine (ISE) management platform allows a perpetrator to delete arbitrary files.

The vulnerability in the web interface for managing Cisco Identity Services Engine ISE platforms relates to the implementation of security functions at the client side. Exploiting this vulnerability allows a malicious actor to delete arbitrary files using a specially created HTTP request...

curl: FTP too eager connection reuse

A flaw was found in the Curl package. Libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, several FTP settings were left out from the configuration match checks, making them match too easily. The problematic...

CVE-2023-1834

Rockwell Automation was made aware that Kinetix 5500 drives, manufactured between May 2022 and January 2023, and are running v7.13 may have the telnet and FTP ports open by default. This could potentially allow attackers unauthorized access to the device through the open ports...