Cross site scripting

A vulnerability in the ArubaOS web-based management interface could allow an unauthenticated remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in...

CVE-2023-32753

OMICARD EDM’s file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary system commands or disrupt service...

CVE-2023-32753

This CVE appears in OMICARD EDM where the file upload function does not restrict uploading of dangerous file types. The root cause is a lack of validation for uploaded content, allowing an unauthenticated attacker to upload and execute arbitrary executables, potentially enabling system commands o...

CVE-2023-28701 ELITE Web Fax - SQL Injection

ELITE TECHNOLOGY CORP. Web Fax has a vulnerability of SQL Injection. An unauthenticated remote attacker can inject SQL commands into the input field of the login page to perform arbitrary system commands, disrupt service or terminate service...

CVE-2023-30602 Hitron Technologies Inc. CODA-5310 - Insecure service Telnet

Hitron Technologies CODA-5310’s Telnet function transfers sensitive data in plaintext. An unauthenticated remote attacker can exploit this vulnerability to access credentials of normal users and administrator...

Welotec TK500 访问控制错误漏洞

The Welotec TK500 is an industrial-grade 4G LTE router from Welotec. The Welotec TK500 suffers from an access control error vulnerability that originates from the fact that an unauthenticated, remote attacker who knows the name of the MQTT topic can send and receive messages, including GET/SET...

CVE-2023-29106

A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 All versions = V2.0 = V2.0 V2.1. The export endpoint is accessible via REST API without authentication. This could allow an unauthenticated remote attacker to download the files available via the endpoint...

CVE-2023-2156

A flaw was found in the networking subsystem of the Linux kernel within the handling of the RPL protocol. This issue results from the lack of proper handling of user-supplied data, which can lead to an assertion failure. This may allow an unauthenticated remote attacker to create a denial of...

CVE-2023-20852 aEnrich a+HRD - Deserialization of Untrusted Data

aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ interpreter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands to perform arbitrary system operation or disrupt service...

Exploit for Uncontrolled Resource Consumption in Cbm Control_De_Ciber

CVE-2022-48474 & CVE-2022-48475 PoC & exploits for CVE-2022-48...

CVE-2023-28489

A vulnerability has been identified in CP-8031 MASTER MODULE All versions CPCI85 V05, CP-8050 MASTER MODULE All versions CPCI85 V05. Affected devices are vulnerable to command injection via the web server port 443/tcp, if the parameter “Remote Operation” is enabled. The parameter is disabled by...

CVE-2023-0325

Uvdesk version 1.1.1 allows an unauthenticated remote attacker to exploit a stored XSS in the application. This is possible because the application does not correctly validate the message sent by the clients in the ticket...

CVE-2023-22300

An unauthenticated remote attacker could force all authenticated users, such as administrative users, to perform unauthorized actions by viewing the logs. This action would also grant the attacker privilege escalation...

CVE-2023-22300

CVE-2023-22300 affects SAUTER EY-modulo 5 Building Automation Stations (EY-AS525F001 with moduWeb). The ICS advisory describes an unauthenticated remote attacker who can force all authenticated users (including admins) to perform unauthorized actions by viewing logs, enabling privilege escalation...

CVE-2023-25909 HGiga Inc. OAKlouds - Arbitrary File Upload

HGiga OAKlouds file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary command or disrupt service...

Design/Logic Flaw

A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to create arbitrary users on the platform. A successful exploit allows an attacker to achieve total cluster compromise...

CVE-2023-27855

In affected versions, a path traversal exists when processing a message in Rockwell Automation's ThinManager ThinServer. An unauthenticated remote attacker could potentially exploit this vulnerability to upload arbitrary files to any directory on the disk drive where ThinServer.exe is installed...

Siemens Buffer Over-Read in Wibu-Systems CodeMeter Runtime (CVE-2021-20094)

A denial of service vulnerability exists in Wibu-Systems CodeMeter versions 7.21a. An unauthenticated remote attacker can exploit this issue to crash the CodeMeter Runtime Server. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

K24358905: BIG-IP AFM virtual server vulnerability CVE-2022-23018

Security Advisory Description When a virtual server is configured with both HTTP protocol security and HTTP Proxy Connect profiles, undisclosed requests can cause the Traffic Management Microkernel TMM to terminate. CVE-2022-23018 Impact Traffic is disrupted while the TMM process restarts. This...

Cisco Identity Services Engine (ISE) XSS (cisco-sa-ise-xss-ubfHG75C)

According to its self-reported version, Cisco Identity Services Engine ISE is affected by a cross-site scripting vulnerability. This could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected...