CVE-2022-25215

CVE-2022-25215 is an improper access-control vulnerability on the LocalMACConfig.asp interface that allows an unauthenticated remote attacker to add or remove client MAC addresses from a banned list, blocking those clients from WAN or router access. Connected sources indicate affected PHICOMM dev...

VulnCheck KEV: CVE-2017-12319

A vulnerability in the Border Gateway Protocol BGP over an Ethernet Virtual Private Network EVPN for Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload, resulting in a denial of service DoS condition, or potentially corrupt the BGP routing...

VulnCheck KEV: CVE-2017-12237

A vulnerability in the Internet Key Exchange Version 2 IKEv2 module of Cisco IOS and Cisco IOS XE could allow an unauthenticated, remote attacker to cause high CPU utilization, traceback messages, or a reload of an affected device that leads to a denial of service...

VulnCheck KEV: CVE-2017-12233

There is a vulnerability in the implementation of the Common Industrial Protocol CIP feature in Cisco IOS could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service...

VulnCheck KEV: CVE-2018-0156

A vulnerability in the Smart Install feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial-of-service DoS condition...

CVE-2022-25359

On ICL ScadaFlex II SCADA Controller SC-1 and SC-2 1.03.07 devices, unauthenticated remote attackers can overwrite, delete, or create files...

CVE-2022-24435

Cross-site scripting vulnerability in phpUploader v1.2 and earlier allows a remote unauthenticated attacker to inject an arbitrary script via unspecified vectors...

CVE-2022-25329

Trend Micro ServerProtect 6.0/5.8 Information Server uses a static credential to perform authentication when a specific command is typed in the console. An unauthenticated remote attacker with access to the Information Server could exploit this to register to the server and perform authenticated...

CVE-2022-20623

A vulnerability in the rate limiter for Bidirectional Forwarding Detection BFD traffic of Cisco NX-OS Software for Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to cause BFD traffic to be dropped on an affected device. This vulnerability is due to a logic error ...

CVE-2022-20750

A vulnerability in the checkpoint manager implementation of Cisco Redundancy Configuration Manager RCM for Cisco StarOS Software could allow an unauthenticated, remote attacker to cause the checkpoint manager process to restart upon receipt of malformed TCP data. This vulnerability is due to...

CVE-2022-20659

A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network EPN Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface of an affected device. This...

CVE-2022-24983

CVE-2022-24983 concerns forms generated by JQueryForm.com before 2022-02-05. The vulnerability allows remote attackers to obtain the URI of uploaded files by capturing the POST response (the Unique ID is included in the response). This is stated to enable unauthenticated remote code execution whe...

Unspecified vulnerability in ImpressCMS

ImpressCMS is a MySQL-based, modular content management system CMS. The system includes modules for press releases, forums, and photo albums. ImpressCMS has a security vulnerability that stems from the fact that impress scms prior to 1.4.2 allows traversal of the origName or imageName directory b...

Backdoor.Win32.XRat.k Remote Command Execution

Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/3d4350282ae043177063de2ad4827b97.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.XRat.k Vulnerability: Unauthenticated Remote Command Execution Description: XRat...

Backdoor.Win32.Wdoor.11 Remote Command Execution

Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/55822613e0d0f437f3ebe5c7f4155452.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Wdoor.11 Vulnerability: Unauthenticated Remote Command Execution Description: Wdoor b...

Siemens OpenSSL Vulnerability in Industrial Products

RISK EVALUATION Successful exploitation of these vulnerabilities could allow an unauthenticated remote attacker to execute arbitrary code or to cause a denial-of-service condition. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this...

Backdoor.Win32.Small.er Code Execution

Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/9f11868c3beaa8e2c1f5c193f5888b85.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Small.er Vulnerability: Unauthenticated Remote Command Execution Description: The...

Siemens Industrial Products with OPC UA Uncaught Exception (CVE-2019-6575)

A vulnerability has been identified in SIMATIC CP 443-1 OPC UA All versions, SIMATIC ET 200SP Open Controller CPU 1515SP PC2 incl. SIPLUS variants All versions = V2.5 V2.6.1, SIMATIC S7-1500 Software Controller All versions between V2.5 including and V2.7 excluding, SIMATIC WinCC OA All versions...

Siemens SICAM A8000 RTU Series Uncaught Exception (CVE-2018-13798)

A vulnerability has been identified in SICAM A8000 CP-8000 All versions V14, SICAM A8000 CP-802X All versions V14, SICAM A8000 CP-8050 All versions V2.00. Specially crafted network packets sent to port 80/TCP or 443/TCP could allow an unauthenticated remote attacker to cause a Denial-of-Service...

Northstar Club Management 路径遍历漏洞

Northstar Club Management is a web-based solution from Northstar, Inc. that allows organizations to manage all elements of a club, such as memberships, guests, events, and more. A path traversal vulnerability exists in Northstar Club Management version 6.3, which stems from the software's lack of...