PT-2023-30810

Name of the Vulnerable Software and Affected Versions ArmorX Spam affected versions not specified Description The issue is related to insufficient validation for user input within a special function, allowing an unauthenticated remote attacker to inject arbitrary SQL commands and access, modify, ...

CVE-2023-48384: Improper Neutralization of Special Elements used in an SQL Command

ArmorX Global Technology Corporation ArmorX Spam has insufficient validation for user input within a special function. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands to access, modify and delete database...

CVE-2023-46143 Phoenix Contact: Classic line industrial controllers prone to inadequate integrity check of PLC

Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT classic line PLCs allows an unauthenticated remote attacker to modify some or all applications on a PLC...

PHOENIX CONTACT Automation Worx Software Suite Security Vulnerability

PHOENIX CONTACT Automation Worx Software Suite is an automation Worx software suite from PHOENIX CONTACT, Germany. A security vulnerability exists in PHOENIX CONTACT Automation Worx Software Suite, which originated from a vulnerability in the incorrect assignment of critical resource privileges,...

CVE-2023-46143: Download of Code Without Integrity Check

Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT classic line PLCs allows an unauthenticated remote attacker to modify some or all applications on a PLC...

CVE-2023-5592: Download of Code Without Integrity Check

Download of Code Without Integrity Check vulnerability in PHOENIX CONTACT MULTIPROG, PHOENIX CONTACT ProConOS eCLR SDK allows an unauthenticated remote attacker to download and execute applications without integrity checks on the device which may result in a complete loss of integrity...

CVE-2023-6193: Uncontrolled Resource Consumption

quiche v. 0.15.0 through 0.19.0 was discovered to be vulnerable to unbounded queuing of path validation messages, which could lead to excessive resource consumption. QUIC path validation RFC 9000 Section 8.2 requires that the recipient of a PATHCHALLENGE frame responds by sending a PATHRESPONSE. ...

CVE-2023-49143: Uncontrolled Resource Consumption

Denial-of-service DoS vulnerability exists in rfe service of HMI GC-A2 series. If a remote unauthenticated attacker sends a specially crafted packets to specific ports, a denial-of-service DoS condition may occur...

Exploit for Missing Authorization in Zoneminder

CVE-2023-26035 Unauthenticated RCE in ZoneMinder Snapshots - P...

Atlassian Jira Service Management Assets Discovery < 6.2.0 (JSDSERVER-14925)

The version of the Atlassian Jira Service Management Assets Discovery formerly Insight Discovery app running on the remote host is prior to 6.2.0. It is, therefore, affected by a remote code execution vulnerability as referenced in the JSDSERVER-14925 advisory. The vulnerability exists between th...

CVE-2023-39167 SENEC: Storage Box V1,V2 and V3 affected by improper access control vulnerability

In SENEC Storage Box V1,V2 and V3 an unauthenticated remote attacker can obtain the devices' logfiles that contain sensitive data...

Wago RTU Input Validation Error Vulnerability

The WAGO RTU is a remote terminal unit from WAGO Germany for remotely monitored and controlled devices. An input validation error vulnerability exists in Wago RTU versions prior to 1.4.6.0. The vulnerability stems from the susceptibility of the WagoAppRTU MMS interpreter to incorrectly formatted...

CVE-2023-49693: Missing Authentication for Critical Function

NETGEAR ProSAFE Network Management System has Java Debug Wire Protocol JDWP listening on port 11611 and it is remotely accessible by unauthenticated users, allowing attackers to execute arbitrary code...

Control iD iDSecure Authentication Bypass (CVE-2023-6329)

This module exploits an improper access control vulnerability CVE-2023-6329 in Control iD iDSecure use auxiliary/admin/http/idsecure/authbypass msf undefinedauthbypass show actions ...actions... msf undefinedauthbypass set ACTION msf undefinedauthbypass show options ...show and set options... msf...

CVE-2023-42000: Improper Limitation of a Pathname to a Restricted Directory

Arcserve UDP prior to 9.2 contains a path traversal vulnerability in com.ca.arcflash.ui.server.servlet.FileHandlingServlet.doUpload. An unauthenticated remote attacker can exploit it to upload arbitrary files to any location on the file system where the UDP agent is installed...

Digital Communications Technologies Syrus 4G IoT Security Breach

Digital Communications Technologies Syrus 4G IoT is a device for vehicle remote monitoring and Internet of Things IoT applications from Digital Communications Technologies. Digital Communications Technologies Syrus 4G IoT suffers from a security vulnerability that originates from the ability to...

CVE-2023-38884

An Insecure Direct Object Reference IDOR vulnerability in the Community Edition version 9.0 of openSIS Classic allows an unauthenticated remote attacker to access any student's files by visiting '/assets/studentfiles/-'...

H2O local file inclusion vulnerability

A Local File Inclusion LFI vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default installation and does not require user interaction. Th...

CVE-2023-6038

A Local File Inclusion LFI vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default installation and does not require user interaction. Th...

CVE-2023-6038 Local File Inclusion in h2oai/h2o-3

A Local File Inclusion LFI vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default installation and does not require user interaction. Th...