CVE-2018-10612

In 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0, user access management and communication encryption is not enabled by default, which could allow an attacker access to the device and sensitive information, including user credentials...

Pointer dereference in subsystem in Intel(R) Graphics Driver allows unprivileged user to elevate privileges via local access

Summary: The Intel® Graphics Drivers for Windows Code can fail to adequately validate a pointer input. This may lead to modification of kernel memory and a potential for an escalation of privilege. Reference CVE-2017-5727. Description: The Intel® Graphics Drivers for Windows Code can fail to...

PT-2019-8756

Name of the Vulnerable Software and Affected Versions 3S-Smart Software Solutions GmbH CODESYS Control V3 versions prior to 3.5.14.0 Description The issue concerns the lack of default enablement for user access management and communication encryption. This could potentially allow an attacker to...

CVE-2018-10612: Improper Access Control

In 3S-Smart Software Solutions GmbH CODESYS Control V3 products prior to version 3.5.14.0, user access management and communication encryption is not enabled by default, which could allow an attacker access to the device and sensitive information, including user credentials...

Yokogawa License Manager Service

1. EXECUTIVE SUMMARY CVSS v8.1 ATTENTION : Exploitable remotely Vendor : Yokogawa Equipment : License Manager Service Vulnerability : Unrestricted Upload of Files with Dangerous Type 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to remotely upload files,...

BD FACSLyric (Update A)

1. EXECUTIVE SUMMARY CVSS v3 6.8 ATTENTION: Low skill level to exploit Vendor: Becton, Dickinson and Company BD Equipment: FACSLyric Vulnerability: Improper Access Control 2. UPDATE INFORMATION This updated medical device advisory is a follow-up to the original advisory titled ICSMA-19-029-02 BD...

FTW - Framework For Testing WAFs

This project was created by researchers from ModSecurity and Fastly to help provide rigorous tests for WAF rules. It uses the OWASP Core Ruleset V3 as a baseline to test rules on a WAF. Each rule from the ruleset is loaded into a YAML file that issues HTTP requests that will trigger these rules...

Advantech WebAccess/SCADA

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Advantech Equipment: WebAccess/SCADA Vulnerabilities: Improper Authentication, Authentication Bypass, SQL Injection 2. RISK EVALUATION Successful exploitation of these vulnerabilities may allow an...

CVE-2019-6487

TP-Link WDR Series devices through firmware v3 such as TL-WDR5620 V3.0 are affected by command injection after login leading to remote code execution, because shell metacharacters can be included in the weather getweatherobserve citycode field...

Command injection

TP-Link WDR Series devices through firmware v3 such as TL-WDR5620 V3.0 are affected by command injection after login leading to remote code execution, because shell metacharacters can be included in the weather getweatherobserve citycode field...

CVE-2019-6487

TP-Link WDR Series devices through firmware v3 such as TL-WDR5620 V3.0 are affected by command injection after login leading to remote code execution, because shell metacharacters can be included in the weather getweatherobserve citycode field...

CVE-2019-6487

CVE-2019-6487 affects TP-Link WDR Series devices with firmware v3 (e.g., TL-WDR5620 V3.0). The issue is a command injection vulnerability exploitable after login via the weather get_weather_observe citycode field, enabling remote code execution. Multiple sources (NVD/NVD-derived, Red Hat advisory...

CVE-2019-6487: Improper Neutralization of Special Elements used in an OS Command

TP-Link WDR Series devices through firmware v3 such as TL-WDR5620 V3.0 are affected by command injection after login leading to remote code execution, because shell metacharacters can be included in the weather getweatherobserve citycode field...

ABB CP400 Panel Builder TextEditor 2.0

1. EXECUTIVE SUMMARY CVSS v7.0 Vendor: ABB Equipment: CP400 Panel Builder TextEditor 2.0 Vulnerability: Improper Input Validation 2. RISK EVALUATION Successful exploitation of this vulnerability may allow an attacker to execute arbitrary code, and cause a denial-of-service condition within the...

Denial Of Service (DoS)

openstack-keystone is vulnerable to denial of service DoS attacks. The vulnerability exists as the V3 API in OpenStack Identity Keystone 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to cause a denial of service CPU consumption via a large number of the same...

LCDS - Leão Consultoria e Desenvolvimento de Sistemas Ltda ME LAquis SCADA

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: LCDS - Leão Consultoria e Desenvolvimento de Sistemas Ltda ME Equipment: LAquis SCADA Vulnerabilities: Improper Input Validation, Out-of-Bounds Read, Code Injection, Untrusted Pointer Dereference,...

ICSA-19-038-02 Siemens EN100 Ethernet Module

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION : Exploitable remotely/low skill level to exploit Vendor : Siemens Equipment : EN100 Ethernet module Vulnerabilities : Improper Input Validation 2. RISK EVALUATION The EN100 Ethernet module for the SWT 3000 management platform is affected by security...

Schneider Electric IIoT Monitor (Update A)

1. EXECUTIVE SUMMARY CVSS v3 9.3 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Schneider Electric Equipment: IIoT Monitor --------- Begin Update A Part 1 of 2 -------- Vulnerabilities: Path Traversal, Unrestricted Upload of File with Dangerous Type, XXE, Cryptographic Issues...

FreeBSD : shibboleth-sp -- crashes on malformed date/time content (4f8665d0-0465-11e9-b77a-6cc21735f730)

The Shibboleth Consortium reports : SAML messages, assertions, and metadata all commonly contain date/time information in a standard XML format. Invalid formatted data in such fields cause an exception of a type that was not handled properly in the V3 software and causes a crash usually to the...

Schneider Electric EcoStruxure

1. EXECUTIVE SUMMARY CVSS v3 7.4 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Schneider Electric Equipment: EcoStruxure Vulnerability: Open Redirect 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to use this device as a platform to...