CVE-2024-46887

The web server of affected devices do not properly authenticate user request to the '/ClientArea/RuntimeInfoData.mwsl' endpoint. This could allow an unauthenticated remote attacker to gain knowledge about current actual and configured maximum cycle times as well as about configured maximum...

CVE-2024-46887

CVE-2024-46887 affects Siemens SIMATIC S7-1500 CPU family and related controllers (e.g., ET 200SP Open Controller). The vulnerability is an authentication bypass in the web server that handles /ClientArea/RuntimeInfoData.mwsl, allowing an unauthenticated remote attacker to obtain current and conf...

CVE-2024-46887

The web server of affected devices do not properly authenticate user request to the '/ClientArea/RuntimeInfoData.mwsl' endpoint. This could allow an unauthenticated remote attacker to gain knowledge about current actual and configured maximum cycle times as well as about configured maximum...

CVE-2024-46886

The web server of affected devices does not properly validate input that is used for a user redirection. This could allow an attacker to make the server redirect the legitimate user to an attacker-chosen URL. For a successful exploit, the legitimate user must actively click on an attacker-crafted...

CVE-2024-46886

CVE-2024-46886 affects Siemens SIMATIC S7-1500/S7-1200 CPUs; the vulnerability lies in the web server’s handling of input used for user redirection. This improper validation can let an attacker cause a user to be redirected to an attacker‑controlled URL, requiring the user to click an attacker‑cr...

CVE-2024-46886

The web server of affected devices does not properly validate input that is used for a user redirection. This could allow an attacker to make the server redirect the legitimate user to an attacker-chosen URL. For a successful exploit, the legitimate user must actively click on an attacker-crafted...

Schneider Electric EcoStruxure Power Monitoring Expert 代码问题漏洞

Schneider Electric EcoStruxure Power Monitoring Expert is a device from Schneider Electric France used for power distribution monitoring in IoT environments. A code issue vulnerability exists in the Schneider Electric EcoStruxure Power Monitoring Expert that stems from the presence of a...

The vulnerability of the parseProxyProtocolV1() function in the ProxyProtocolReadListener class of the Undertow web server allows a hacker to gain unauthorized access to protected information.

The vulnerability of the parseProxyProtocolV1 function in the ProxyProtocolReadListener class of the Undertow web server is related to the synchronization of requests and responses when processing the StringBuilder parameter. Exploiting this vulnerability can allow a remote attacker to gain...

[SECURITY] Fedora 40 Update: aws-2020-16.1.fc40

AWS is a complete framework to develop Web based applications. The main part of the framework is the embedded Web server. This small yet powerful Web server can be embedded into your application so your application will be able to talk with a standard Web browser Around this Web server a lot of...

[SECURITY] Fedora 39 Update: aws-2020-12.1.fc39

AWS is a complete framework to develop Web based applications. The main part of the framework is the embedded Web server. This small yet powerful Web server can be embedded into your application so your application will be able to talk with a standard Web browser Around this Web server a lot of...

[SECURITY] Fedora 41 Update: aws-24.0.0-3.fc41

AWS is a complete framework to develop Web based applications. The main part of the framework is the embedded Web server. This small yet powerful Web server can be embedded into your application so your application will be able to talk with a standard Web browser...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the LocalMode's openlocalfile method, which allows an authenticated user with adequate permissions to download any .txt via the ScreensControllershow on the web server. Details A Directory Traversal attack also...

CVE-2024-45367

The web server for ONS-S8 - Spectra Aggregation Switch includes an incomplete authentication process, which can lead to an attacker authenticating without a password...

CVE-2024-45367

CVE-2024-45367 affects Optigo Networks’ ONS-S8 – Spectra Aggregation Switch. The web server contains an incomplete authentication process that can allow an attacker to authenticate without a password. Affected firmware: 1.3.7 and earlier. The issue is categorized as weak authentication (CWE-1390)...

CVE-2024-41988

CVE-2024-41988 affects TEM Opera Plus FM Family Transmitter (affected version: 35.45). An unprotected endpoint allows MPFS File System binary image upload without authentication, affecting the HTTP2 web server module and SNMP module (and shared storage access). This can be exploited to overwrite ...

CVE-2024-41988 Missing Authentication for Critical Function vulnerability in TEM Opera Plus FM Family Transmitter

TEM Opera Plus FM Family Transmitter allows access to an unprotected endpoint that allows MPFS File System binary image upload without authentication. This file system serves as the basis for the HTTP2 web server module but is also used by the SNMP module and is available to other applications th...

PT-2024-29677 · Unknown · Tem Opera Plus Fm Family Transmitter

Name of the Vulnerable Software and Affected Versions: TEM Opera Plus FM Family Transmitter affected versions not specified Description: The TEM Opera Plus FM Family Transmitter has an unprotected endpoint that allows MPFS File System binary image upload without authentication. This file system i...

Jenkins LTS < 2.462.3 / Jenkins weekly < 2.479 Multiple Vulnerabilities

According to its its self-reported version number, the version of Jenkins running on the remote web server is Jenkins LTS prior to 2.462.3 or Jenkins weekly prior to 2.479. It is, therefore, affected by multiple vulnerabilities: - Jenkins 2.478 and earlier, LTS 2.462.2 and earlier does not redact...

CVE-2024-46977

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. A path traversal vulnerability inside of LocalMode's openlocalfile method allows an authenticated user with adequate permissions to download any .txt via the ScreensControllersh...

PYSEC-2024-101

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. A path traversal vulnerability inside of LocalMode's openlocalfile method allows an authenticated user with adequate permissions to download any .txt via the ScreensControllersh...