Rockwell Automation products using GoAhead Web Server

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: Products using GoAhead Web Server Vulnerabilities: Infinite Loop, Use after Free 2. RISK EVALUATION Successful exploitation of these vulnerabilities could have a high...

Siemens SCALANCE X Switches (CVE-2018-13807)

A vulnerability has been identified in SCALANCE X300 All versions V4.0.0, SCALANCE X408 All versions V4.0.0, SCALANCE X414 All versions. The web interface on port 443/tcp could allow an attacker to cause a Denial-of-Service condition by sending specially crafted packets to the web server. The...

Siemens SCALANCE X Products Heap-Based Buffer Overflow (CVE-2020-25226)

A vulnerability has been identified in SCALANCE X-200 switch family incl. SIPLUS NET variants All versions V5.2.5, SCALANCE X-200IRT switch family incl. SIPLUS NET variants All versions V5.5.0. The web server of the affected devices contains a vulnerability that may lead to a buffer overflow...

Siemens SCALANCE X-200 switches Insufficient Entropy Source (CVE-2013-5709)

The authentication implementation in the web server on Siemens SCALANCE X-200 switches with firmware before 5.0.0 does not use a sufficient source of entropy for generating values of random numbers, which makes it easier for remote attackers to hijack sessions by predicting a value. This plugin...

Siemens SCALANCE X-300 Switches Cross-Site Request Forgery (CVE-2022-25754)

A vulnerability has been identified in SCALANCE X302-7 EEC 230V, SCALANCE X302-7 EEC 230V, coated, SCALANCE X302-7 EEC 24V, SCALANCE X302-7 EEC 24V, coated, SCALANCE X302-7 EEC 2x 230V, SCALANCE X302-7 EEC 2x 230V, coated, SCALANCE X302-7 EEC 2x 24V, SCALANCE X302-7 EEC 2x 24V, coated, SCALANCE...

Siemens SCALANCE X-300 Switches Improper Neutralization of Script-Related HTML Tags in a Web Page (CVE-2022-25756)

A vulnerability has been identified in SCALANCE X302-7 EEC 230V, SCALANCE X302-7 EEC 230V, coated, SCALANCE X302-7 EEC 24V, SCALANCE X302-7 EEC 24V, coated, SCALANCE X302-7 EEC 2x 230V, SCALANCE X302-7 EEC 2x 230V, coated, SCALANCE X302-7 EEC 2x 24V, SCALANCE X302-7 EEC 2x 24V, coated, SCALANCE...

Siemens Web Server of SCALANCE X200 Heap-Based Buffer Overflow (CVE-2021-25668)

A vulnerability has been identified in SCALANCE X200-4P IRT All versions 5.5.1, SCALANCE X201-3P IRT All versions 5.5.1, SCALANCE X201-3P IRT PRO All versions 5.5.1, SCALANCE X202-2 IRT All versions 5.5.1, SCALANCE X202-2P IRT incl. SIPLUS NET variant All versions 5.5.1, SCALANCE X202-2P IRT PRO...

Phoenix Contact ILC PLCs Improper Authentication (CVE-2016-8380)

The web server in Phoenix Contact ILC PLCs allows access to read and write PLC variables without authentication. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if...

Siemens Desigo PX Devices External Control of Assumed-Immutable Web Parameter (CVE-2019-13927)

A vulnerability has been identified in Desigo PX automation controllers PXC00-E.D, PXC50-E.D, PXC100-E.D, PXC200-E.D with Desigo PX Web modules PXA40-W0, PXA40-W1, PXA40-W2 All firmware versions V6.00.320, Desigo PX automation controllers PXC00-U, PXC64-U, PXC128-U with Desigo PX Web modules...

Siemens APOGEE and TALON Improper Access Control (CVE-2022-45937)

A vulnerability has been identified in APOGEE PXC Series BACnet All versions V3.5.5, APOGEE PXC Series P2 Ethernet All versions V2.8.20, TALON TC Series BACnet All versions V3.5.5. A low privilege authenticated attacker with network access to the integrated web server could download sensitive...

Siemens Web Server of SCALANCE X200 Stack-Based Buffer Overflow (CVE-2021-25669)

A vulnerability has been identified in SCALANCE X200-4P IRT All versions 5.5.1, SCALANCE X201-3P IRT All versions 5.5.1, SCALANCE X201-3P IRT PRO All versions 5.5.1, SCALANCE X202-2 IRT All versions 5.5.1, SCALANCE X202-2P IRT incl. SIPLUS NET variant All versions 5.5.1, SCALANCE X202-2P IRT PRO...

Exploit for Improper Access Control in Lexmark B2236_Firmware

PoC for CVE-2023-22960 !Pythonhttps://img.shields.io/badg...

Apache HTTP Server: mod_proxy_ajp Possible request smuggling

...

FreeBSD : net/krill -- DoS vulnerability (7844789a-9b1f-11ed-9a3f-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 7844789a-9b1f-11ed-9a3f-b42e991fc52e advisory. - NLnet Labs Krill supports direct access to the RRDP repository content through its built-in web serve...

CVE-2022-40267

Predictable Seed in Pseudo-Random Number Generator PRNG vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-xMy/z x=32,64,80, y=T,R, z=ES,DS,ESS,DSS with serial number 17X or later, and versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-xMy/z...

CVE-2022-40267

Predictable Seed in Pseudo-Random Number Generator PRNG vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-xMy/z x=32,64,80, y=T,R, z=ES,DS,ESS,DSS with serial number 17X or later, and versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-xMy/z...

CVE-2022-40267

The CVE-2022-40267 issue is an authentication bypass in Mitsubishi Electric MELSEC iQ-F/iQ-R Series web servers caused by a Predictable Seed in the PRNG used for session identifiers. TALOS details show an LCG-based generator that seeds future values with previously produced random numbers, enabli...

CVE-2022-40267 Authentication Bypass Vulnerability in Web Server Function on MELSEC Series

Predictable Seed in Pseudo-Random Number Generator PRNG vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-xMy/z x=32,64,80, y=T,R, z=ES,DS,ESS,DSS with serial number 17X or later, and versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-xMy/z...

CVE-2022-40267 Authentication Bypass Vulnerability in Web Server Function on MELSEC Series

Predictable Seed in Pseudo-Random Number Generator PRNG vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-xMy/z x=32,64,80, y=T,R, z=ES,DS,ESS,DSS with serial number 17X or later, and versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-xMy/z...

Security Bulletin: IBM Spectrum Symphony is vulnerable to Host header injection

Summary IBM Spectrum Symphony 7.3.0 can encounter an unauthenticated Host header injection vulnerability. Vulnerability Details Web servers dispatch requests to the target virtual host based on the value supplied in the Host header. Without proper validation of the header value, the attacker can...