3148 matches found
CVE-2023-1109 PHOENIX CONTACT: Directory Traversal Vulnerability in ENERGY AXC PU Web service
In Phoenix Contacts ENERGY AXC PU Web service an authenticated restricted user of the web frontend can access, read, write and create files throughout the file system using specially crafted URLs via the upload and download functionality of the web service. This may lead to full control of the...
PHOENIX CONTACT ENERGY AXC PU 路径遍历漏洞
The PHOENIX CONTACT ENERGY AXC PU is an energy management device from PHOENIX CONTACT, Germany, typically used to monitor and control energy flow in solar and wind energy systems. A path traversal vulnerability exists in versions prior to PHOENIX CONTACT ENERGY AXC PU V04.15.00.00, which originat...
PT-2023-7105 · Phoenix Contact · Phoenix Contacts Energy Axc Pu
Name of the Vulnerable Software and Affected Versions: Phoenix Contacts ENERGY AXC PU versions affected versions not specified Description: The issue is related to a web service vulnerability that allows an authenticated restricted user of the web frontend to access, read, write, and create files...
Microsoft Visual Studio Spoofing Vulnerability (CNVD-2023-29698)
Microsoft Visual Studio is a family of development tools from Microsoft Corporation USA, and a largely complete development toolset that includes most of the tools needed throughout the software lifecycle. Microsoft Visual Studio is vulnerable to a spoofing vulnerability that can be exploited by...
Design/Logic Flaw
A vulnerability has been identified in SIPROTEC 5 6MD85 CP300 All versions = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 V...
CVE-2023-28766
A vulnerability has been identified in SIPROTEC 5 6MD85 CP300 All versions = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 = V7.80 V9.40, SIP...
Microsoft Visual Studio 安全漏洞
Microsoft Visual Studio is a family of development tools from Microsoft Corporation USA, and a largely complete development toolset that includes most of the tools needed throughout the software lifecycle. Microsoft Visual Studio is vulnerable to a spoofing vulnerability that can be exploited by...
Zoho ManageEngine Applications Manager 代码问题漏洞
ZOHO ManageEngine Applications Manager is a set of IT operation and maintenance management solutions of the United States ZhuoHao ZOHO company. The product features application performance management, fault management, report generation, and SLA management. A security vulnerability exists in Zoho...
CVE-2023-29473
webservice in Atos Unify OpenScape 4000 Platform and OpenScape 4000 Manager Platform 10 R1 before 10 R1.34.4 allows an unauthenticated attacker to run arbitrary commands on the platform operating system and achieve administrative access, aka OSFOURK-23710...
CVE-2022-43769
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream. Recent assessments: gwillcox-r7 at May 10, 2023 5:31pm UTC reported: This is a...
CVE-2023-0432
The web configuration service of the affected device contains an authenticated command injection vulnerability. It can be used to execute system commands on the operating system OS from the device in the context of the user "root." If the attacker has credentials for the web service, then the...
Code injection
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ABB Flow-X firmware on Flow-X embedded hardware web service modules allows Footprinting.This issue affects Flow-X: before 4.0...
ABB Central Licensing System Permissions, Privileges, and Access Controls (CVE-2020-8476)
For the Central Licensing Server component used in ABB products ABB Ability System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0, 1.1 and 2.0, Symphony Plus -S+ Operations 3.0 to 3.2 Symphony Plus -S+ Engineering 1.1 to...
CVE-2022-0650
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-WR940N 3.20.1 Build 200316 Rel.34392n 5553 routers. Authentication is required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on...
OpenNMS Horizon 安全漏洞
OpenNMS Horizon is an open source solution from OpenNMS, Inc. that helps you visualize and monitor everything on your local and remote networks. A security vulnerability exists in OpenNMS Horizon that stems from the fact that the Horizon REST API includes an endpoint named users that is vulnerabl...
CVE-2022-40208
In Moodle, insufficient limitations in some quiz web services made it possible for students to bypass sequential navigation during a quiz attempt...
PT-2023-9783 · Abb · Flow-X
Name of the Vulnerable Software and Affected Versions: ABB Flow-X versions prior to 4.0 Description: The issue is related to exposure of sensitive information to an unauthorized actor, allowing footprinting. This is due to insufficient protection of service data in the web service modules of the...
Important: python-lxml
Issue Overview: A Cross-site Scripting XSS vulnerability was found in the python-lxml's clean module. The module's parser did not properly imitate browsers, causing different behaviors between the sanitizer and the user's page. This flaw allows a remote attacker to run arbitrary HTML/JS code. The...
CVE-2023-28338
Any request send to a Netgear Nighthawk Wifi6 Router RAX30's web service containing a “Content-Type” of “multipartboundary=” will result in the request body being written to “/tmp/mulipartFile” on the device itself. A sufficiently large file will cause device resources to be exhausted, resulting ...
