PT-2023-5636 · Withsecure · Withsecure Policy Manager

Name of the Vulnerable Software and Affected Versions: WithSecure Policy Manager version 15 Description: The issue exists due to insufficient input validation in the WithSecure Policy Manager, allowing an attacker to execute arbitrary code. This can be exploited for unauthenticated remote code...

PT-2023-28971 · Withsecure · Withsecure Policy Manager Proxy +1

Name of the Vulnerable Software and Affected Versions: WithSecure Policy Manager version 15 WithSecure Policy Manager Proxy version 15 Description: The issue allows Unauthenticated Remote Code Execution via the web server backend. This is a significant problem as it can be exploited without the...

Siemens LOGO! Web Server Buffer Copy Without Checking Size of Input (CVE-2020-7593)

A vulnerability has been identified in LOGO! 8 BM incl. SIPLUS variants V1.81.01 - V1.81.03, LOGO! 8 BM incl. SIPLUS variants V1.82.01, LOGO! 8 BM incl. SIPLUS variants V1.82.02. A buffer overflow vulnerability exists in the Web Server functionality of the device. A remote unauthenticated attacke...

CVE-2023-25528

NVIDIA DGX H100 baseboard management controller BMC contains a vulnerability in a web server plugin, where an unauthenticated attacker may cause a stack overflow by sending a specially crafted network packet. A successful exploit of this vulnerability may lead to arbitrary code execution, denial ...

CVE-2023-25528

NVIDIA DGX H100 baseboard management controller BMC contains a vulnerability in a web server plugin, where an unauthenticated attacker may cause a stack overflow by sending a specially crafted network packet. A successful exploit of this vulnerability may lead to arbitrary code execution, denial ...

Design/Logic Flaw

NVIDIA DGX H100 baseboard management controller BMC contains a vulnerability in a web server plugin, where an unauthenticated attacker may cause a stack overflow by sending a specially crafted network packet. A successful exploit of this vulnerability may lead to arbitrary code execution, denial ...

CVE-2023-25528

NVIDIA DGX H100 baseboard management controller BMC contains a vulnerability in a web server plugin, where an unauthenticated attacker may cause a stack overflow by sending a specially crafted network packet. A successful exploit of this vulnerability may lead to arbitrary code execution, denial ...

CVE-2023-25528

NVIDIA DGX H100 baseboard management controller BMC contains a vulnerability in a web server plugin, where an unauthenticated attacker may cause a stack overflow by sending a specially crafted network packet. A successful exploit of this vulnerability may lead to arbitrary code execution, denial ...

CVE-2023-25528

CVE-2023-25528 affects the NVIDIA DGX H100 baseboard management controller (BMC) web server plugin. An unauthenticated attacker can trigger a stack overflow by sending a specially crafted network packet, potentially leading to arbitrary code execution, denial of service, information disclosure, a...

CVE-2023-25528: Stack-based Buffer Overflow

NVIDIA DGX H100 baseboard management controller BMC contains a vulnerability in a web server plugin, where an unauthenticated attacker may cause a stack overflow by sending a specially crafted network packet. A successful exploit of this vulnerability may lead to arbitrary code execution, denial ...

Jenkins LTS < 2.414.2 / Jenkins weekly < 2.424 Multiple Vulnerabilities

According to its its self-reported version number, the version of Jenkins running on the remote web server is Jenkins LTS prior to 2.414.2 or Jenkins weekly prior to 2.424. It is, therefore, affected by multiple vulnerabilities: - Jenkins 2.50 through 2.423 both inclusive, LTS 2.60.1 through...

CVE-2022-47556

Uncontrolled resource consumption in ekorRCI, allowing an attacker with low-privileged access to the web server to send continuous legitimate web requests to a functionality that is not properly validated, in order to cause a denial of service DoS on the device...

CVE-2022-47553

Incorrect authorisation in ekorCCP and ekorRCI, which could allow a remote attacker to obtain resources with sensitive information for the organisation, without being authenticated within the web server...

CVE-2022-47553

Incorrect authorisation in ekorCCP and ekorRCI, which could allow a remote attacker to obtain resources with sensitive information for the organisation, without being authenticated within the web server...

Code injection

UNSUPPPORTED WHEN ASSIGNED Exposure of sensitive information in ekorCCP and ekorRCI, potentially allowing a remote attacker to obtain critical information from various .xml files, including .xml files containing credentials, without being authenticated within the web server...

Information disclosure

UNSUPPPORTED WHEN ASSIGNED Incorrect authorisation in ekorCCP and ekorRCI, which could allow a remote attacker to obtain resources with sensitive information for the organisation, without being authenticated within the web server...

CVE-2022-47556

CVE-2022-47556 describes uncontrolled resource consumption in Ormazabal ekorRCI . A low-privileged attacker with network access can send continuous, legitimate web requests to a function that is not properly validated, causing a Denial of Service (DoS) on the device. The vulnerability affects eko...

CVE-2022-47556 Uncontrolled Resource Consumption in Ormazabal products

Uncontrolled resource consumption in ekorRCI, allowing an attacker with low-privileged access to the web server to send continuous legitimate web requests to a functionality that is not properly validated, in order to cause a denial of service DoS on the device...

CVE-2022-47556 Uncontrolled Resource Consumption in Ormazabal products

Uncontrolled resource consumption in ekorRCI, allowing an attacker with low-privileged access to the web server to send continuous legitimate web requests to a functionality that is not properly validated, in order to cause a denial of service DoS on the device...

CVE-2022-47554

CVE-2022-47554 targets Ormazabal ekorCCP and ekorRCI, exposing sensitive information from various .xml files (including credentials) without authentication. Affected software: ekorCCP/ekorRCI (Ormazabal product family). Root cause: exposure of protected data via unsecured access to XML files on t...