Siemens RUGGEDCOM 安全漏洞

RUGGEDCOM ros-based devices, typically switches and serial-to-Ethernet devices, are used to connect equipment that operates in harsh environments, such as power substations and traffic control cabinets. A mirrored port isolation vulnerability exists in Siemens RUGGEDCOM ROS devices, which can be...

PT-2023-4659 · Unknown · Mxsecurity

Name of the Vulnerable Software and Affected Versions: MXsecurity versions prior to v1.0.1 Description: A vulnerability has been identified that allows the unauthorized disclosure of authenticated information. This issue arises when special elements are not neutralized correctly, allowing remote...

CVE-2023-3946

A reflected cross-site scripting XSS vulnerability in ePO prior to 5.10 SP1 Update 1allows a remote unauthenticated attacker to potentially obtain access to an ePO administrator's session by convincing the authenticated ePO administrator to click on a carefully crafted link. This would lead to...

The vulnerabilities of the Ethernet modules FX3U-ENET-ADP and Ethernet FX3U-ENET(-L) of the microprogrammable logic controllers MELSEC iQ-F series, such as FX3U, FX3UC, FX3G, FX3GC-32MT, FX3GE, FX3GA, FX3S, and FX3SA, allow attackers to circumvent security restrictions and reset system settings.

The vulnerability of the Ethernet modules FX3U-ENET-ADP and Ethernet FX3U-ENET-L of the microprogrammable logic controllers MELSEC iQ-F series, such as FX3U, FX3UC, FX3G, FX3GC-32MT, FX3GE, FX3GA, FX3S, and FX3SA, stems from the ability to bypass authentication by using capture-replay techniques...

PT-2023-20582 · WordPress · Kivicare

Name of the Vulnerable Software and Affected Versions: KiviCare WordPress plugin versions prior to 3.2.1 Description: The issue concerns the lack of CSRF checks in various AJAX actions, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks. This includes...

The vulnerability of TeamViewer Remote software for remote control of computers lies in its authentication procedures’ flaws, which allow attackers to alter the basic settings of the local device.

The vulnerability of the TeamViewer Remote software for remote control is related to deficiencies in the authentication process. Exploiting this vulnerability allows a hacker to alter the basic settings of the local device...

Progress OpenEdge 注入漏洞

Progress OpenEdge is an application. A security vulnerability exists in Progress OpenEdge LTS versions prior to 11.7.16, 12.x through 12.2.12, and 12.3.x through 12.6.x. The vulnerability stems from a URL injection attack that can be executed by a remote user to change identity or role membership...

CVE-2023-2533

A Cross-Site Request Forgery CSRF vulnerability has been identified in PaperCut NG/MF, which, under specific conditions, could potentially enable an attacker to alter security settings or execute arbitrary code. This could be exploited if the target is an admin with a current login session...

CVE-2023-1388

A heap-based overflow vulnerability in TA prior to version 5.7.9 allows a remote user to alter the page heap in the macmnsvc process memory block, resulting in the service becoming unavailable...

Apache Airflow 注入漏洞

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is characterized by scalability and dynamic monitoring. Apache Airflow CNCF Kubernetes version 5.0.0 suffers from an injection vulnerability that...

CVE-2023-27304

Operation restriction bypass vulnerability in Message and Bulletin of Cybozu Garoon 4.6.0 to 5.9.2 allows a remote authenticated attacker to alter the data of Message and/or Bulletin...

Authentication flaw

Missing authentication for critical function exists in T&D Corporation and ESPEC MIC CORP. data logger products, which may allow a remote unauthenticated attacker to alter the product settings without authentication. Affected products and versions are as follows: T&D Corporation data logger...

CVE-2023-1698

In multiple products of WAGO a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can result in unintended behaviour, Denial of Service and full system compromise...

Rockwell Automation ArmorStart ST 跨站脚本漏洞

Rockwell Automation ArmorStart ST is a simple and cost-effective solution for machine-side control architectures from Rockwell Automation. A cross-site scripting vulnerability exists in Rockwell Automation ArmorStart ST, which can be exploited by an attacker to view user data and modify the web...

CVE-2021-40331

An Incorrect Permission Assignment for Critical Resource vulnerability was found in the Apache Ranger Hive Plugin. Any user with SELECT privilege on a database can alter the ownership of the table in Hive when Apache Ranger Hive Plugin is enabled This issue affects Apache Ranger Hive Plugin: from...

Trellix Agent < 5.7.9 Heap-Based Overflow Vulnerability (SB10396)

The version of Trellix Agent, formerly McAfee Agent or McAfee Policy Orchestrator ePO Agent, installed on the remote host is prior to 5.7.9. It is, therefore, affected by a heap-based overflow vulnerability in TA 5.7.8 and earlier allows a remote user to alter the page heap in the macmnsvc proces...

PT-2023-3026 · Wago · Wago Cc100 +4

Name of the Vulnerable Software and Affected Versions: WAGO PFC100 versions =16 and =16 and =16 and =16 and =16 and =16 and =16 and =16 and =16 and =16 and =23, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting access to the device...

CVE-2023-31043

EnterpriseDB EDB Postgres Advanced Server EPAS before 14.6.0 logs unredacted passwords in situations where optional parameters are used with CREATE/ALTER USER/GROUP/ROLE, and redacting was configured with edbfilterlog.redactpasswordcommands. The fixed versions are 10.23.33, 11.18.29, 12.13.17,...

PT-2023-23120 · Enterprisedb · Edb Postgres Advanced Server

Name of the Vulnerable Software and Affected Versions: EnterpriseDB EDB Postgres Advanced Server EPAS versions prior to 10.23.33 EnterpriseDB EDB Postgres Advanced Server EPAS versions prior to 11.18.29 EnterpriseDB EDB Postgres Advanced Server EPAS versions prior to 12.13.17 EnterpriseDB EDB...

PT-2023-20381 · Haproxy +1 · Haproxy +1

Name of the Vulnerable Software and Affected Versions: HAProxy versions 2.6.1 through 2.6.7 HAProxy version 2.7.0 Description: The issue allows a remote attacker to alter a legitimate user's request, potentially obtaining sensitive information or causing a denial-of-service DoS condition...