CVE-2025-26411

An authenticated attacker is able to use the Plugin Manager of the web interface of the Wattsense Bridge devices to upload malicious Python files to the device. This enables an attacker to gain remote root access to the device. An attacker needs a valid user account on the Wattsense web...

CVE-2025-26411 Authenticated Arbitrary Python File Upload via Plugin Manager

An authenticated attacker is able to use the Plugin Manager of the web interface of the Wattsense Bridge devices to upload malicious Python files to the device. This enables an attacker to gain remote root access to the device. An attacker needs a valid user account on the Wattsense web...

CVE-2025-23190

Due to missing authorization check, an authenticated attacker could call a remote-enabled function module which allows them to access data that they would otherwise not have access to. The attacker cannot modify data or impact the availability of the system...

CVE-2025-23190 Missing Authorization check in SAP NetWeaver and ABAP platform (ST-PI)

Due to missing authorization check, an authenticated attacker could call a remote-enabled function module which allows them to access data that they would otherwise not have access to. The attacker cannot modify data or impact the availability of the system...

CVE-2025-23190

CVE-2025-23190 affects SAP NetWeaver/ABAP platform (ST-PI). The root cause is a missing authorization check that allows an authenticated attacker to call a remote-enabled function module and access data they normally cannot view. The attacker cannot modify data or affect system availability as de...

Siemens SIMATIC IPC DiagBase and SIMATIC IPC DiagMonitor

SUMMARY SIMATIC IPC DiagBase and SIMATIC IPC DiagMonitor contain a weak registry permission vulnerability that could allow an authenticated attacker to perform privilege escalation or bypass security measures. Siemens recommends specific countermeasures for products where fixes are not, or not...

Siemens SIMATIC IPC DiagBase 安全漏洞

Siemens SIMATIC IPC DiagBase is a diagnostic software from Siemens, Germany, used to monitor and diagnose the hardware and system status of SIMATIC IPCs industrial computers. A security vulnerability exists in Siemens SIMATIC IPC DiagBase that stems from affected devices not properly restricting...

PT-2025-6314 · Microsoft · Digest Authentication +1

Name of the Vulnerable Software and Affected Versions: Microsoft Digest Authentication affected versions not specified Description: The issue allows remote attackers to execute arbitrary code and affect the system. It is noted that any authenticated attacker could trigger this issue on domain...

OS command injection in external connector

...

PT-2025-6202 · Siemens · Simatic Ipc Diagmonitor +1

Name of the Vulnerable Software and Affected Versions: SIMATIC IPC DiagBase All versions SIMATIC IPC DiagMonitor All versions Description: A vulnerability has been identified where the affected devices do not properly restrict user permissions for the registry key. This could allow an authenticat...

CVE-2024-8684

OS Command Injection vulnerability in Revolution Pi version 2022-07-28-revpi-buster from KUNBUS GmbH. This vulnerability could allow an authenticated attacker to execute OS commands on the device via the ‘php/dal.php’ endpoint, in the ‘arrSaveConfig’ parameter...

CVE-2024-8685

CVE-2024-8685 affects Revolution Pi (KUNBUS GmbH) and is a path-traversal vulnerability exploiting the dir parameter of /pictory/php/getFileList.php. An authenticated attacker could list device directories. The CVE details present in multiple feeds consistently describe the issue but do not provi...

CVE-2024-8685 Path-Traversal vulnerability in Revolution Pi

Path-Traversal vulnerability in Revolution Pi version 2022-07-28-revpi-buster from KUNBUS GmbH. This vulnerability could allow an authenticated attacker to list device directories via the ‘/pictory/php/getFileList.php’ endpoint in the ‘dir’ parameter...

CVE-2024-8685 Path-Traversal vulnerability in Revolution Pi

Path-Traversal vulnerability in Revolution Pi version 2022-07-28-revpi-buster from KUNBUS GmbH. This vulnerability could allow an authenticated attacker to list device directories via the ‘/pictory/php/getFileList.php’ endpoint in the ‘dir’ parameter...

CVE-2024-8684

CVE-2024-8684 describes an OS command injection in Revolution Pi (KUNBUS GmbH) via the php/dal.php endpoint, in the arrSaveConfig parameter. The vulnerability affects Revolution Pi 2022-07-28-revpi-buster and can be exploited by an authenticated attacker to execute OS commands. Available connecte...

CVE-2024-8684 OS Command Injection vulnerability in Revolution Pi

OS Command Injection vulnerability in Revolution Pi version 2022-07-28-revpi-buster from KUNBUS GmbH. This vulnerability could allow an authenticated attacker to execute OS commands on the device via the ‘php/dal.php’ endpoint, in the ‘arrSaveConfig’ parameter...

CVE-2024-13841

The Builder Shortcode Extras – WordPress Shortcodes Collection to Save You Time plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.0 via the 'bse-elementor-template' shortcode due to insufficient restrictions on which posts can be included. This...

CVE-2024-54171

IBM EntireX 11.1 is vulnerable to an XML external entity injection XXE attack when processing XML data. An authenticated attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

CVE-2024-51450

IBM Security Verify Directory 10.0.0 through 10.0.3 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request...

CVE-2024-56471

IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...