CVE-2025-27394

Siemens SCALANCE LPE9403 (6GK5998-3GS00-2AC2), affected in all versions before V4.0, exposes an OS command injection due to improper sanitization of input when creating new SNMP users. The vulnerability allows an authenticated, highly-privileged remote attacker to execute arbitrary code on the de...

CVE-2024-56182

A vulnerability has been identified in SIMATIC Field PG M5 All versions, SIMATIC Field PG M6 All versions V26.01.12, SIMATIC IPC BX-21A All versions V31.01.07, SIMATIC IPC BX-32A All versions V29.01.07, SIMATIC IPC BX-39A All versions V29.01.07, SIMATIC IPC BX-59A All versions V32.01.04, SIMATIC...

CVE-2024-56182

A vulnerability has been identified in SIMATIC Field PG M5 All versions, SIMATIC Field PG M6 All versions V26.01.12, SIMATIC IPC BX-21A All versions V31.01.07, SIMATIC IPC BX-32A All versions V29.01.07, SIMATIC IPC BX-39A All versions V29.01.07, SIMATIC IPC BX-59A All versions V32.01.04, SIMATIC...

CVE-2024-56181

A vulnerability has been identified in SIMATIC Field PG M5 All versions, SIMATIC IPC BX-21A All versions V31.01.07, SIMATIC IPC BX-32A All versions V29.01.07, SIMATIC IPC BX-39A All versions V29.01.07, SIMATIC IPC BX-59A All versions V32.01.04, SIMATIC IPC PX-32A All versions V29.01.07, SIMATIC I...

CVE-2024-56181

CVE-2024-56181 affects Siemens SIMATIC devices (e.g., Field PG M5, IPC BX-21A/BX-32A/BX-39A/BX-59A, PX-32A/PX-39A, RC/RW families, IPC127E/227E/277E/3000/327G/347G/377G/427E/477E/527G/627E/647E/677E/847E, ITP1000, etc.). The vulnerability stems from insufficient protection of EFI variables stored...

CVE-2024-56181

A vulnerability has been identified in SIMATIC Field PG M5 All versions, SIMATIC IPC BX-21A All versions V31.01.07, SIMATIC IPC BX-32A All versions V29.01.07, SIMATIC IPC BX-39A All versions V29.01.07, SIMATIC IPC BX-59A All versions V32.01.04, SIMATIC IPC PX-32A All versions V29.01.07, SIMATIC I...

CVE-2024-11253

A post-authentication command injection vulnerability in the "DNSServer” parameter of the diagnostic function in the Zyxel VMG8825-T50K firmware version V5.50ABOM.8.5C0 and earlier could allow an authenticated attacker with administrator privileges to execute operating system OS commands on a...

CVE-2024-12009

A post-authentication command injection vulnerability in the "ZyEE" function of the Zyxel EX5601-T1 firmware version V5.70ACDZ.3.6C0 and earlier could allow an authenticated attacker with administrator privileges to execute operating system OS commands on a vulnerable device...

CVE-2024-12010

A post-authentication command injection vulnerability in the ”zyUtilMailSend” function of the Zyxel AX7501-B1 firmware version V5.17ABPC.5.3C0 and earlier could allow an authenticated attacker with administrator privileges to execute operating system OS commands on a vulnerable device...

CVE-2024-12010

CVE-2024-12010 is a post‑authentication command injection affecting Zyxel AX7501‑B1 firmware up to version V5.17(ABPC.5.3)C0. The vulnerability resides in the zyUtilMailSend function and allows an authenticated administrator to execute OS commands on the device. The CVE entry notes a network‑base...

CVE-2024-12010

A post-authentication command injection vulnerability in the ”zyUtilMailSend” function of the Zyxel AX7501-B1 firmware version V5.17ABPC.5.3C0 and earlier could allow an authenticated attacker with administrator privileges to execute operating system OS commands on a vulnerable device...

CVE-2024-12009

A post-authentication command injection vulnerability in the "ZyEE" function of the Zyxel EX5601-T1 firmware version V5.70ACDZ.3.6C0 and earlier could allow an authenticated attacker with administrator privileges to execute operating system OS commands on a vulnerable device...

CVE-2024-12009

CVE-2024-12009 : A post-authentication command injection in the ZyEE function affects Zyxel EX5601-T1 firmware up to V5.70(ACDZ.3.6)C0 and earlier, allowing an authenticated administrator to execute OS commands on the device. Documented impact is high (C/H/I/A) with network access and no user int...

CVE-2024-11253

CVE-2024-11253 concerns Zyxel VMG8825-T50K devices with firmware versions up to V5.50(ABOM.8.5)C0 and earlier. The vulnerability is a post-authentication command injection in the diagnostic function’s DNSServer parameter, enabling an authenticated administrator to run OS commands on the device. T...

CVE-2024-11253

A post-authentication command injection vulnerability in the "DNSServer” parameter of the diagnostic function in the Zyxel VMG8825-T50K firmware version V5.50ABOM.8.5C0 and earlier could allow an authenticated attacker with administrator privileges to execute operating system OS commands on a...

CVE-2025-27433 Broken Access Control vulnerabilities in SAP S/4HANA (Manage Bank Statements)

The Manage Bank Statements in SAP S/4HANA allows authenticated attacker to bypass certain functionality restrictions of the application and upload files to a reversed bank statement. This vulnerability has a low impact on the application's integrity, with no effect on confidentiality and...

CVE-2025-27433 Broken Access Control vulnerabilities in SAP S/4HANA (Manage Bank Statements)

The Manage Bank Statements in SAP S/4HANA allows authenticated attacker to bypass certain functionality restrictions of the application and upload files to a reversed bank statement. This vulnerability has a low impact on the application's integrity, with no effect on confidentiality and...

CVE-2024-51320

CVE-2024-51320 affects Zucchetti Ad Hoc Infinity 2.4. It is a cross-site scripting vulnerability that, when exploited by an authenticated attacker, can lead to Remote Code Execution via the endpoints /servlet/gsdm_fsave_htmltmp and /servlet/gsdm_btlk_openfile . The provided connected documents co...

Siemens SIMATIC 缓冲区错误漏洞

Siemens SIMATIC is a configuration software from Siemens, Germany. A buffer error vulnerability exists in Siemens SIMATIC that stems from an inadequate protection mechanism for EFI variables, which could allow an authenticated attacker to disable the BIOS password...

CVE-2024-51319

A local file include vulnerability in the /servlet/Report of Zucchetti Ad Hoc Infinity 2.4 allows an authenticated attacker to achieve Remote Code Execution by uploading a jsp web/reverse shell through /jsp/zimgupload.jsp...