B&R Automation Runtime Use of a Cryptographic Primitive with a Risky Implementation (CVE-2024-0323)

The FTP server used on the B&R Automation Runtime supports unsecure encryption mechanisms, such as SSLv3, TLSv1.0 and TLS1.1. An network- based attacker can exploit the flaws to conduct man-in-the-middle attacks or to decrypt communications between the affected product clients. This plugin only...

B&R Automation Runtime Improper Neutralization of Input During Web Page Generation (CVE-2023-6028)

A reflected cross-site scripting XSS vulnerability exists in the SVG version of System Diagnostics Manager of B&R Automation Runtime versions = G4.93 that enables a remote attacker to execute arbitrary JavaScript code in the context of the attacked user's browser session. This plugin only works...

B&R Automation Runtime Use of a Broken or Risky Cryptographic Algorithm (CVE-2024-8603)

B&R Automation Runtime and B&R mapp View generates self-signed certificates during the boot-up process if no certificates have been configured in the B&R Automation Studio project. These certificates are signed using an algorithm, which is no longer considered to be secure. This plugin only works...

B&R Systems Diagnostics Manager Improper Neutralization of Input During Web Page Generation (CVE-2022-4286)

A reflected cross-site scripting XSS vulnerability exists in System Diagnostics Manager of B&R Automation Runtime versions =3.00 and =3.00 and =C4.93 that enables a remote attacker to execute arbitrary JavaScript in the context of the users browser session. This plugin only works with Tenable.ot...

BRAutomation Runtime Buffer Copy without Checking Size of Input (CVE-2021-22275)

Buffer Overflow vulnerability in B&R Automation Runtime webserver allows an unauthenticated network-based attacker to stop the cyclic program on the device and cause a denial of service. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...

PT-2025-24052 · B. Braun · B. Braun Onlinesuite

Name of the Vulnerable Software and Affected Versions: B.Braun OnlineSuite versions prior to AP 3.0 Description: A predefined administrative account is not documented and cannot be deactivated. This account cannot be misused from the network, only by local users on the server. The issue affects t...

CVE-2025-23100

creationtimestamp| type| source ---|---|--- 2025-06-03 21:36:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lqqaqaxmy32a...

CVE-2024-30432

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bPlugins B Slider - Slider for your block editor allows Stored XSS.This issue affects B Slider - Slider for your block editor: from n/a through 1.1.12...

CVE-2024-30973

An issue in V-SOL G/EPON ONU HG323AC-B with firmware version V2.0.08-210715 allows an attacker to execute arbtirary code and obtain sensitive information via crafted POST request to /boaform/getASPdata/formFirewall, /boaform/getASPdata/formAcc...

CVE-2024-11880

The B Testimonial – testimonial plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'btestimonial' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes ...

CVE-2024-46669

An Integer Overflow or Wraparound vulnerability CWE-190 in version 7.4.4 and below, version 7.2.10 and below; FortiSASE version 23.4.b FortiOS tenant IPsec IKE service may allow an authenticated attacker to crash the IPsec tunnel via crafted requests, resulting in potential denial of service...

CVE-2023-6028

A reflected cross-site scripting XSS vulnerability exists in the SVG version of System Diagnostics Manager of B Automation Runtime versions = G4.93 that enables a remote attacker to execute arbitrary JavaScript code in the context of the attacked user’s browser session...

CVE-2023-37562

Cross-site request forgery CSRF vulnerability in exists in WTC-C1167GC-B v1.17 and earlier, and WTC-C1167GC-W v1.17 and earlier. If a user views a malicious page while logged in, unintended operations may be performed...

CVE-2024-40462

creationtimestamp| type| source ---|---|--- 2025-05-23 01:08:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpsgy335py2y...

CVE-2022-4286

A reflected cross-site scripting XSS vulnerability exists in System Diagnostics Manager of B Automation Runtime versions =3.00 and =C4.93 that enables a remote attacker to execute arbitrary JavaScript in the context of the users browser session...

CVE-2021-33884

An Unrestricted Upload of File with Dangerous Type vulnerability in B. Braun SpaceCom2 prior to 012U000062 allows remote attackers to upload any files to the /tmp directory of the device through the webpage API. This can result in critical files being overwritten...

CVE-2020-25152

A session fixation vulnerability in the B. Braun Melsungen AG SpaceCom administrative interface Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows remote attackers to hijack web sessions and escalate privileges...

CVE-2020-25154

An open redirect vulnerability in the administrative interface of the B. Braun Melsungen AG SpaceCom device Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers to redirect users to malicious websites...

CVE-2020-25160

Improper access controls in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 enables attackers to extract and tamper with the devices network configuration...

CVE-2020-16238

A vulnerability in the configuration import mechanism of the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers with command line access to the underlying Linux system to escalate privileges to the root user...