FortiWLM - Command injection in script handlers

An improper neutralization of special elements used in an OS command vulnerability 'OS Command Injection' CWE-78 in FortiWLM may allow an authenticated attacker to execute unauthorized code or commands via crafted HTTP requests to various controllers...

FortiWLM - SQL Injection in script handlers

An improper neutralization of special elements CWE-79 used in an SQL command vulnerability 'SQL Injection' CWE-89 in FortiWLM may allow an authenticated attacker to disclose sensitive information via crafted HTTP requests to various controllers...

The vulnerability of the implementation of the Ethernet Industrial Protocol (ENIP) in the microsoftware-based network interface controllers of Cisco Firepower Threat Defense (FTD) allows a attacker to circumvent the configured access control policies.

The vulnerability of the Industrial Ethernet Protocol ENIP implementation of Cisco Firepower Threat Defense’s micro-programmed network interface controllers is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to bypass the configured access contr...

Security Restriction Bypass

spring-boot-actuator is vulnerable to security restriction bypass. Lack of secure handling of HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping causes the exposure of those resources and request mapping, leading to...

CVE-2021-22047

In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for...

CVE-2021-22047

In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for...

Design/Logic Flaw

In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for...

CVE-2021-22047

In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for...

CVE-2021-22047

In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for...

CVE-2021-22047

In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for...

CVE-2021-22047: Exposure of Sensitive Information to an Unauthorized Actor

In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for...

PT-2021-14846

Name of the Vulnerable Software and Affected Versions Spring Data REST versions 3.4.0 through 3.4.13 Spring Data REST versions 3.5.0 through 3.5.5 Spring Data REST older unsupported versions Description The issue affects HTTP resources implemented by custom controllers using a configured base API...

PT-2021-26340

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.14.15 Description: A potential issue exists in the Linux Kernel related to a deadlock when adding SPI controllers on SPI buses. The actual impact and attack plausibility have not yet been proven...

PT-2021-30335

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.14.15 Description A potential issue exists in the Linux Kernel related to a deadlock when adding SPI controllers on SPI buses. The actual impact and attack plausibility have not yet been proven. Recommendation...

CVE-2021-38450

The affected controllers do not properly sanitize the input containing code syntax. As a result, an attacker could craft code to alter the intended controller flow of the software...

CVE-2021-38450 Trane Tracer Code Injection

The affected controllers do not properly sanitize the input containing code syntax. As a result, an attacker could craft code to alter the intended controller flow of the software...

Potential Security Bypass for customized Spring Data REST Resource

In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for...

CVE-2021-42534 Trane Building Automation Controllers Cross-site Scripting

The affected product’s web application does not properly neutralize the input during webpage generation, which could allow an attacker to inject code in the input forms...

PT-2021-8052

Name of the Vulnerable Software and Affected Versions Fanuc Series 32i affected versions not specified Description The issue is related to errors in resource management within the software of Fanuc Series 32i CNC controllers. It may allow a remote attacker to gain unauthorized access to protected...

Trane HVAC Systems Controls

1. EXECUTIVE SUMMARY CVSS v3 6.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Trane Equipment: Building Automation Controllers Tracer SC Vulnerability: Cross-site Scripting 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to redirect a user...