RSLogix 500 Information Disclosure

The vulnerability of the RSLogix 500 software, the programmable logic controllers MicroLogix 1100 and MicroLogix 1400, is related to the use of user-side authentication. Exploiting this vulnerability can allow a remote attacker to disclose confidential information...

CVE-2019-5159

An exploitable improper input validation vulnerability exists in the firmware update functionality of WAGO e!COCKPIT automation software v1.6.0.7. A specially crafted firmware update file can allow an attacker to write arbitrary files to arbitrary locations on WAGO controllers as a part of...

CVE-2019-5135

An exploitable timing discrepancy vulnerability exists in the authentication functionality of the Web-Based Management WBM web application on WAGO PFC100/200 controllers. The WBM application makes use of the PHP crypt function which can be exploited to disclose hashed user credentials. This affec...

CVE-2019-5135

WAGO PFC100/200 Web-Based Management (WBM) authentication timing information disclosure (CVE-2019-5135) is detailed in the TALOS entry. The vulnerability resides in the WBM login routine where the PHP crypt() function is used to generate a password hash for comparison, allowing an attacker to inf...

CVE-2019-19281

A vulnerability has been identified in SIMATIC ET 200SP Open Controller CPU 1515SP PC2 incl. SIPLUS variants All versions = V2.5 and = V2.5 and = V2.5 and V20.8. Affected devices contain a vulnerability that allows an unauthenticated attacker to trigger a Denial-of-Service condition. The...

PT-2020-8534

Name of the Vulnerable Software and Affected Versions: Kiboko Chained Quiz plugin versions prior to 1.0.9 Description: The issue allows remote unauthenticated users to execute arbitrary SQL commands via the answer and answers parameters in the controllers/quizzes.php file. This can be exploited b...

CVE-2019-5159: Exposure of Resource to Wrong Sphere

An exploitable improper input validation vulnerability exists in the firmware update functionality of WAGO e!COCKPIT automation software v1.6.0.7. A specially crafted firmware update file can allow an attacker to write arbitrary files to arbitrary locations on WAGO controllers as a part of...

CVE-2018-14502: Improper Neutralization of Special Elements used in an SQL Command

controllers/quizzes.php in the Kiboko Chained Quiz plugin before 1.0.9 for WordPress allows remote unauthenticated users to execute arbitrary SQL commands via the 'answer' and 'answers' parameters...

Rockwell Automation MicroLogix Controllers and RSLogix 500 Software

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Rockwell Automation Equipment: MicroLogix 1400 Controllers, MicroLogix 1100 Controllers, and RSLogix 500 Software Vulnerabilities: Use of Hard-coded Cryptographic Key, Use of a Broken or Risky...

CVE-2020-10191

An issue was discovered in MunkiReport before 5.3.0. An authenticated actor can send a custom XSS payload through the /module/comment/save endpoint. The payload will be executed by any authenticated users browsing the application. This concerns app/controllers/client.php:detail...

CVE-2020-10191: Improper Neutralization of Input During Web Page Generation

An issue was discovered in MunkiReport before 5.3.0. An authenticated actor can send a custom XSS payload through the /module/comment/save endpoint. The payload will be executed by any authenticated users browsing the application. This concerns app/controllers/client.php:detail...

PT-2020-11964

Name of the Vulnerable Software and Affected Versions MunkiReport versions prior to 5.3.0 Description An issue allows an authenticated actor to send a custom XSS payload through the "/module/comment/save" endpoint. The payload will be executed by any authenticated users browsing the application...

WAGO PFC100/200 Web-Based Management (WBM) Authentication Timing Information Disclosure Vulnerability

Summary An exploitable timing discrepancy vulnerability exists in the authentication functionality of the Web-Based Management WBM web application on WAGO PFC100/200 controllers. The WBM application makes use of the PHP crypt function which can be exploited to disclose hashed user credentials...

WAGO e!COCKPIT file path improper input validation vulnerability

Summary An exploitable improper input validation vulnerability exists in the firmware update functionality of WAGO e!COCKPIT automation software. A specially crafted firmware update file can allow an attacker to write arbitrary files to arbitrary locations on WAGO controllers as a part of executi...

WAGO PFC100/200 Web-Based Management (WBM) Authentication Regex Information Disclosure Vulnerability

Summary An exploitable regular expression without anchors vulnerability exists in the Web-Based Management WBM authentication functionality of WAGO PFC100/200 controllers. A specially crafted authentication request can bypass regular expression filters, resulting in sensitive information...

PT-2020-1765

Name of the Vulnerable Software and Affected Versions Rockwell Automation MicroLogix 1400 Controllers Series B versions 21.001 and prior Rockwell Automation MicroLogix 1400 Controllers Series A, all versions MicroLogix 1100 Controller, all versions RSLogix 500 Software versions 12.001 and prior...

PT-2020-1768

Name of the Vulnerable Software and Affected Versions Rockwell Automation MicroLogix 1400 Controllers versions prior to Series B v21.001 Rockwell Automation MicroLogix 1100 Controller all versions RSLogix 500 Software versions prior to v12.001 Description The issue is related to the Simple Mail...

PT-2020-1767

Name of the Vulnerable Software and Affected Versions Rockwell Automation MicroLogix 1400 Controllers Series B versions 21.001 and prior Rockwell Automation MicroLogix 1400 Controllers Series A, all versions Rockwell Automation MicroLogix 1100 Controller, all versions RSLogix 500 Software version...

PT-2020-1766

Name of the Vulnerable Software and Affected Versions Rockwell Automation MicroLogix 1400 Controllers Series B versions 21.001 and prior Rockwell Automation MicroLogix 1400 Controllers Series A all versions Rockwell Automation MicroLogix 1100 Controller all versions RSLogix 500 Software versions...

Moxa ioLogik Device Detection Consolidation

Consolidation of Moxa ioLogik device detections. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only include"pluginfeedinfo.inc"; ifdescription...