CVE-2021-22047

In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for...

CVE-2021-22047

In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for...

Design/Logic Flaw

In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for...

CVE-2021-22047

In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for...

CVE-2021-22047

In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for...

CVE-2021-38450

The affected controllers do not properly sanitize the input containing code syntax. As a result, an attacker could craft code to alter the intended controller flow of the software...

CVE-2021-38450 Trane Tracer Code Injection

The affected controllers do not properly sanitize the input containing code syntax. As a result, an attacker could craft code to alter the intended controller flow of the software...

Potential Security Bypass for customized Spring Data REST Resource

In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for...

CVE-2021-42534 Trane Building Automation Controllers Cross-site Scripting

The affected product’s web application does not properly neutralize the input during webpage generation, which could allow an attacker to inject code in the input forms...

Trane HVAC Systems Controls

1. EXECUTIVE SUMMARY CVSS v3 6.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: Trane Equipment: Building Automation Controllers Tracer SC Vulnerability: Cross-site Scripting 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to redirect a user...

Active-Directory-Exploitation-Cheat-Sheet

This is a cheat sheet for Windows Active Directory exploitation, containing common enumeration and attack methods. The repository is a collection of PowerShell scripts and modules that can be used to perform various attacks on Active Directory, including domain enumeration, lateral movement, and...

Siemens SINUMERIK Controllers Denial of Service Vulnerability

SINUMERIK CNCs provide automation solutions for shop floor, workshop and large volume production environments. a denial of service vulnerability exists in Siemens SINUMERIK Controllers. the vulnerability stems from the fact that the affected device fails to properly handle certain specially craft...

Medtronic recalls insulin pump controllers over life-threatening flaws

By Deeba Ahmed Medtronic has recalled the remote controllers used with some of the company’s insulin pumps because of inherent vulnerabilities that could lead to injury or death. This is a post from HackRead.com Read the original post: Medtronic recalls insulin pump controllers over...

Multiple Critical Flaws Discovered in Honeywell Experion PKS and ACE Controllers

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Tuesday released an advisory regarding multiple security vulnerabilities affecting all versions of Honeywell Experion Process Knowledge System C200, C200E, C300, and ACE controllers that could be exploited to achieve remote code...

PT-2021-4325 · Honeywell · Honeywell Experion Pks

Name of the Vulnerable Software and Affected Versions: Honeywell Experion PKS versions C200, C200E, C300, and ACE controllers Description: The issue is related to insufficient restrictions on directory path names in the operating system of Honeywell's industrial portable computers. This can be...

CISA Releases Security Advisory for Honeywell Experion and ACE Controllers

CISA has released an Industrial Controls Systems ICS advisory detailing multiple vulnerabilities affecting all versions of Honeywell Experion Process Knowledge System C200, C200E, C300, and ACE controllers. A remote attacker could exploit some of these vulnerabilities to take control of an affect...

Honeywell Experion PKS和Ace Controllers 路径遍历漏洞

Honeywell Experion PKS and Honeywell Ace Controllers are both products of Honeywell, Inc. Honeywell Experion PKS is a process automation system. Honeywell Ace Controllers are used to execute Honeywell's Control Execution Environment Cee on a server-grade computer platform. Honeywell Ace Controlle...

Honeywell Experion PKS and ACE Controllers

1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low attack complexity Vendor: Honeywell Equipment: Experion Process Knowledge System PKS C200, C200E, C300 and ACE Controllers Vulnerabilities: Unrestricted Upload of File with Dangerous Type, Relative Path Traversal, Improper...

Honeywell Experion PKS 和 ACE Controllers 代码问题漏洞

Honeywell Experion PKS and Honeywell Ace Controllers are both products of Honeywell, Inc. Honeywell Experion PKS is a process automation system. Honeywell Ace Controllers are used to execute Honeywell's Control Execution Environment Cee on a server-grade computer platform. Honeywell Ace Controlle...

Honeywell Experion PKS和Honeywell Ace Controllers 注入漏洞

Honeywell Experion PKS and Honeywell Ace Controllers are both products of Honeywell, Inc. Honeywell Experion PKS is a process automation system. Honeywell Ace Controllers are used to execute Honeywell's Control Execution Environment Cee on a server-grade computer platform. Honeywell Ace Controlle...