CP-Plus DVR 安全漏洞

CP-Plus DVR is a digital video recorder from CP-Plus. A security vulnerability exists in CP-Plus DVR that stems from improper input handling, which allows an unauthenticated, remote attacker to obtain sensitive information on a target device by sending a specially crafted HTTP request to the...

The vulnerability of the web server of the microprogramming software for the processor module control units of Siemens SICAM CP-8031 and CP-8050 allows a hacker to increase their privileges.

The vulnerability of web servers with microprogramming software and Siemens SICAM CP-8031/CP-8050 processor module controllers is related to the use of rigidly encrypted login data. Exploiting this vulnerability can allow attackers to increase their privileges...

EulerOS 2.0 SP9 : ntp (EulerOS-SA-2023-2591)

According to the versions of the ntp package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the cpcpdec while loop. An adversary may be able to attack a client ntpq...

CVE-2023-3855: Improper Neutralization of Input During Web Page Generation

A vulnerability classified as problematic was found in phpscriptpoint JobSeeker 1.5. Affected by this vulnerability is an unknown functionality of the file /search-result.php. The manipulation of the argument kw/lc/ct/cp/p leads to cross site scripting. The attack can be launched remotely. The...

The vulnerability of the d_expression_1 function in the libiberty/cp-demangle.c component of the GNU Binutils development environment allows a attacker to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the dexpression1 function in the libiberty/cp-demangle.c component of the GNU Binutils development environment is related to reading data beyond the allowable buffer limits after multiple recursive calls. Exploiting this vulnerability allows an attacker to gain access to...

The vulnerability of the d_count_templates_scopes function in the libiberty/cp-demangle.c component of the GNU Binutils development environment allows a attacker to cause a service failure.

The vulnerability of the dcounttemplatesscopes function in the libiberty/cp-demangle.c component of the GNU Binutils development environment is related to an uncontrolled recursion. Exploiting this vulnerability allows a remote attacker to cause service interruptions...

WordPress CP Image Gallery Plugin <= 1.1.0 is vulnerable to Cross Site Scripting (XSS)

Software CP Image Gallery Type Plugin Vulnerable versions = 1.1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID d0eacddeb26a Credits Rafie Muhammad Patchstack Require...

WordPress CP Simple Newsletter Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)

Software CP Simple Newsletter Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 0ce14137a822 Credits Rafie Muhammad Patchstack...

Siemens A8000 CP-8050 / CP-8031 Code Execution / Command Injection

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple Vulnerabilities including Unauthenticated RCE product: Siemens A8000 CP-8050 MASTER MODULE 6MF2805-0AA00 Siemens A8000 CP-8031 MASTER MODULE 6MF2803-1AA00...

CVE-2023-27396

FINS Factory Interface Network Service is a message communication protocol, which is designed to be used in closed FA Factory Automation networks, and is used in FA networks composed of OMRON products. Multiple OMRON products that implement FINS protocol contain following security issues --...

CVE-2023-27396

FINS Factory Interface Network Service is a message communication protocol, which is designed to be used in closed FA Factory Automation networks, and is used in FA networks composed of OMRON products. Multiple OMRON products that implement FINS protocol contain following security issues --...

CVE-2023-27396: Missing Authentication for Critical Function

FINS Factory Interface Network Service is a message communication protocol, which is designed to be used in closed FA Factory Automation networks, and is used in FA networks composed of OMRON products. Multiple OMRON products that implement FINS protocol contain following security issues --...

CVE-2023-33919

A vulnerability has been identified in CP-8031 MASTER MODULE All versions CPCI85 V05, CP-8050 MASTER MODULE All versions CPCI85 V05. The web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated privileged...

CVE-2023-33920

A vulnerability has been identified in CP-8031 MASTER MODULE All versions CPCI85 V05, CP-8050 MASTER MODULE All versions CPCI85 V05. The affected devices contain the hash of the root password in a hard-coded form, which could be exploited for UART console login to the device. An attacker with...

CVE-2023-33919

A vulnerability has been identified in CP-8031 MASTER MODULE All versions CPCI85 V05, CP-8050 MASTER MODULE All versions CPCI85 V05. The web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated privileged...

CVE-2023-33921

A vulnerability has been identified in CP-8031 MASTER MODULE All versions CPCI85 V05, CP-8050 MASTER MODULE All versions CPCI85 V05. The affected devices contain an exposed UART console login interface. An attacker with direct physical access could try to bruteforce or crack the root password to...

CVE-2023-33920

A vulnerability has been identified in CP-8031 MASTER MODULE All versions CPCI85 V05, CP-8050 MASTER MODULE All versions CPCI85 V05. The affected devices contain the hash of the root password in a hard-coded form, which could be exploited for UART console login to the device. An attacker with...

Command injection

A vulnerability has been identified in CP-8031 MASTER MODULE All versions CPCI85 V05, CP-8050 MASTER MODULE All versions CPCI85 V05. The web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated privileged...

Default credentials

A vulnerability has been identified in CP-8031 MASTER MODULE All versions CPCI85 V05, CP-8050 MASTER MODULE All versions CPCI85 V05. The affected devices contain an exposed UART console login interface. An attacker with direct physical access could try to bruteforce or crack the root password to...

Default credentials

A vulnerability has been identified in CP-8031 MASTER MODULE All versions CPCI85 V05, CP-8050 MASTER MODULE All versions CPCI85 V05. The affected devices contain the hash of the root password in a hard-coded form, which could be exploited for UART console login to the device. An attacker with...