CVE-2023-3573

CVE-2023-3573 describes a command-injection vulnerability in PHOENIX CONTACT WP 6xxx series web panels, present in versions prior to 4.0.10. A remote attacker with low privileges can exploit an HTTP POST request related to font configuration operations to gain full control of the device. Impact i...

CVE-2023-3573 PHOENIX CONTACT: Command Injection in WP 6xxx Web panels

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges may use a command injection in a HTTP POST request releated to font configuration operations to gain full access to the device...

CVE-2023-3573 PHOENIX CONTACT: Command Injection in WP 6xxx Web panels

In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges may use a command injection in a HTTP POST request releated to font configuration operations to gain full access to the device...

The vulnerability of the application programming interface of the TapHome smart home control system allows a perpetrator to bypass the authentication process and gain full access to the device.

The vulnerability of the application programming interface of the TapHome smart home control system is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to bypass the authentication process and gain full access to the device...

CVE-2022-4046

In CODESYS Control in multiple versions a improper restriction of operations within the bounds of a memory buffer allow an remote attacker with user privileges to gain full access of the device...

CVE-2022-4046

In CODESYS Control in multiple versions a improper restriction of operations within the bounds of a memory buffer allow an remote attacker with user privileges to gain full access of the device...

Critical Flaws in AMI MegaRAC BMC Software Expose Servers to Remote Attacks

Two more security flaws have been disclosed in AMI MegaRAC Baseboard Management Controller BMC software that, if successfully exploited, could allow threat actors to remotely commandeer vulnerable servers and deploy malware. "These new vulnerabilities range in severity from High to Critical,...

CVE-2023-2759

A hidden API exists in TapHome's core platform before version 2023.2 that allows an authenticated, low privileged user to change passwords of other users without any prior knowledge. The attacker may gain full access to the device by using this vulnerability...

Spoofing

A hidden API exists in TapHome's core platform before version 2023.2 that allows an authenticated, low privileged user to change passwords of other users without any prior knowledge. The attacker may gain full access to the device by using this vulnerability...

CVE-2023-2759 TAPHOME Improper Authentication in Core Platform

A hidden API exists in TapHome's core platform before version 2023.2 that allows an authenticated, low privileged user to change passwords of other users without any prior knowledge. The attacker may gain full access to the device by using this vulnerability...

CVE-2023-32394

The issue was addressed with improved checks. This issue is fixed in iOS 16.5 and iPadOS 16.5, watchOS 9.5, tvOS 16.5, macOS Ventura 13.4. A person with physical access to a device may be able to view contact information from the lock screen...

PT-2023-21982 · Hikvision · Hikvision Access Control

Name of the Vulnerable Software and Affected Versions: Hikvision Access Control affected versions not specified Description: The issue allows attackers to perform a session hijacking attack because the product does not update the session ID after a user successfully logs in. To exploit this,...

CVE-2022-4332 Sprecher: Vulnerable firmware verification

In Sprecher Automation SPRECON-E-C/P/T3 CPU in variant PU244x a vulnerable firmware verification has been identified. Through physical access and hardware manipulation, an attacker might be able to bypass hardware-based code verification and thus inject and execute arbitrary code and gain full...

PT-2023-14191 · Sprecher Automation · Sprecon-E-C/P/T3 Cpu

Name of the Vulnerable Software and Affected Versions: Sprecher Automation SPRECON-E-C/P/T3 CPU in variant PU244x affected versions not specified Description: A vulnerable firmware verification has been identified in the device. Through physical access and hardware manipulation, an attacker might...

CVE-2022-46738 CVE-2022-46738

The affected product exposes multiple sensitive data fields of the affected product. An attacker can use the SNMP command to get device mac address and login as admin...

CVE-2023-32348

Teltonika’s Remote Management System versions prior to 4.10.0 contain a virtual private network VPN hub feature for cross-device communication that uses OpenVPN. It connects new devices in a manner that allows the new device to communicate with all Teltonika devices connected to the VPN. The...

CVE-2023-31679

Incorrect access control in Videogo v6.8.1 allows attackers to access images from other devices via modification of the Device Id parameter...

PT-2023-6552 · Totolink · Totolink X5000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK X5000R versions V9.1.0u.6118 B20201102 through V9.1.0u.6369 B20230113 Description: The issue concerns a command insertion vulnerability in the setting/setTracerouteCfg component of the TOTOLINK X5000R router's firmware. This...

The vulnerability of the FTP service for operating system network storage devices like My Cloud OS allows a hacker to gain full access to the device and execute arbitrary code.

The vulnerability of the FTP service in operating system network storage devices like My Cloud OS is related to incorrect restrictions on the path to the restricted access directory. Exploiting this vulnerability could allow an attacker to gain full access to the device and execute arbitrary code...

PT-2023-3074 · 3S Smart Software Solutions · Codesys Control

Name of the Vulnerable Software and Affected Versions: CODESYS Control versions affected versions not specified Description: The issue is related to an improper restriction of operations within the bounds of a memory buffer, which can be exploited by a remote attacker with user privileges to gain...