CVE-2022-45139 WAGO: Origin validation error through CORS misconfiguration

A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combination with CVE-2022-45138 this could lead to disclosure of device information like CPU diagnostics. As there is just a limited amount of...

CVE-2022-45139

CVE-2022-45139 (Wago): A CORS misconfiguration in the web-based management causes disclosure of basic information pages, potentially exposing device information when combined with CVE-2022-45138. Affected product: Wago web-based management interfaces. Root cause: misconfigured CORS controls allow...

PT-2023-14617 · Wago · 751-9301 Firmware +13

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: A CORS misconfiguration in the web-based management allows a malicious third-party web server to misuse basic information pages, potentially leading to the disclosure of device...

K03544414: Running a CTU Diagnostics Report may leave elevated command prompt after report generation

Security Advisory Description This issue occurs when all of the following conditions are met: You run one of the following BIG-IP Edge Client for Windows versions: 7.2.1 or later 7.1.9.7 or later 7.1.8.4 or later You run the Client Troubleshooting Utility CTU Diagnostics Report with administrator...

Intel Ethernet Diagnostics Driver Detection (Windows)

Binary data intelethernetdiagnosticsdriverwininstalled.nbin...

SUSE CVE-2012-2377

JGroups diagnostics service in JBoss Enterprise Portal Platform before 5.2.2, SOA Platform before 5.3.0, and BRMS Platform before 5.3.0, is enabled without authentication when started by the JGroups channel, which allows remote attackers in adjacent networks to read diagnostics information via a...

SUSE CVE-2014-2068

The doIndex function in hudson/util/RemotingDiagnostics.java in CloudBees Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users with the ADMINISTER permission to obtain sensitive information via vectors related to heapDump...

SUSE CVE-2015-2908

Mobile Devices aka MDI C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, do not validate firmware updates, which allows remote attackers to execute arbitrary code by specifying an update server...

SUSE CVE-2022-1641

Use after free in Web UI Diagnostics in Google Chrome on Chrome OS prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via specific user interaction...

CVE-2022-4286

A reflected cross-site scripting XSS vulnerability exists in System Diagnostics Manager of B&R Automation Runtime versions =3.00 and =C4.93 that enables a remote attacker to execute arbitrary JavaScript in the context of the users browser session...

CVE-2022-4286

A reflected cross-site scripting XSS vulnerability exists in System Diagnostics Manager of B&R Automation Runtime versions =3.00 and =C4.93 that enables a remote attacker to execute arbitrary JavaScript in the context of the users browser session...

CVE-2022-4286 Reflected Cross-Site Scripting Vulnerabilities in Automation Runtime

A reflected cross-site scripting XSS vulnerability exists in System Diagnostics Manager of B&R Automation Runtime versions =3.00 and =C4.93 that enables a remote attacker to execute arbitrary JavaScript in the context of the users browser session...

CVE-2022-4286 Reflected Cross-Site Scripting Vulnerabilities in Automation Runtime

A reflected cross-site scripting XSS vulnerability exists in System Diagnostics Manager of B&R Automation Runtime versions =3.00 and =C4.93 that enables a remote attacker to execute arbitrary JavaScript in the context of the users browser session...

PT-2023-14154 · B&R · B&R Automation Runtime

Name of the Vulnerable Software and Affected Versions: B&R Automation Runtime versions 3.00 through C4.93 Description: A reflected cross-site scripting issue exists in the System Diagnostics Manager, allowing a remote attacker to execute arbitrary JavaScript in the context of the user's browser...

CVE-2022-4286: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting XSS vulnerability exists in System Diagnostics Manager of B&R Automation Runtime versions =3.00 and =C4.93 that enables a remote attacker to execute arbitrary JavaScript in the context of the users browser session...

Metasploit Weekly Wrap-Up

Taking a stroll down memory lane Tomcat Init Script Privilege Escalation Do you remember the issue with Tomcat init script that was originally discovered by Dawid Golunski back in 2016 that led to privilege escalation? This week's Metasploit release includes an exploit module for CVE-2016-1240 by...

Intel Ethernet Diagnostics Driver for Windows Denial-of-Service Vulnerability

Intel ethernet diagnostics driver for Windows IQVW32.sys and IQVW64.sys contain an unspecified vulnerability that allows for a denial-of-service DoS...

Security Bulletin: IBM Tivoli Composite Application Manager for Application Diagnostics Installed WebSphere Application Server traditional is vulnerable to a remote code execution vulnerability

Summary The security issue described in CVE-2023-23477 has been identified in the WebSphere Application Server traditional included as part of IBM Tivoli Composite Application Manager for Application Diagnostics Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes...

Lenovo Diagnostics Driver Memory Access

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Lenovo Diagnostics Driver IOCTL memmove', 'Description' = %q Incorrect access control for the Lenovo Diagnostics Driver allows a low-privileged...

Lenovo Diagnostics Driver Memory Access Exploit

This Metasploit module demonstrates how an incorrect access control for the Lenovo Diagnostics Driver allows a low-privileged user the ability to issue device IOCTLs to perform arbitrary physical/virtual memory reads and writes. This module requires Metasploit: https://metasploit.com/download...