13498 matches found
CVE-2021-32978
The CVE-2021-32978 entry describes a vulnerability in Automation Direct CLICK PLC CPU Modules (C0-1x) with firmware prior to v3.00 where a previously entered password and lock state can be read from the programming protocol, effectively exposing credentials and enabling unlocks if the password wa...
CVE-2021-32978 Automation Direct CLICK PLC CPU Modules Plaintext Storage of a Password
The programming protocol allows for a previously entered password and lock state to be read by an attacker. If the previously entered password was successful, the attacker can then use the password to unlock Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00...
CVE-2021-32978 Automation Direct CLICK PLC CPU Modules Plaintext Storage of a Password
The programming protocol allows for a previously entered password and lock state to be read by an attacker. If the previously entered password was successful, the attacker can then use the password to unlock Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00...
CVE-2021-32980 Automation Direct CLICK PLC CPU Modules Authentication Bypass Using an Alternate Path or Channel
Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 does not protect against additional software programming connections. An attacker can connect to the PLC while an existing connection is already active...
CVE-2021-32980
CVE-2021-32980 affects Automation Direct CLICK PLC CPU Modules, specifically the C0-1x CPUs with firmware older than 3.00. The issue is an authentication bypass via an alternate path or channel, caused by the firmware not protecting against additional software programming connections. An attacker...
CVE-2021-32980 Automation Direct CLICK PLC CPU Modules Authentication Bypass Using an Alternate Path or Channel
Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 does not protect against additional software programming connections. An attacker can connect to the PLC while an existing connection is already active...
CreateWiki 授权问题漏洞
CreateWiki is Miraheze's MediaWiki extension for requesting and creating wikis. A security vulnerability exists in CreateWiki that stems from the ability to use Special:RequestWikiQueue for anonymous comments when sent directly via POST...
PT-2022-10178 · Automationdirect · Automation Direct Click Plc Cpu Modules
Name of the Vulnerable Software and Affected Versions: Automation Direct CLICK PLC CPU Modules: C0-1x CPUs versions prior to v3.00 Description: The issue arises when an authorized user unlocks the Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00. The unlocked state...
CVE-2021-32978: Plaintext Storage of a Password
The programming protocol allows for a previously entered password and lock state to be read by an attacker. If the previously entered password was successful, the attacker can then use the password to unlock Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00...
CVE-2021-32982: Cleartext Transmission of Sensitive Information
Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 passwords are sent as plaintext during unlocking and project transfers. An attacker who has network visibility can observe the password exchange...
CVE-2021-32980: Authentication Bypass Using an Alternate Path or Channel
Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 does not protect against additional software programming connections. An attacker can connect to the PLC while an existing connection is already active...
CVE-2021-32984: Authentication Bypass Using an Alternate Path or Channel
All programming connections receive the same unlocked privileges, which can result in a privilege escalation. During the time Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 is unlocked by an authorized user, an attacker can connect to the PLC and read the project...
CVE-2021-32986: Authentication Bypass Using an Alternate Path or Channel
After Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 is unlocked by an authorized user, the unlocked state does not timeout. If the programming software is interrupted, the PLC remains unlocked. All subsequent programming connections are allowed without...
CVE-2022-22331
IBM SterlingPartner Engagement Manager 6.2.0 could allow a remote authenticated attacker to obtain sensitive information or modify user details caused by an insecure direct object vulnerability IDOR. IBM X-Force ID: 219130...
CVE-2022-22331
IBM SterlingPartner Engagement Manager 6.2.0 could allow a remote authenticated attacker to obtain sensitive information or modify user details caused by an insecure direct object vulnerability IDOR. IBM X-Force ID: 219130...
Design/Logic Flaw
IBM SterlingPartner Engagement Manager 6.2.0 could allow a remote authenticated attacker to obtain sensitive information or modify user details caused by an insecure direct object vulnerability IDOR. IBM X-Force ID: 219130...
CVE-2022-22331
IBM SterlingPartner Engagement Manager 6.2.0 could allow a remote authenticated attacker to obtain sensitive information or modify user details caused by an insecure direct object vulnerability IDOR. IBM X-Force ID: 219130...
Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to insecure direct object exploitation (CVE-2022-22331)
Summary IBM Sterling Partner Engagement Manager CVE-2022-22331 is vulnerable to insecure direct object exploitation. The issue has been addressed and users are strongly advised to apply remediation. Vulnerability Details CVEID: CVE-2022-22331 DESCRIPTION: IBM Sterling Partner Engagement Manager...
