CVE-2021-22815

The CVE-2021-22815 entry covers an Information Exposure vulnerability in Schneider Electric NMC/NMC2/NMC3 embedded devices and related APC equipment. Affected products include 1-phase and 3-phase UPS with NMC2/NMC3 (AP9630/9631/9635 on NMC2; AP9640/9641/9643 on NMC3), NMC2/NMC3-based PDUs, XRDP/X...

CVE-2021-22813

A CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists that could cause arbritrary script execution when a privileged account clicks on a malicious URL specifically crafted for the NMC pointing to an edit policy file. Affected Products:...

CVE-2021-22811

A CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists that could cause script execution when the request of a privileged account accessing the vulnerable web page is intercepted. Affected Products: 1-Phase Uninterruptible Power Supply UP...

crawfordenvironmental.com Improper Access Control vulnerability OBB-2297498

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Schneider Electric NMC cards and Embedded Devices

1. EXECUTIVE SUMMARY CVSS v3 6.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schneider Electric Equipment: Network Management Cards NMC and NMC Embedded Devices Vulnerabilities: Cross-site Scripting, Exposure of Sensitive Information to an Unauthorized Actor 2. RISK EVALUATION...

CVE-2021-41185

CVE-2021-41185 affects Mycodo (environmental monitoring system) with a path traversal vulnerability in versions prior to 8.12.7. The issue arises from insufficient filtering of file paths, allowing an endpoint-accessed user to download files outside the intended directory. A fix was released in 8...

CVE-2021-41185 Download file outside intended directory

Mycodo is an environmental monitoring and regulation system. An exploit in versions prior to 8.12.7 allows anyone with access to endpoints to download files outside the intended directory. A patch has been applied and a release made. Users should upgrade to version 8.12.7. As a workaround, users...

environmental-action.org Improper Access Control vulnerability OBB-2171770

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Nodejs Core 环境问题漏洞

Nodejs Core is a core module compiled into Nodejs from the OpenJS Openjs Foundation. The module provides underlying TCP, HTTP, DNS, filesystem, subprocessing, and other functionality support for Nodejs. An environmental issue vulnerability exists in Nodejs Core that stems from an attacker being...

Puma 环境问题漏洞

Puma is a web server for highly concurrent applications by Evan Phoenix, an individual developer in the United States. Puma is vulnerable to an environmental issue that arises from improper design or implementation during code development of a web system or product...

Learn How Akamai Enables AI Powered Analytics Tools to Reduce Water Losses

The Accelerator Program, a flagship initiative of Akamai India’s Corporate Social Responsibility Trust, enables early-stage innovations for water conservation. Over the past two years, along with our mentoring partner, the International Center for Clean Water ICCW; an initiative of the Indian...

Pepperl Fuchs WirelessHART-Gateway环境问题漏洞

The Pepperl Fuchs WirelessHART-Gateway is a gateway device from Pepperl Fuchs, Germany. An environmental issue vulnerability exists in Pepperl Fuchs WirelessHART-Gateway version 3.0.8 and prior versions, which can be exploited by an attacker to rewrite links and urls in cached pages as arbitrary...

Compilation database: An alternative way to configure your C or C++ analysis

Analyzing C or C++ code requires - in addition to the source code - the configuration that is used to build the code. At SonarSource, we have provided a tool to automate the extraction of this information, the build wrapper. This tool has been used successfully with many projects, yet there are...

Actix-http 环境问题漏洞

Actix-http is the HTTP primitive for the Actix ecosystem. An environmental issue vulnerability exists in Actix-http that stems from the product's failure to detect HTTP HRS requests, which can be exploited by an attacker to cause a credential disclosure. The following products and versions are...

Fortinet FortiManager和Fortinet FortiAnalyzer 环境问题漏洞

Fortinet FortiManager is a centralized network security management platform from Fortinet, Inc. Fortinet FortiAnalyzer is a centralized network security reporting solution that allows for centralized management of any number of Fortinet devices and the ability to group devices into different...

Is crypto’s criminal rollercoaster approaching a terminal dip?

It’s a turbulent time in the cryptomining realm, especially for malware authors. Some big attacks and a lot of publicity has resulted in prolific groups promising to disband, even if potentially only temporarily. Running a tighter ship The mining banhammer continues to swing as China keeps puttin...

Apache Traffic Server 环境问题漏洞

An environmental issue vulnerability exists in Apache Traffic Server ATS, a set of scalable HTTP proxy and caching servers from the Apache Foundation, which stems from a failure to properly handle URL data segments. An attacker could exploit this vulnerability to affect the cache of the target...

SUSE: Security Advisory (SUSE-SU-2017:0114-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GSD-2021-1000010 temporary file creation (CWE-379) in fabric-samples version Prior to commit 6bccc138887b3dbd9dc920bad200068b11066ef7

In Hyperledger fabric-samples version Prior to commit 6bccc138887b3dbd9dc920bad200068b11066ef7 a temporary file creation CWE-379 exists in the digibank.sh and magnetocorp.sh that can be attacked via Local resulting in Information disclosure of all environmental variables...

Jiangsu Sanxi Technology Co., Ltd. pollution source online monitoring management system has information leakage vulnerability

Ltd. is a professional provider of software and hardware total solutions in the field of environmental automatic monitoring and industrial process control. Ltd. pollution source online monitoring management system information leakage vulnerability, attackers can use the vulnerability to obtain...