CVE-2021-22705

CVE-2021-22705 describes an Improper Restriction of Operations within the Bounds of a Memory Buffer that could allow denial of service or unauthorized access to system information when interacting with a driver installed by Schneider Electric’s Vijeo Designer or EcoStruxure Machine Expert. The co...

CVE-2021-22705

Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause denial of service or unauthorized access to system information when interacting directly with a driver installed by Vijeo Designer or EcoStruxure Machine Expert...

Security Bulletin: Vulnerability in Java SE and Eclipse OpenJ9 affect DB2 Recovery Expert for Linux, Unix and Windows

Summary An unspecified vulnerability in Java SE could allow an unauthenticated attacker to obtain sensitive information resulting in a low confidentiality impact using unknown attack vectors. Eclipse OpenJ9 is vulnerable to a stack-based buffer overflow when the virtual machine or JNI natives are...

Denial of Service Vulnerability in Schneider Control Expert

Control Expert is a suite of programming software for Schneider Electric logic controller products. A denial of service vulnerability exists in Schneider Control Expert. An attacker could exploit this vulnerability to cause a denial of service...

CVE-2021-30176

The ZEROF Expert pro/2.0 application for mobile devices allows SQL Injection via the Authorization header to the /v2/devices/add endpoint...

CVE-2021-30176

The ZEROF Expert pro/2.0 application for mobile devices allows SQL Injection via the Authorization header to the /v2/devices/add endpoint...

CVE-2021-30176

The ZEROF Expert pro/2.0 application for mobile devices allows SQL Injection via the Authorization header to the /v2/devices/add endpoint...

Sql injection

The ZEROF Expert pro/2.0 application for mobile devices allows SQL Injection via the Authorization header to the /v2/devices/add endpoint...

CVE-2021-30176

The CVE-2021-30176 entry concerns the ZEROF Expert pro/2.0 mobile app, where an SQL Injection is possible through the Authorization header to the /v2/devices/add endpoint. Sources in linked records (Red Hat, NVD, CVE listing, CNNVD) confirm the vulnerability and its impact vector, but the connect...

CVE-2021-30176

The ZEROF Expert pro/2.0 application for mobile devices allows SQL Injection via the Authorization header to the /v2/devices/add endpoint...

ZEROF Expert pro SQL注入漏洞

ZEROF Expert pro is a mobile application for the ZEROF platform. For professional use by employees and agents of sellers involved in the inspection of insurance objects, collateralized assets, responsible for the display of goods at retail outlets. A SQL injection vulnerability exists in ZEROF...

Hobby Lobby Exposes Customer Data in Cloud Misconfiguration

Arts-and-crafts retailer Hobby Lobby has suffered a cloud-bucket misconfiguration, exposing a raft of customer information, according to a report. An independent security researcher who goes by the handle “Boogeyman” uncovered the issue and reported it to Motherboard in an online chat, according ...

The vulnerability of the Schneider Electric EcoStruxure Control Expert programming tool, related to the execution of operations beyond the buffer boundaries, allows a intruder to trigger a maintenance failure or execute arbitrary code.

The vulnerability of the Schneider Electric EcoStruxure Control Expert programming tool relates to the execution of operations beyond the buffer boundaries. Exploiting this vulnerability could allow an attacker to trigger a maintenance failure or execute arbitrary code by opening a specially...

Damn-Vulnerable-GraphQL-Application - Damn Vulnerable GraphQL Application Is An Intentionally Vulnerable Implementation Of Facebook's GraphQL Technology, To Learn And Practice GraphQL Security

Damn Vulnerable GraphQL Application is an intentionally vulnerable implementation of Facebook's GraphQL technology, to learn and practice GraphQL Security. About DVGA Damn Vulnerable GraphQL is a deliberately weak and insecure implementation of GraphQL that provides a safe environment to attack a...

Afternoon Cyber Tea: Privacy, the pandemic, and protecting our cyber future

Much of our everyday life has moved online with the pandemic continuing to play a role in how we work and communicate with others. This migration has meant that security and privacy continue to remain top-of-mind for both security professionals and those who may not have given these cyber issues ...

CVE-2020-28221

A CWE-20: Improper Input Validation vulnerability exists in EcoStruxure™ Operator Terminal Expert and Pro-face BLUE version details in the notification that could cause arbitrary code execution when the Ethernet Download feature is enable on the HMI...

CVE-2020-28221

CVE-2020-28221 is an improper input validation (CWE-20) vulnerability in EcoStruxure™ Operator Terminal Expert and Pro-face BLUE. The issue could allow arbitrary code execution when the Ethernet Download feature is enabled on the HMI. The provided sources identify the affected products but do not...

Vulnerability discovered in Schneider Electric EcoStruxure Control Expert

Vulnerabilities have been discovered in Schneider Electric EcoStruxure Control Expert. The vulnerabilities allow a local malicious able to cause a denial-of-service and to execute arbitrary execute arbitrary code by opening a rogue file. Schneider Electric categorizes this vulnerability according...

CVE-2018-18689

The Portable Document Format PDF specification does not provide any information regarding the concrete procedure of how to validate signatures. Consequently, a Signature Wrapping vulnerability exists in multiple products. An attacker can use /ByteRange and xref manipulations that are not detected...

CVE-2018-18689

The Portable Document Format PDF specification does not provide any information regarding the concrete procedure of how to validate signatures. Consequently, a Signature Wrapping vulnerability exists in multiple products. An attacker can use /ByteRange and xref manipulations that are not detected...