CVE-2024-28135

A low privileged remote attacker can use a command injection vulnerability in the API which performs remote code execution as the user-app user due to improper input validation. The confidentiality is partly affected...

CVE-2024-28136

CVE-2024-28136 describes a command-injection on PHOENIX CONTACT CHARX SEC devices via the OCPP Remote service. Multiple connected sources (ZDI, NVD, CVE listings) indicate the flaw resides in input validation when processing Charger ID/remote commands (e.g., Get Diagnostics), enabling a low-privi...

CVE-2024-28136 PHOENIX CONTACT: command injection gains root privileges using the OCPP remote service

A local attacker with low privileges can use a command injection vulnerability to gain root privileges due to improper input validation using the OCPP Remote service...

CVE-2024-28136 PHOENIX CONTACT: command injection gains root privileges using the OCPP remote service

A local attacker with low privileges can use a command injection vulnerability to gain root privileges due to improper input validation using the OCPP Remote service...

CVE-2024-28135 PHOENIX CONTACT: command injection vulnerability in the API of the CHARX Series

A low privileged remote attacker can use a command injection vulnerability in the API which performs remote code execution as the user-app user due to improper input validation. The confidentiality is partly affected...

CVE-2024-28135 PHOENIX CONTACT: command injection vulnerability in the API of the CHARX Series

A low privileged remote attacker can use a command injection vulnerability in the API which performs remote code execution as the user-app user due to improper input validation. The confidentiality is partly affected...

CVE-2024-28135

CVE-2024-28135 affects Phoenix Contact CHARX SEC-3100 devices. The vulnerability is a command injection in the API that allows remote code execution as the user-app user due to improper input validation. Impact is described as partial confidentiality loss; root cause is input validation failures ...

TOTOLINK CPE CP450 安全漏洞

TOTOLINK CP450 is a wireless bridge from China Gion Electronics TOTOLINK. The TOTOLINK CP450 suffers from a buffer overflow vulnerability that stems from the addWlProfileClientMode method failing to correctly validate the length size of the input data, no details of the vulnerability are provided...

Adobe Reader < 20.005.30635 / 24.002.20759 Multiple Vulnerabilities (APSB24-29) (macOS)

The version of Adobe Reader installed on the remote macOS host is a version prior to 20.005.30635 or 24.002.20759. It is, therefore, affected by multiple vulnerabilities. - Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by a Use After Free vulnerability that could...

Adobe Acrobat < 20.005.30635 / 24.002.20759 Multiple Vulnerabilities (APSB24-29) (macOS)

The version of Adobe Acrobat installed on the remote macOS host is a version prior to 20.005.30635 or 24.002.20759. It is, therefore, affected by multiple vulnerabilities. - Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by a Use After Free vulnerability that could...

Adobe Acrobat < 20.005.30635 / 24.002.20759 Multiple Vulnerabilities (APSB24-29)

The version of Adobe Acrobat installed on the remote Windows host is a version prior to 20.005.30635 or 24.002.20759. It is, therefore, affected by multiple vulnerabilities. - Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by a Use After Free vulnerability that could...

Adobe Reader < 20.005.30635 / 24.002.20759 Multiple Vulnerabilities (APSB24-29)

The version of Adobe Reader installed on the remote Windows host is a version prior to 20.005.30635 or 24.002.20759. It is, therefore, affected by multiple vulnerabilities. - Acrobat Reader versions 20.005.30574, 24.002.20736 and earlier are affected by a Use After Free vulnerability that could...

Siemens SIMATIC RTLS Locating Manager

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...

Siemens RUGGEDCOM APE1808

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...

Intel® TDX Module Software Advisory

Summary: Potential security vulnerabilities in some Intel® Trust Domain Extensions TDX module software may allow escalation of privilege. Intel is releasing firmware updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2023-45745 Description: Improper input...

RHEL 7 : dovecot (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - dovecot: IMAP hibernation function allows mail access CVE-2020-24386 - dovecot: Privilege escalation when...

RHEL 5 : cpio (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - cpio: improper input validation when writing tar header fields leads to unexpected tar generation...

RHEL 8 : libarchive (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - libarchive: Improper input validation in WARC parser resulting in a denial of service CVE-2018-1000880 -...

RHEL 6 : cpio (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - cpio: improper input validation when writing tar header fields leads to unexpected tar generation...

RHEL 7 : tomcat (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - tomcat: Information Disclosure when using VirtualDirContext CVE-2017-12616 - tomcat: HTTP request smuggli...