HP Integrated Lights-Out Improper Input Validation (CVE-2022-28633)

A local disclosure of sensitive information and a local unauthorized data modification vulnerability were discovered in HPE Integrated Lights-Out 5 iLO 5 firmware versions: Prior to 2.71. An unprivileged user could locally exploit this vulnerability to read and write to the iLO 5 firmware file...

Generex UPS Adapter CS141 Improper Input Validation (CVE-2022-47189)

Generex UPS CS141 below 2.06 version, allows an attacker toupload a firmware file containing an incorrect configuration, in order to disrupt the normal functionality of the device. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more informatio...

Siemens SIMATIC S7-1500 Improper Input Validation (CVE-2023-52675)

In the Linux kernel, the following vulnerability has been resolved: powerpc/imc-pmu: Add a null pointer check in updateeventsingroup kasprintf returns a pointer to dynamically allocated memory which can be NULL upon failure. This plugin only works with Tenable.ot. Please visit...

HP Integrated Lights-Out Improper Input Validation (CVE-2016-4375)

Multiple unspecified vulnerabilities in HPE Integrated Lights-Out 3 aka iLO 3 firmware before 1.88, Integrated Lights-Out 4 aka iLO 4 firmware before 2.44, and Integrated Lights-Out 4 aka iLO 4 mRCA firmware before 2.32 allow remote attackers to obtain sensitive information, modify data, or cause...

Siemens SIMATIC S7-1500 Improper Input Validation (CVE-2025-21758)

ipv6: mcast: add RCU protection to mldnewpack mldnewpack can be called without RTNL or RCU being held. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description...

HP Integrated Lights-Out Improper Input Validation (CVE-2022-28630)

A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 iLO 5 firmware versions: Prior to 2.71. An unprivileged user could locally exploit this vulnerability to execute arbitrary code resulting in a complete loss of confidentiality and integrity, and a partial...

Siemens SIMATIC S7-1500 Improper Input Validation (CVE-2020-12062)

The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious unprivileged user on the remote server to overwrite arbitrary files in the client's download directory by creating a crafted subdirectory anywhere on the...

Siemens SIMATIC S7-1500 Improper Input Validation (CVE-2025-21724)

iommufd/iovabitmap: Fix shift-out-of-bounds in iovabitmapoffsettoindex. Resolve a UBSAN shift-out-of-bounds issue in iovabitmapoffsettoindex where shifting the constant 1 of type int by bitmap-mapped.pgshift an unsigned long value could result in undefined behavior. The constant 1 defaults to a...

HP Integrated Lights-Out Improper Neutralization of Input During Web Page Generation (CVE-2021-29209)

"A remote dom xss, crlf injection vulnerability was discovered in HPE Integrated Lights-Out 4 iLO 4 %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid504390; scriptversion"1.1"; scriptsetattributeattribute:"pluginmodificationdate", value:"2025/11/13";...

Siemens SIMATIC and SCALANCE Improper Input Validation (CVE-2025-3360)

Describe what is the vulnerability about, e.g.: Affected devices do not properly validate input in the hack-me endpoint of the web service. 2. Describe what an attacker could do with it - e.g.: This could allow an unauthenticated remote attacker to execute arbitrary code on the device. This...

CVE-2025-12942

Improper Input Validation vulnerability in NETGEAR R6260 and NETGEAR R6850 allows unauthenticated attackers connected to LAN with ability to perform MiTM attacks and control over DNS Server to perform command execution.This issue affects R6260: through 1.1.0.86; R6850: through 1.1.0.86...

Improper Input Validation

github.com/kcp-dev/kcp is vulnerable to improper input validation. The vulnerability is due to missing UPDATE validation in the initializingworkspaces virtual workspace, which allows an attacker with access to run arbitrary patches on the status field of LogicalCluster objects...

CVE-2025-11962

CVE-2025-11962 is a Stored XSS in DivvyDrive Information Technologies’ Digital Corporate Warehouse (pre-4.8.2.22). The issue arises from improper input neutralization during web page generation, enabling stored cross-site scripting. Affected software: Digital Corporate Warehouse versions before 4...

CVE-2025-11962 Stored XSS in DivvyDrive Information Technologies' Digital Corporate Warehouse

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in DivvyDrive Information Technologies Inc. Digital Corporate Warehouse allows Stored XSS. This issue affects Digital Corporate Warehouse: before v.4.8.2.22...

DivvyDrive Digital Corporate Warehouse 跨站脚本漏洞

DivvyDrive Digital Corporate Warehouse is a file management platform from the Turkish company DivvyDrive. A cross-site scripting vulnerability exists in versions prior to DivvyDrive Digital Corporate Warehouse v.4.8.2.22, which stems from improper input neutralization during web page generation a...

EUVD-2025-93530

Improper input validation for some Intel VTune Profiler before version 2025.1 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable data manipulation. This result may...

EUVD-2025-93538

Improper input validation in NETGEAR DGN2200v4 N300 Wireless ADSL2+ Modem Router allows attackers with direct network access to the device to potentially execute code on the device. Please check the firmware version and update to the latest. Fixed in: DGN2200v4 firmware 1.0.0.132 or later...

CVE-2025-23361

NVIDIA NeMo Framework for all platforms contains a vulnerability in a script, where malicious input created by an attacker may cause improper control of code generation. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and da...

CVE-2025-31948

Improper input validation for some IntelR oneAPI Math Kernel Library before version 2025.2 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may...

CVE-2025-30509

CVE-2025-30509 concerns Intel QuickAssist Technology (QAT) software on Windows, with versions before 2.6.0 affected. The root cause is improper input validation in Ring 3: User Applications, enabling privilege escalation. An authenticated local user with low attack complexity and no user interact...