K000134781: Multiple Intel Server Board BMC vulnerabilities

Security Advisory Description CVE-2023-22661 Buffer overflow in some IntelR Server Board BMC firmware before version 2.90 may allow a privileged user to enable escalation of privilege via local access. CVE-2023-22297 Access of memory location after end of buffer in some IntelR Server Board BMC...

Rockwell ArmorStart Improper Input Validation (CVE-2023-29027)

A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious user with admin privileges and network access to view user data and modify the web interface. Additionally, a malicious user could potentially cause...

Rockwell ArmorStart Improper Input Validation (CVE-2023-29028)

A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious user with admin privileges and network access to view user data and modify the web interface. Additionally, a malicious user could potentially cause...

Rockwell ArmorStart Improper Input Validation (CVE-2023-29022)

A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious user with admin privileges and network access to view user data and modify the web interface. Additionally, a malicious user could potentially cause...

(Pwn2Own) Lexmark MC3224i snmpUTIL Improper Input Validation Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lexmark MC3224i printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the snmpUTIL binary. The issue results from the lack of proper...

Snap One OvrC Cloud (Update A)

1. EXECUTIVE SUMMARY CVSS v3 8.6 ATTENTION: Exploitable remotely/low attack complexity Vendor: Snap One Equipment: OvrC Cloud, OvrC Pro Devices Vulnerabilities: Improper Input Validation, Observable Response Discrepancy, Improper Access Control, Cleartext Transmission of Sensitive Information,...

CVE-2023-20721

In isp, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07162155; Issue ID: ALPS07162155...

Design/Logic Flaw

In m4u, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07771518; Issue ID: ALPS07680084...

GHSA-8J28-34QQ-GMCH Apache Sling Commons JSON bundle vulnerable to Improper Input Validation

Improper input validation in the Apache Sling Commons JSON bundle allows an attacker to trigger unexpected errors by supplying specially-crafted input. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. The org.apache.sling.commons.json bundle has been...

CVE-2022-47937

Improper input validation in the Apache Sling Commons JSON bundle allows an attacker to trigger unexpected errors by supplying specially-crafted input. The org.apache.sling.commons.json bundle has been deprecated as of March 2017 and should not be used anymore. Consumers are encouraged to conside...

CVE-2022-22508

Improper Input Validation vulnerability in multiple CODESYS V3 products allows an authenticated remote attacker to block consecutive logins of a specific type...

CVE-2022-47378

Multiple CODESYS products in multiple versions are prone to a improper input validation vulnerability. An authenticated remote attacker may craft specific requests that use the vulnerability leading to a denial-of-service condition...

CVE-2022-47392 CODESYS: Multiple products prone to Improper Input Validation

An authenticated, remote attacker may use a improper input validation vulnerability in the CmpApp/CmpAppBP/CmpAppForce Components of multiple CODESYS products in multiple versions to read from an invalid address which can lead to a denial-of-service condition...

CVE-2022-47391 CODESYS: Multiple products prone to Improper Input Validation

In multiple CODESYS products in multiple versions an unauthorized, remote attacker may use a improper input validation vulnerability to read from invalid addresses leading to a denial of service...

CVE-2022-47378

CVE-2022-47378 affects CODESYS V3 across multiple versions and is due to improper input validation in the communication stack. After successful authentication, specially crafted requests can cause the CmpFiletransfer component to read from an invalid address, potentially leading to a denial-of-se...

CVE-2022-47378 CODESYS: Multiple products prone to Improper Input Validation

Multiple CODESYS products in multiple versions are prone to a improper input validation vulnerability. An authenticated remote attacker may craft specific requests that use the vulnerability leading to a denial-of-service condition...

CVE-2022-22508 CODESYS V3: Improper Input Validation

Improper Input Validation vulnerability in multiple CODESYS V3 products allows an authenticated remote attacker to block consecutive logins of a specific type...

CVE-2022-22508

CVE-2022-22508 affects multiple CODESYS V3 products; root cause is improper input validation. An authenticated remote attacker can block consecutive logins of a specific type (impact is availability loss). The exact affected products, versions, exploit details, and remediation are not specified i...

CVE-2023-26125

A flaw was found in Gin-Gonic Gin. This flaw allows a remote attacker to bypass security restrictions caused by improper input validation. An attacker can perform cache poisoning attacks by sending a specially-crafted request using the X-Forwarded-Prefix header. Mitigation Mitigation for this iss...

CVE-2023-20722

CVE-2023-20722 affects the m4u component with an out-of-bounds write caused by improper input validation. This can lead to local privilege escalation requiring System execution privileges, with no user interaction needed. A patch is available (Patch ID: ALPS07771518; Issue ID: ALPS07680084). Conn...