58 matches found
Multiple Siemens products open to redirection vulnerabilities
Siemens Desigo PX is a building automation control system from Siemens Germany. Several Siemens products have an open redirection vulnerability, which stems from the fact that the device's embedded browser does not prevent interaction with an alternate URI scheme when the Web application code...
Fuji Electric D300win
1. EXECUTIVE SUMMARY CVSS v3 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: Fuji Electric Equipment: D300win Vulnerabilities: Out-of-bounds Read, Write-what-where Condition 2. RISK EVALUATION Successful exploitation of these vulnerabilities could result in loss of sensitive...
CISA offers guidance on dealing with information manipulation
Malicious actors use influence operations, like spreading false information, to shape public opinion, undermine trust, amplify division, and create dissension. In response, the Cybersecurity & Infrastructure Security Agency CISA has released CISA Insights: Preparing for and Mitigating Foreign...
U.S. Cybersecurity Agency Publishes List of Free Security Tools and Services
The U.S. Cybersecurity and Infrastructure Security Agency CISA on Friday published a repository of free tools and services to enable organizations to mitigate, detect, and respond effectively to malicious attacks and further improve their security posture. The "Free Cybersecurity Services and...
CISA Insights: Foreign Influence Operations Targeting Critical Infrastructure
CISA has released CISA Insights: Preparing for and Mitigating Foreign Influence Operations Targeting Critical Infrastructure, which provides proactive steps organizations can take to assess and mitigate risks from information manipulation. Malicious actors may use tactics—such as misinformation,...
CVE-2021-30171
CVE-2021-30171 affects Jun-He Technology / Junghwa ERP POS: special characters on the ERP POS news page are not filtered, allowing remote authenticated attackers to inject JavaScript and perform stored XSS, with potential access to and manipulation of customer information. Root cause: unfiltered ...
Unauthorized Access Vulnerability in Jingtao Backend Management System
Jingtao is a backend management system. There is an unauthorized access vulnerability in the background management system of Jingtao, which can be exploited by an attacker to arbitrarily add and query website product information and add management to website content...
Sql injection
IBM Maximo Asset Management 7.6.1.1 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 170961...
CVE-2020-9468
The Community plugin 2.9.e-beta for Piwigo allows users to set image information on images in albums for which they do not have permission, by manipulating the imageid parameter...
CVE-2019-6521
WebAccess/SCADA, Version 8.3. Specially crafted requests could allow a possible authentication bypass that could allow an attacker to obtain and manipulate sensitive information...
Beckhoff Embedded PC Images and TwinCAT Components Vulnerabilities
OVERVIEW Gregor Bonney from FH Aachen University of Applied Sciences has identified vulnerabilities in Beckhoff’s Embedded PC Images and TwinCAT Components. He published them and reported them to Beckhoff afterward. In 2014, Beckhoff produced a new build and security advisories with instructions ...
CVE-2006-0787
CVE-2006-0787 affects Plaino Wimpy MP3 Player (likely
[SA18792] PHP Event Calendar User Information Manipulation
TITLE: PHP Event Calendar User Information Manipulation SECUNIA ADVISORY ID: SA18792 VERIFY ADVISORY: http://secunia.com/advisories/18792/ CRITICAL: Less critical IMPACT: Cross Site Scripting, Manipulation of data WHERE: From remote SOFTWARE: PHP Event Calendar 1.x http://secunia.com/product/7964...
[SA12439] TorrentTrader "id" SQL Injection Vulnerability
TITLE: TorrentTrader "id" SQL Injection Vulnerability SECUNIA ADVISORY ID: SA12439 VERIFY ADVISORY: http://secunia.com/advisories/12439/ CRITICAL: Moderately critical IMPACT: Exposure of system information, Exposure of sensitive information, Manipulation of data WHERE: From remote SOFTWARE:...
Apache 2.0.4x mod_php - File Descriptor Leakage (1)
// source: https://www.securityfocus.com/bid/9302/info Reportedly, the Apache modphp module may be prone to a vulnerability that may allow a local attacker to gain access to privileged file descriptors. As a result, the attacker may pose as a legitimate server and possibly steal or manipulate...
Apache 2.0.4x mod_php - File Descriptor Leakage (2)
// source: https://www.securityfocus.com/bid/9302/info Reportedly, the Apache modphp module may be prone to a vulnerability that may allow a local attacker to gain access to privileged file descriptors. As a result, the attacker may pose as a legitimate server and possibly steal or manipulate...
CVE-2000-0123
CVE-2000-0123 describes a vulnerability in the Filemaker shopping cart application where remote attackers can alter sensitive purchase information by manipulating hidden form fields. The available sources confirm the issue exists in the shopping cart component shipped with Filemaker, enabling inf...