CVE-2023-22805: Improper Access Control

LS ELECTRIC XBC-DN32U with operating system version 01.80 has improper access control to its read prohibition feature. This could allow a remote attacker to remotely set the feature to lock users out of reading data from the device...

CVE-2023-22806: Cleartext Transmission of Sensitive Information

LS ELECTRIC XBC-DN32U with operating system version 01.80 transmits sensitive information in cleartext when communicating over its XGT protocol. This could allow an attacker to gain sensitive information such as user credentials...

CVE-2023-0102: Missing Authentication for Critical Function

LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication for its deletion command. This could allow an attacker to delete arbitrary files...

LS ELECTRIC XBC-DN32U 访问控制错误漏洞

The LS ELECTRIC XBC-DN32U is a PLC programmable logic controller from LS ELECTRIC in Korea. An information disclosure vulnerability exists in the LS ELECTRIC XBC-DN32U version 01.80, which originates when the device transmits sensitive information in clear text when communicating via the XGT...

CVE-2023-0103: Access of Memory Location After End of Buffer

If an attacker were to access memory locations of LS ELECTRIC XBC-DN32U with operating system version 01.80 that are outside of the communication buffer, the device stops operating. This could allow an attacker to cause a denial-of-service condition...

PT-2023-6658

Name of the Vulnerable Software and Affected Versions LS ELECTRIC XBC-DN32U version 01.80 Description The issue is related to the absence of authentication for a critical function in the programmable logic controller's software. This could allow a remote attacker to elevate their privileges and...

CVE-2023-22803: Missing Authentication for Critical Function

LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication to perform critical functions to the PLC. This could allow an attacker to change the PLC's mode arbitrarily...

CVE-2023-22804: Missing Authentication for Critical Function

LS ELECTRIC XBC-DN32U with operating system version 01.80 is missing authentication to create users on the PLC. This could allow an attacker to create and use an account with elevated privileges and take control of the device...

CVE-2023-22807: Improper Access Control

LS ELECTRIC XBC-DN32U with operating system version 01.80 does not properly control access to the PLC over its internal XGT protocol. An attacker could control and tamper with the PLC by sending the packets to the PLC over its XGT protocol...

LS ELECTRIC XBC-DN32U 访问控制错误漏洞

The LS ELECTRIC XBC-DN32U is a PLC programmable logic controller from LS ELECTRIC in Korea. An Access Control Error vulnerability exists in the LS ELECTRIC XBC-DN32U version 01.80, which stems from a lack of authentication of the PLC's created user, and can be exploited by an attacker to create a...

PT-2023-2043

Name of the Vulnerable Software and Affected Versions LS ELECTRIC XBC-DN32U version 01.80 Description The issue is related to inadequate access control to the PLC over its internal XGT protocol. An attacker could potentially control and tamper with the PLC by sending specially crafted packets to...

LS ELECTRIC XBC-DN32U 访问控制错误漏洞

The LS ELECTRIC XBC-DN32U is a PLC programmable logic controller from LS ELECTRIC in Korea. An Access Control Error vulnerability exists in the LS ELECTRIC XBC-DN32U version 01.80. The vulnerability stems from the device's inability to properly control access to the PLC via its internal XGT...

PT-2023-18707 · Ls Electric · Ls Electric Xbc-Dn32U

Name of the Vulnerable Software and Affected Versions: LS ELECTRIC XBC-DN32U version 01.80 Description: The issue is related to the transmission of sensitive information in cleartext when the device communicates over its XGT protocol. This could allow an attacker to gain sensitive information, su...

PT-2023-6657 · Ls Electric · Xbc-Dn32U

Name of the Vulnerable Software and Affected Versions: LS ELECTRIC XBC-DN32U version 01.80 Description: The issue is caused by a buffer overflow in the memory of the programmable logic controller. If an attacker accesses memory locations outside of the communication buffer, the device stops...

CISA Releases Six Industrial Control Systems Advisories

CISA released six Industrial Control Systems ICS advisories on February 9, 2023. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. CISA encourages users and administrators to review the newly released ICS advisories for...

PT-2023-3369 · Ls Electric · Ls Electric Xbc-Dn32U

Name of the Vulnerable Software and Affected Versions: LS ELECTRIC XBC-DN32U version 01.80 Description: The issue is related to the lack of authentication for a critical function in the LS ELECTRIC XBC-DN32U, specifically its deletion command. This could allow an attacker to delete arbitrary file...

LS ELECTRIC XBC-DN32U

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: LS ELECTRIC, LS Industrial Systems LSIS Co. Ltd Equipment: XBC-DN32U Vulnerabilities: Missing Authentication for Critical Function, Improper Access Control, Cleartext Transmission of Sensitive...

GHSA-PFPR-3463-C6JH ruby-git has potential remote code execution vulnerability

The git gem, between versions 1.2.0 and 1.12.0, incorrectly parsed the output of the git ls-files command using eval to unescape quoted file names. If a file name was added to the git repository contained special characters, such as \n, then the git ls-files command would print the file name in...

Potential remote code execution in ruby-git

The git gem, between versions 1.2.0 and 1.12.0, incorrectly parsed the output of the 'git ls-files' command using eval to unescape quoted file names. If a file name was added to the git repository contained special characters, such as '\n', then the 'git ls-files' command would print the file nam...

CVE-2022-41830

Stored cross-site scripting vulnerability in Kyocera Document Solutions MFPs and printers allows a remote authenticated attacker with an administrative privilege to inject arbitrary script. Affected products/versions are as follows: TASKalfa 7550ci/6550ci, TASKalfa 5550ci/4550ci/3550ci/3050ci,...