CVE-2024-2427

A denial-of-service vulnerability exists in the Rockwell Automation PowerFlex® 527 due to improper traffic throttling in the device. If multiple data packets are sent to the device repeatedly the device will crash and require a manual restart to recover...

CVE-2024-2425

A denial-of-service vulnerability exists in the Rockwell Automation PowerFlex® 527 due to improper input validation in the device. If exploited, the web server will crash and need a manual restart to recover it...

CVE-2024-2426

A denial-of-service vulnerability exists in the Rockwell Automation PowerFlex® 527 due to improper input validation in the device. If exploited, a disruption in the CIP communication will occur and a manual restart will be required by the user to recover it...

CVE-2024-2426

A denial-of-service vulnerability exists in the Rockwell Automation PowerFlex® 527 due to improper input validation in the device. If exploited, a disruption in the CIP communication will occur and a manual restart will be required by the user to recover it...

CVE-2024-2427

CVE-2024-2427 pertains to the Rockwell Automation PowerFlex 527, a configurable AC drive. The reported issue is a denial-of-service caused by improper traffic throttling: if multiple data packets are sent to the device, it can crash and require a manual restart. Connected documents provide concre...

CVE-2024-2426

The CVE-2024-2426 entry concerns Rockwell Automation PowerFlex 527, affecting versions v2.001.x and later. The vulnerability is an improper input validation in the device that can cause a denial-of-service by disrupting CIP communication, potentially requiring a manual restart to recover. The iss...

CVE-2024-2425

Summary (CVE-2024-2425) Rockwell Automation PowerFlex 527 is affected by a denial-of-service vulnerability due to improper input validation (CWE-120). Affected product: PowerFlex 527, versions v2.001.x and later. Impact: remote DoS causing the web server to crash and require a manual restart; hig...

Rockwell Automation PowerFlex 安全漏洞

The Rockwell Automation PowerFlex 527 is an adjustable AC frequency converter from Rockwell Automation. The Rockwell Automation PowerFlex 527 has an input validation error vulnerability that can be exploited by an attacker to cause CIP communication to be interrupted, requiring a manual restart...

PT-2024-2448 · Rockwell Automation · Powerflex 527

Name of the Vulnerable Software and Affected Versions: Rockwell Automation PowerFlex 527 affected versions not specified Description: A denial-of-service issue exists due to improper input validation in the device. If exploited, it can cause a disruption in the CIP communication, requiring a manu...

PT-2024-11204 · Unknown · Net::Ipaddress::Util

Name of the Vulnerable Software and Affected Versions: Net::IPAddress::Util versions prior to 5.000 Description: The issue arises from the Net::IPAddress::Util module not properly handling extraneous zero characters in IP address strings. This can lead to attackers bypassing access control based ...

CVE-2024-27307

JSONata is a JSON query and transformation language. Starting in version 1.4.0 and prior to version 1.8.7 and 2.0.4, a malicious expression can use the transform operator to override properties on the Object constructor and prototype. This may lead to denial of service, remote code execution or...

BIT-AIRFLOW-2022-40189 Apache Airlfow Pig Provider RCE

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache Airflow Pig Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue affects Pig Provider...

BIT-ARGO-CD-2023-40029

Argo CD is a declarative continuous deployment for Kubernetes. Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. As a result, the full secret body is stored inkubectl.kubernetes.io/last-applied-configuration annotation. pull request 7139 introduced the ability ...

CVE-2024-1936

The encrypted subject of an email message could be incorrectly and permanently assigned to an arbitrary other email message in Thunderbird's local cache. Consequently, when replying to the contaminated email message, the user might accidentally leak the confidential subject to a third-party. Whil...

Cannot Create Catalog from Azure VM with Trusted Launch Enabled

Error Attempting to create a catalog using an Azure Trusted Launch enabled image results in the following error: "CreateTerminatingError in operation PreparingMasterImage with message Error starting machine. Security type of VM is not compatible with the security type of attached OS Disk." Soluti...

GHSA-PCFX-G2J2-F6F6 Docassemble HTML and javascript injection

Impact A user could type HTML into a field, including the field for the user's name, and then that HTML could be displayed on the screen as HTML. The HTML can also contain tags allowing JavaScript to execute on the page. Patches The vulnerability has been patched in version 1.4.97 of the master...

GHSA-7WXF-R2QV-9XWR Docassemble open redirect

Impact It is possible to create a URL that acts as an open redirect. Patches The vulnerability has been patched in version 1.4.97 of the master branch. The Docker image on docker.io has been patched. Workarounds If upgrading is not possible, manually apply the changes of 4801ac7 and restart the...

Docassemble open redirect

Impact It is possible to create a URL that acts as an open redirect. Patches The vulnerability has been patched in version 1.4.97 of the master branch. The Docker image on docker.io has been patched. Workarounds If upgrading is not possible, manually apply the changes of 4801ac7 and restart the...

GHSA-JQ57-3W7P-VWVV Docassemble unauthorized access through URL manipulation

Impact The vulnerability allows attackers to gain unauthorized access to information on the system through URL manipulation. It affects versions 1.4.53 to 1.4.96. Patches The vulnerability has been patched in version 1.4.97 of the master branch. The Docker image on docker.io has been patched...

MGASA-2024-0052 Updated sympa packages fix security vulnerabilities

Sympa 6.2.72 fixes many bugs, including the security one related in CVE-2021-32850 It is required to manually run sympa upgrade after get this update...