PT-2021-29388

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.128 Description A memory leak issue exists in the ip mc add1 src function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to v5.4.128,...

CVE-2020-15782

CVE-2020-15782 covers Siemens SIMATIC S7-1200/1500 CPUs and related devices (including ET 200SP Open Controller, S7-PLCSIM Advanced, SINAMICS GH180, SINUMERIK MC/ONE, and S7-1500 Software Controller) with a memory protection bypass via a specific operation. A remote, unauthenticated attacker can ...

CVE-2020-15782: Improper Restriction of Operations within the Bounds of a Memory Buffer

A vulnerability has been identified in SIMATIC Drive Controller family All versions V2.9.2, SIMATIC ET 200SP Open Controller CPU 1515SP PC incl. SIPLUS variants All versions, SIMATIC ET 200SP Open Controller CPU 1515SP PC2 incl. SIPLUS variants All versions V21.9, SIMATIC S7-1200 CPU family incl...

MiniCMS 跨站脚本漏洞

MiniCMS is a content management system CMS designed for personal websites. A security vulnerability exists in MiniCMS v1.10 that allows remote attackers to execute arbitrary code by sending a crafted HTTP request injection command to the component "mc-admin post-edit.php"...

PT-2021-10115

Name of the Vulnerable Software and Affected Versions: MiniCMS version 1.10 Description: The issue allows remote attackers to execute arbitrary code by injecting commands via a crafted HTTP request to the "/mc-admin/post-edit.php" API endpoint. This is a result of a Cross Site Scripting XSS flaw...

CVE-2020-17999: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS in MiniCMS v1.10 allows remote attackers to execute arbitrary code by injecting commands via a crafted HTTP request to the component "/mc-admin/post-edit.php"...

Apache Tomcat Vulnerabilities May 2020 - Mar 2021

Summary Symantec Network and Information Security NIS products using affected versions of Apache Tomcat may be susceptible to multiple vulnerabilities. A remote attacker may be able to execute arbitrary code on the target server, observe HTTP responses for other users' requests, obtain JSP source...

OpenSSL Vulnerabilities Sep 2020 - Feb 2021

Summary Symantec Network and Information Security NIS products using affected versions of OpenSSL may be susceptible to multiple vulnerabilities. A remote attacker may be able to decrypt encrypted communication from an SSL/TLS connection, downgrade a newly established SSL/TLS connection to SSLv2,...

Authorization Bypass

github.com/minio/minio is vulnerable to authorization bypass. PostPolicyHandler did not verify user policies and allows an attacker to bypass the readOnly policy by creating a temporary mc share upload URL...

CVE-2021-21362

MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service. In MinIO before version RELEASE.2021-03-04T00-53-13Z it is possible to bypass a readOnly policy by creating a temporary 'mc share upload' URL. Everyone is impacted who us...

CVE-2021-21362: Improper Authorization

MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service. In MinIO before version RELEASE.2021-03-04T00-53-13Z it is possible to bypass a readOnly policy by creating a temporary 'mc share upload' URL. Everyone is impacted who us...

PT-2021-28134

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-buffer-overflow read error. Technical details include a crash type of Heap-buffer-overflow READ 2, and the crash state...

PT-2021-28129

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow READ 1 crash has been reported. The crash involves the put epel 8 fallback and acceleration functions::put hevc epel functions, as...

Under Construction, Coming Soon & Maintenance Mode < 1.1.2 - Server Side Request Forgery (SSRF)

The includes/mc-getlists.php file used the 'apiKey' POST parameter to create an https URL from it without sanitisation and called it with cURL, leading to a SSRF issue. The issue is exploitable via direct access to the affected file, and ucmmmcapi AJAX call available to both authenticated and...

OSV-2018-85 Heap-buffer-overflow in put_8tap_scaled_c

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11378 Crash type: Heap-buffer-overflow READ 2 Crash state: put8tapscaledc put8tapsharpscaledc mc...

PT-2021-27637

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow READ 2 crash has been reported, involving functions such as put 8tap scaled c, put 8tap sharp scaled c, and mc. No information is...

PT-2020-17005

Name of the Vulnerable Software and Affected Versions MantisBT version 2.24.3 Description The issue is related to SQL Injection that can occur in the access parameter of the mc project get users function through the API SOAP. Recommendations For MantisBT version 2.24.3, consider disabling the mc...

mc-metrocontrol.com Cross Site Scripting vulnerability OBB-1432888

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

mc-lohnmontagen.de Cross Site Scripting vulnerability OBB-1431633

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Vulnerability of software packages for supervisory control and data collection: MC Works64/MC Works32, FrameWorX server, centralized configuration environment for HMI-/SCADA applications: Workbench, software platform: Platform Services, application for organization of API exchange: GenBroker64/GenBroker32. This vulnerability is related to deficiencies in the deserialization mechanism, allowing a intruder to trigger a service failure.

The vulnerabilities of the software packages for supervisory control and data collection MC Works64/MC Works32, the FrameWorX server, the centralized configuration environment for HMI-/SCADA applications, the Platform Services software platform, and the GenBroker64/GenBroker32 application for...