110 matches found
node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS
Summary A process-global nonce cache with no eviction policy allows an unauthenticated remote attacker to exhaust server heap memory by repeatedly opening sessions, causing the node-opcua server process to crash. Affected versions: = 2.165.0 Tested version: 2.165.0 CVSS Score: 7.5 High CVSS Vecto...
GHSA-6WVW-VRW4-363W node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS
Summary A process-global nonce cache with no eviction policy allows an unauthenticated remote attacker to exhaust server heap memory by repeatedly opening sessions, causing the node-opcua server process to crash. Affected versions: = 2.165.0 Tested version: 2.165.0 CVSS Score: 7.5 High CVSS Vecto...
node-opcua missing nonce verification in UserNameIdentityToken authentication
Summary A missing nonce verification in the UserNameIdentityToken authentication handler allows an unauthenticated remote attacker to forge a password token that extracts as an empty string, and to replay captured authentication tokens across sessions. Affected versions: = 2.165.0 Tested version:...
CVE-2026-58080
In Eclipse Milo versions 1.0.0 through 1.1.4, OpcUaServerConfig.copy fails to preserve a configured RoleMapper. On servers that rely on role permissions and construct the running configuration through copy, sessions receive no role IDs and the default access controller skips role-permission check...
PYSEC-2026-888 Uncontrolled Resource Consumption in asyncua and opcua
All versions of package opcua; all versions of package asyncua are vulnerable to Denial of Service DoS due to a missing limitation on the number of received chunks - per single session or in total for all concurrent sessions. An attacker can exploit this vulnerability by sending an unlimited numb...
CVE-2025-11482
The vulnerability CVE-2025-11482 concerns the OPC-UA Server component used in PPT30. An unauthenticated, network-based attacker can exploit an Allocation of Resources Without Limits or Throttling vulnerability on affected systems running operating system versions before 1.8.0, potentially renderi...
EUVD-2019-9400
Malware in sbrugna...
EUVD-2009-3224
Malware in sbrugna...
EUVD-2022-6517
Malicious code in bioql PyPI...
EUVD-2022-6567
Malicious code in bioql PyPI...
EUVD-2022-6584
Malicious code in bioql PyPI...
EUVD-2022-6631
Malicious code in bioql PyPI...
EUVD-2024-53528
Malicious code in bioql PyPI...
EUVD-2022-6479
Malicious code in bioql PyPI...
EUVD-2022-6609
Malicious code in bioql PyPI...
CVE-2019-19802
In Gallagher Command Centre Server v8.10 prior to v8.10.1134MR4, v8.00 prior to v8.00.1161MR5, v7.90 prior to v7.90.991MR5, v7.80 prior to v7.80.960MR2 and v7.70 or earlier, an authenticated user connecting to OPCUA can view all data that would be replicated in a multi-server setup without...
CVE-2024-57086
A prototype pollution in the function fieldsToJson of node-opcua-alarm-condition v2.134.0 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...
node-opcua-alarm-condition prototype pollution vulnerability
A prototype pollution in the function fieldsToJson of node-opcua-alarm-condition v2.134.0 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...
GHSA-GVWQ-6FMX-28XM node-opcua-alarm-condition prototype pollution vulnerability
A prototype pollution in the function fieldsToJson of node-opcua-alarm-condition v2.134.0 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...