1178 matches found
I Can'T Patch My OT Systems! a Look at CISA'S KEVC Workarounds and Mitigations for OT
We examine the state of publicly available information about known exploitable vulnerabilities applicable to operational technology OT environments. Specifically, we analyze the Known Exploitable Vulnerabilities Catalog KEVC maintained by the US Department of Homeland Security Cybersecurity and...
EUVD-2023-29157
Malicious code in bioql PyPI...
EUVD-2024-0267
Malicious code in bioql PyPI...
EUVD-2024-29676
Malicious code in bioql PyPI...
EUVD-2024-36080
Malicious code in bioql PyPI...
GE Reason S20 Ethernet Switch Improper Neutralization of Input During Web Page Generation (CVE-2020-16246)
The affected Reason S20 Ethernet Switch is vulnerable to cross-site scripting XSS, which may allow attackers to trick users into following a link or navigating to a page that posts a malicious JavaScript statement to the vulnerable site, causing the malicious JavaScript to be rendered by the site...
GE Reason S20 Ethernet Switch Improper Neutralization of Input During Web Page Generation (CVE-2020-16242)
The affected Reason S20 Ethernet Switch is vulnerable to cross-site scripting XSS, which may allow an attacker to trick application users into performing critical application actions that include, but are not limited to, adding and updating accounts. This plugin only works with Tenable.ot. Please...
GE UR family Improper Input Validation (CVE-2021-27420)
GE UR firmware versions prior to version 8.1x web server task does not properly handle receipt of unsupported HTTP verbs, resulting in the web server becoming temporarily unresponsive after receiving a series of unsupported HTTP requests. When unresponsive, the web server is inaccessible. By...
Ruckus Wireless ICX Switches Cross-site Scripting and Cross-site Request Forgery (CVE-2023-39904)
A vulnerability in the web-based management interface of the RUCKUS ICX product line could allow a remote attacker to execute XSS and CSRF attacks against the user of the interface. To exploit this vulnerability, an attacker would require the targeted user to click a crafted link that would send ...
Ruckus Wireless ICX Switches Cross-site Scripting and Cross-site Request Forgery (CVE-2023-39906)
A vulnerability in the web-based management interface of the RUCKUS ICX product line could allow a remote attacker to execute XSS and CSRF attacks against the user of the interface. To exploit this vulnerability, an attacker would require the targeted user to click a crafted link that would send ...
Rockwell Automation 1756-EN4TR, 1756-EN4TRXT Improper Input Validation (CVE-2025-8007)
A security issue exists in the protected mode of 1756-EN4TR and 1756-EN2TR communication modules, where a Concurrent Forward Close operation can trigger a Major Non-Recoverable MNFR fault. This condition may lead to unexpected system crashes and loss of device availability. This plugin only works...
Rockwell Automation Stratix Managed Switches Cross-site Request Forgery to Code Execution (CVE-2025-7350)
A security issue affecting multiple Cisco devices also directly impacts Stratix 5410, 5700, and 8000 devices. This can lead to remote code execution by uploading and running malicious configurations without authentication. This plugin only works with Tenable.ot. Please visit...
Wago CODESYS V2 Web-Server Unchecked Return Value (CVE-2021-34585)
In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests can trigger a parser error. Since the parser result is not checked under all conditions, a pointer dereference with an invalid address can occur. This leads to a denial of service situation. This plugin only works with...
Wago CODESYS V2 Web-Server Improper Access Control (CVE-2021-30190)
CODESYS V2 Web-Server before 1.1.9.20 has Improper Access Control. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid503320; scriptversion"1.3";...
Wago CODESYS V2 Web-Server Improperly Implemented Security Check (CVE-2021-30192)
CODESYS V2 Web-Server before 1.1.9.20 has an Improperly Implemented Security Check. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid503316;...
Wago CODESYS V2 Web-Server Out-of-bounds Read (CVE-2021-30194)
CODESYS V2 Web-Server before 1.1.9.20 has an Out-of-bounds Read. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid503315; scriptversion"1.2";...
Wago CODESYS V2 Runtime Toolkit Improper Restriction of Operations within the Bounds of a Memory Buffer (CVE-2021-34595)
A crafted request with invalid offsets may cause an out-of-bounds read or write access in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resulting in a denial-of-service condition or local memory overwrite. This plugin only works with Tenable.ot. Please visit...
Malicious code in ot-eda-messages (npm)
The package ot-eda-messages was found to contain malicious code...
