PT-2022-20960 · Dataprobe · Dataprobe Iboot Pdu

Name of the Vulnerable Software and Affected Versions: Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 Description: The affected product allows an attacker to access the device's main management page from the cloud. This feature enables users to remotely connect devices, however, the curre...

PT-2022-20963 · Dataprobe · Dataprobe Iboot Pdu

Name of the Vulnerable Software and Affected Versions: Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 Description: The issue arises from certain PHP pages only validating when a valid connection is established with the database, but not verifying the validity of a user. This lack of...

PT-2022-25074 · Samsung · Exynos Modem

Name of the Vulnerable Software and Affected Versions: Exynos modems versions prior to SMR Sep-2022 Release Description: The issue is related to an improper input validation vulnerability for processing SIB12 PDU in Exynos modems. This allows a remote attacker to read out of bounds memory...

PT-2022-4840 · Dataprobe · Dataprobe Iboot Pdu

Name of the Vulnerable Software and Affected Versions: Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 Description: The issue is related to the device's existing firmware, which allows unauthenticated users to access an old PHP page vulnerable to directory traversal. This may enable a user...

Dataprobe iBoot-PDU 路径遍历漏洞

The Dataprobe iBoot-PDU is a web-accessible managed PDU independently controlled outlet from Dataprobe USA. A path traversal vulnerability exists in the Dataprobe iBoot-PDU FW that stems from its firmware allowing unauthenticated users to access old PHP pages susceptible to directory traversal,...

Dataprobe iBoot-PDU 信息泄露漏洞

The Dataprobe iBoot-PDU is a web-accessible managed PDU independently controlled outlet from Dataprobe USA. An information disclosure vulnerability exists in the Dataprobe iBoot-PDU FW, which stems from the possibility that an attacker could gain access to sensitive data of the exposed device...

Dataprobe iBoot-PDU 安全漏洞

The Dataprobe iBoot-PDU is a web-accessible managed PDU independently controlled outlet from Dataprobe USA. A security vulnerability exists in the Dataprobe iBoot-PDU FW that stems from allowing an attacker to access the device's main management page from the cloud. This feature allows a user to...

Dataprobe iBoot-PDU 代码问题漏洞

The Dataprobe iBoot-PDU is a web-accessible managed PDU independently controlled outlet from Dataprobe USA. A code issue vulnerability exists in the Dataprobe iBoot-PDU FW that stems from the fact that an attacker can create URLs capable of changing host parameters via a carefully crafted PHP...

Dataprobe iBoot-PDU 操作系统命令注入漏洞

The Dataprobe iBoot-PDU is a web-accessible managed PDU independently controlled outlet from Dataprobe USA. The Dataprobe iBoot-PDU FW suffers from an operating system command injection vulnerability that stems from the fact that certain specific functions do not sanitize user-supplied input, whi...

PT-2022-4839 · Dataprobe · Iboot-Pdu

Name of the Vulnerable Software and Affected Versions: Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 Description: The issue is related to a vulnerability in the web interface of the iBoot-PDU managed power distribution unit, which is associated with the possibility of command injection...

CISA Releases Eight industrial Control Systems Advisories

CISA has released eight 8 Industrial Control Systems ICS advisories on September 20, 2022. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. CISA encourages users and administrators to review the newly released ICS advisories...

Espressif ESP-IDF Memory Corruption Vulnerability

Espressif ESP-IDF is an IoT development framework from China Lexin Information Technology Espressif.A memory corruption vulnerability exists in Espressif ESP-IDF, which stems from not checking the SegN field of the Transaction Start PDU, and can be exploited by an attacker during configuration to...

CVE-2022-24893 Espressif Bluetooth Mesh Stack Vulnerable to Out-of-bounds Write leading to memory buffer corruption

ESP-IDF is the official development framework for Espressif SoCs. In Espressif’s Bluetooth Mesh SDK ESP-BLE-MESH, a memory corruption vulnerability can be triggered during provisioning, because there is no check for the SegN field of the Transaction Start PDU. This can result in memory corruption...

CVE-2022-20198

In llcpdlcprocconnectpdu of llcpdlc.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure from the NFC stack with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

Powertek PDU Buffer Overflow Vulnerability

Powertek is a company that manufactures data center-grade intelligent PDUs Power Distribution Units, i.e., heavy-duty power strips for server racks. The Powertek PDUs suffer from a buffer overflow vulnerability that can be exploited by an attacker to cause disclosure of the active session id of t...

Cross site scripting

A CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists which could cause arbritrary script execution when a malicious file is read and displayed. Affected Products: 1-Phase Uninterruptible Power Supply UPS using NMC2 including Smart-UPS,...

CVE-2021-22814

A CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists which could cause arbritrary script execution when a malicious file is read and displayed. Affected Products: 1-Phase Uninterruptible Power Supply UPS using NMC2 including Smart-UPS,...

CVE-2021-22814

CVE-2021-22814 describes a Cross-site Scripting (CWE-79) vulnerability in Schneider Electric NMC embedded devices (NMC2 and NMC3) that can cause arbitrary script execution when a malicious file is read and displayed. Affected products span multiple Schneider Electric lines: 1-phase and 3-phase UP...

CVE-2021-22813

A CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists that could cause arbritrary script execution when a privileged account clicks on a malicious URL specifically crafted for the NMC pointing to an edit policy file. Affected Products:...

CVE-2021-22811

A CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists that could cause script execution when the request of a privileged account accessing the vulnerable web page is intercepted. Affected Products: 1-Phase Uninterruptible Power Supply UP...