PLC Fastwel Arbitrary Command Privilege Escalation

The vulnerability of the built-in software of the PLC Fastwel is related to the use of dangerous methods or functions. Exploiting this vulnerability allows a remote attacker to execute arbitrary operating system commands and elevate their privileges to that of a superuser by sending a POST reques...

CSRF vulnerability in favorite-view

favorite-view 5.v77a37f62782d and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to add or remove views from another user's favorite views tab bar. As of publication of this advisory,...

FreeTAKServer 访问控制错误漏洞

FreeTAKServer is an open source lightweight server from the FreeTAKTeam team. It is used to connect to TAK clients. FreeTAKServer suffers from an access control error vulnerability, which stems from the fact that Endpoint/ManageRoute/postRoute can be accessed without authentication, and can be...