Siemens SICAM P850 and SICAM P855 Devices Cross-Site Scripting Vulnerability

The SICAM P850 Multifunctional Measurement Device is used to collect, visualize, evaluate and transmit electrical measurement variables such as AC current, AC voltage, frequency, power, harmonics, etc. The SICAM P855 Multifunctional Device is used to collect, display and transmit measured...

Security Bulletin: This Power System update is being released to address CVE 2021-29847

Summary POWER8: In response to a security issue with BMC's configuration, a new Power System firmware update is being released to address Common Vulnerabilities and Exposures issue number CVE 2019-29847. Vulnerability Details CVEID:CVE-2021-29847 DESCRIPTION: BMC firmware configuration changed to...

Eaton Intelligent Power Manager Cross-Site Script Vulnerability

Eaton Intelligent Power Manager IPM is an intelligent power manager from Eaton Corporation that supports remote monitoring and management of multiple devices in a network from an interface. A cross-site scripting vulnerability exists in Eaton Intelligent Power Manager that stems from insufficient...

Eaton Intelligent Power Manager Infrastructure

1. EXECUTIVE SUMMARY CVSS v3 5.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: Eaton Equipment: Intelligent Power Manager Infrastructure Vulnerabilities: Cross-site Scripting, Reflected Cross-site Scripting, Improper Neutralization of Formula in a CSV File 2. RISK EVALUATION...

PT-2022-3426 · Eaton · Eaton Intelligent Power Manager

Name of the Vulnerable Software and Affected Versions: Eaton Intelligent Power Manager IPM versions prior to 1.70 Description: The issue exists due to insufficient validation of input from certain resources by the IPM software, leading to stored Cross site scripting. An attacker would need access...

Missing check in the updateValset function

Lines of code Vulnerability details Impact The updateValset function don't check that the sum of the powers of the new validators in the new valset is greater than the threshold, which can lead to unwanted behavior. There are 2 main problems that can occur in that situation: 1. The sum of the new...

Voting power of new validators not checked in updateValset function, Gravity.sol

Lines of code Gravity.solL276-L358 Vulnerability details Impact While the voting power of the current valset is checked when the checkValidatorSignatures function is called in updateValset, the power of the new valset is not. This could cause some functions to not work since whenever...

it's possible that validators don't have enough power

Lines of code Vulnerability details newValset parameter in updateValset can have validators that don't have enough power combined for passing the threshold. Recomendation mitigation steps check that the validators power combined is bigger than the threshold --- The text was updated successfully,...

Missing powerThreshold validation in function updateValset(in Gravity.sol) could cause the contract non-functional

Lines of code Vulnerability details Impact When the cumulative power of validators in newValset is less than or equal to statepowerThreshold, the checkValidatorSignatures function would fail. Eventually, submitBatch, submitLogicCall & updateValset would fail for the new set of validators. This wi...

No cumulative power check when updating valset

Lines of code Vulnerability details Impact When batches are submitted by validators in the current valset, they are checked for validity based on signatures and cumulative powers. Each validator in the valset has an associated power which can give certain validators more voting power than others...

updateValset() Insufficient validation of new validator set may brick the contract

Lines of code Vulnerability details In Gravity.solupdateValset, while the signatures of the current validators are verified and = powerThreshold is checked, there is one important validation should be done: check the cumulative power of the new validator set to ensure the contract has sufficient...

python: urllib: HTTP client possible infinite loop on a 100 Continue response

A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability...

One of the Most Powerful DDoS Attacks Ever Hits a Crypto Platform

The onslaught was delivered through HTTPS, which puts more strain on a target, and it suggests that attackers are getting more powerful...

IBM Java 7.0 < 7.0.10.70 / 7.1 < 7.1.4.70 / 8.0 < 8.0.6.15

The version of IBM Java installed on the remote host is prior to 7.0 7.0.10.70 / 7.1 7.1.4.70 / 8.0 8.0.6.15. It is, therefore, affected by a vulnerability as referenced in the IBM Security Update August 2020 advisory. - In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the...

prod.genuinepower.online Cross Site Scripting vulnerability OBB-2554534

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Invision Power Board Code Execution

The vulnerability in the “applications/core/modules/front/system/content.php” component of the Invision Power Board software, which is a PHP programming language interpreter, relates to insecure privilege management. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

GSD-2022-1002498 power: supply: wm8350-power: Add missing free in free_charger_irq

power: supply: wm8350-power: Add missing free in freechargerirq This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.311 by commit...

GSD-2022-1002491 PM: core: keep irq flags in device_pm_check_callbacks()

PM: core: keep irq flags in devicepmcheckcallbacks This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.311 by commit...

GSD-2022-1002439 power: supply: ab8500: Fix memory leak in ab8500_fg_sysfs_init

power: supply: ab8500: Fix memory leak in ab8500fgsysfsinit This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.276 by commit...

GSD-2022-1002435 power: supply: wm8350-power: Add missing free in free_charger_irq

power: supply: wm8350-power: Add missing free in freechargerirq This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.276 by commit...