PT-2024-15711 · Unknown · C21 Live Encoder/Live Mosaic

Name of the Vulnerable Software and Affected Versions: C21 Live Encoder and Live Mosaic version 5.3 Description: The issue is related to inadequate access control, allowing a remote attacker to access the application as an administrator user due to lack of proper credential management. This can b...

CVE-2023-6448

Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system...

Devellion CubeCart Security Breach

Devellion CubeCart is a free and open source e-commerce shopping cart software from the company of Devellion UK. The software supports selling products, adding/editing products or images in an online store, etc. A security vulnerability exists in Devellion CubeCart versions prior to 6.5.3, which...

Nokia G-040W-Q Security Vulnerability

Nokia G-040W-Q is a modem from Nokia of Finland. A security vulnerability exists in Nokia G-040W-Q, which arises from insufficient filtering of user input. A remote attacker with administrator privileges can use this vulnerability to conduct a command injection attack to execute arbitrary command...

CVE-2023-4089

On affected Wago products an remote attacker with administrative privileges can access files to which he has already access to through an undocumented local file inclusion. This access is logged in a different log file than expected...

PT-2023-6373 · Wago · Wago

Name of the Vulnerable Software and Affected Versions: Wago products affected versions not specified Description: The issue allows a remote attacker with administrative privileges to access files through an undocumented local file inclusion. This access is logged in a different log file than...

PT-2023-21064 · Netapp · Snapcenter

Name of the Vulnerable Software and Affected Versions: SnapCenter versions 4.8 through 4.9 Description: The issue allows an authenticated SnapCenter Server user to potentially become an admin user on a remote system where a SnapCenter plug-in has been installed. Recommendations: For SnapCenter...

PT-2023-5067 · Microsoft · Azure Kubernetes Service

Name of the Vulnerable Software and Affected Versions: Microsoft Azure Kubernetes Service affected versions not specified Description: The issue is related to insufficient access controls in the Microsoft Azure Kubernetes Service, which can be exploited by a remote attacker to elevate their...

Tinycontrol LAN Controller 3 Remote Admin Password Change Exploit

!/bin/bash : " Tinycontrol LAN Controller v3 LK3 Remote Admin Password Change Vendor: Tinycontrol Product web page: https://www.tinycontrol.pl Affected version: this with a calendar when - then. The device provides a user interface in the form of a web page. The website presents readings of vario...

Tinycontrol LAN Controller 3 Remote Admin Password Change

!/bin/bash : " Tinycontrol LAN Controller v3 LK3 Remote Admin Password Change Vendor: Tinycontrol Product web page: https://www.tinycontrol.pl Affected version: this with a calendar when - then. The device provides a user interface in the form of a web page. The website presents readings of vario...

Tinycontrol LAN Controller v3 (LK3) Remote Admin Password Change

Summary Lan Controller is a very universal device that allows you to connect many different sensors and remotely view their readings and remotely control various types of outputs. It is also possible to combine both functions into an automatic if - this with a calendar when - then. The device...

PT-2023-7056 · Technicolor · Technicolor Tg670

Name of the Vulnerable Software and Affected Versions: Technicolor TG670 version 10.5.N.9 Description: The issue concerns the presence of multiple accounts with hard-coded passwords in the Technicolor TG670 device. One of these accounts has administrative privileges, which can allow for...

Loxone Miniserver 操作系统命令注入漏洞

Loxone Miniserver is a server from Loxone, Inc. that automates equipment in buildings, houses, and homes to provide energy management, monitoring, and other functions. A security vulnerability exists in Loxone Miniserver Go Gen.2 versions prior to 14.1.5.9, which stems from a websocket...

CVE-2023-0971

A logic error in SiLabs Z/IP Gateway SDK 7.18.02 and earlier allows authentication to be bypassed, remote administration of Z-Wave controllers, and S0/S2 encryption keys to be recovered...

Authentication flaw

A logic error in SiLabs Z/IP Gateway SDK 7.18.02 and earlier allows authentication to be bypassed, remote administration of Z-Wave controllers, and S0/S2 encryption keys to be recovered...

ASUS RT-AC86U 缓冲区错误漏洞

The ASUS RT-AC86U is a dual-band Wi-Fi router from the Chinese company ASUS. The ASUS RT-AC86U suffers from a buffer overflow vulnerability that originates from a boundary error when handling untrusted input, which can be exploited by a remote attacker with administrator privileges to execute...

CVE-2023-27512

Use of hard-coded credentials exists in SolarView Compact SV-CPT-MC310 versions prior to Ver.8.10, and SV-CPT-MC310F versions prior to Ver.8.10, which may allow a remote authenticated attacker to login the affected product with an administrative privilege and perform an unintended operation...

Contec SolarView Compact 信任管理问题漏洞

Contec SolarView Compact is an application system from Contec Japan. It provides measurement system for photovoltaic power generation. A security vulnerability exists in the Contec SolarView Compact SV-CPT-MC310 Ver.8.10 prior and SV-CPT-MC310F Ver.8.10 prior, which stems from the presence of...

Stored Cross-Site Scripting (XSS)

backdrop/backdrop is vulnerable to Stored Cross-Site Scripting XSS attacks. A remote admin authenticated attacker is able to inject arbitrary web scripts or HTML through the name argument in Text Editors and Formats, modifying any sort of material, which allows the stored XSS payload to be execut...

Multiple vulnerabilities in SolarView Compact

Overview SolarView Compact provided by CONTEC CO.,LTD. contains multiple vulnerabilities listed below. Use of hard-coded credentials CWE-798 - CVE-2023-27512 OS command injection in the download page CWE-78 - CVE-2023-27514 Buffer overflow in the multiple setting pages CWE-120 - CVE-2023-27518 OS...