3824 matches found
Siemens S7-1500 CPU devices
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...
PT-2025-54009
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.0.10-2 Description The Linux kernel contained a flaw within the btrfs subsystem related to handling device replacement during repair operations. Specifically, a bug report indicated a kernel panic BUG ON...
Mitsubishi Electric GX Works3 Access Control RCE
The vulnerability of the software access control mechanism for Mitsubishi Electric’s GX Works3 programming platform is related to the use of a strictly encrypted cryptographic key. Exploiting this vulnerability allows an attacker, operating remotely, to execute arbitrary code by replacing the...
AZL-38788 CVE-2022-43551 affecting package tensorflow for versions less than 2.16.1-1
A vulnerability exists in curl 7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypasse...
PT-2025-37581
Name of the Vulnerable Software and Affected Versions Linux kernel versions 6.1.0-rc8+ through 6.1.0-rc8+ 144 Description This issue involves a global out-of-bounds bug in the rtl8812ae phy set txpower limit function within the rtlwifi module. The root cause is an incorrect comparison order of...
AVEVA Edge InstallShield SCADA Code Execution
The vulnerability of the AVEVA Edge InstallShield SCADA system’s installation component is related to the possibility of replacing the dynamic library. Exploiting this vulnerability could allow a intruder to execute arbitrary code or enhance their privileges...
Description of the security update for SharePoint Server Subscription Edition: December 13, 2022 (KB5002327)
None None...
CVE-2022-41267: Unrestricted Upload of File with Dangerous Type
SAP Business Objects Platform - versions 420, and 430, allows an attacker with normal BI user privileges to upload/replace any file on Business Objects server at the operating system level, enabling the attacker to take full control of the system causing a high impact on confidentiality, integrit...
CVE-2022-40680
A improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiOS 6.0.7 - 6.0.15, 6.2.2 - 6.2.12, 6.4.0 - 6.4.9 and 7.0.0 - 7.0.3 allows a privileged attacker to execute unauthorized code or commands via storing malicious payloads in replacement messages...
Cross site scripting
A improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiOS 6.0.7 - 6.0.15, 6.2.2 - 6.2.12, 6.4.0 - 6.4.9 and 7.0.0 - 7.0.3 allows a privileged attacker to execute unauthorized code or commands via storing malicious payloads in replacement messages...
CVE-2022-40680
A improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiOS 6.0.7 - 6.0.15, 6.2.2 - 6.2.12, 6.4.0 - 6.4.9 and 7.0.0 - 7.0.3 allows a privileged attacker to execute unauthorized code or commands via storing malicious payloads in replacement messages...
CVE-2022-40680: Improper Neutralization of Input During Web Page Generation
A improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiOS 6.0.7 - 6.0.15, 6.2.2 - 6.2.12, 6.4.0 - 6.4.9 and 7.0.0 - 7.0.3 allows a privileged attacker to execute unauthorized code or commands via storing malicious payloads in replacement messages...
PT-2022-6108 · Fortinet · Fortios
Name of the Vulnerable Software and Affected Versions: Fortinet FortiOS versions 6.0.7 through 6.0.15 Fortinet FortiOS versions 6.2.2 through 6.2.12 Fortinet FortiOS versions 6.4.0 through 6.4.9 Fortinet FortiOS versions 7.0.0 through 7.0.3 Description: The issue is related to improper...
CVE-2022-3850 Find and Replace All <= 1.3 - Arbitrary Replacement via CSRF
The Find and Replace All WordPress plugin before 1.3 does not have CSRF check when replacing string, which could allow attackers to make a logged admin replace arbitrary string in database tables via a CSRF attack...
CVE-2022-3850: Undefined Security Weakness
The Find and Replace All WordPress plugin before 1.3 does not have CSRF check when replacing string, which could allow attackers to make a logged admin replace arbitrary string in database tables via a CSRF attack...
PT-2022-24430 · WordPress · Find/Replace All
Name of the Vulnerable Software and Affected Versions: Find and Replace All WordPress plugin versions prior to 1.3 Description: The issue is related to the lack of a CSRF check when replacing strings, which could allow attackers to make a logged admin replace arbitrary strings in database tables...
OPENSUSE-SU-2022:10219-1 Security update for opera
This update for opera fixes the following issues: Update to 93.0.4585.11 - CHR-9051 Update chromium on desktop-stable-107-4585 to 107.0.5304.88 - DNA-95965 Add support for more UD TLDs - DNA-102960 Replace messengers icons - DNA-102964 Crash at -FramedBrowserWindow sendEvent: - DNA-103125...
TaoSecurity on Mastodon
--- I am now using Mastodon as a replacement for the blue bird. This is my attempt to verify myself via my blog. I am no longer posting to my old bird account. Copyright 2003-2020 Richard Bejtlich and TaoSecurity taosecurity.blogspot.com and www.taosecurity.com...