PT-2023-2217 · Cisco · Cisco Ios Xe Sd-Wan +1

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE SD-WAN Software affected versions not specified Description: The issue is due to insufficient input validation by the system CLI, allowing an authenticated, local attacker to execute arbitrary commands with elevated privileges. A...

PT-2023-2105 · Cisco · Cisco Sd-Wan Vmanage

Name of the Vulnerable Software and Affected Versions: Cisco SD-WAN vManage Software affected versions not specified Description: A vulnerability in the web-based management interface could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affecte...

USN-5915-1 linux-oem-6.1 vulnerabilities

It was discovered that the Upper Level Protocol ULP subsystem in the Linux kernel did not properly handle sockets entering the LISTEN state in certain protocols, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service system crash or possibly execut...

HPESBNW04454 rev.5 - HPE Aruba Networking Controller and Gateway-Based AOS Multiple Vulnerabilities

Potential Security Impact: Local: Cross-Site Scripting XSS; Remote: Arbitrary Code Execution, Arbitrary Command Execution, Arbitrary File Deletion, Disclosure of Sensitive Information, Unauthorized Arbitrary Command Execution, Buffer Overflow, Session Reuse SUPPORTED SOFTWARE VERSIONS: ONLY...

The vulnerability of the delivery interface component in NetScaler SD-WAN and Citrix SD-WAN software management tools allows attackers to enhance their privileges.

The vulnerability of the delivery interface component in NetScaler SD-WAN and Citrix SD-WAN software management tools is related to insufficient cleaning of input data. Exploiting this vulnerability can allow an attacker to enhance their privileges remotely...

SUSE CVE-2013-4537

The ssisdtransfer function in hw/sd/ssi-sd.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary code via a crafted arglen value in a savevm image...

SUSE CVE-2017-5667

The sdhcisdmatransfermultiblocks function in hw/sd/sdhci.c in QEMU aka Quick Emulator allows local guest OS privileged users to cause a denial of service out-of-bounds heap access and crash or execute arbitrary code on the QEMU host via vectors involving the data transfer length...

SUSE CVE-2019-6454

An issue was discovered in sd-bus in systemd 239. busprocessobject in libsystemd/sd-bus/bus-objects.c allocates a variable-length stack buffer for temporarily storing the object path of incoming D-Bus messages. An unprivileged local user can exploit this by sending a specially crafted message to...

SUSE CVE-2022-3872

An off-by-one read/write issue was found in the SDHCI device of QEMU. It occurs when reading/writing the Buffer Data Port Register in sdhcireaddataport and sdhciwritedataport, respectively, if datacount == blocksize. A malicious guest could use this flaw to crash the QEMU process on the host,...

SUSE CVE-2022-20008

In mmcblkreadsingle of block.c, there is a possible way to read kernel heap memory due to uninitialized data. This could lead to local information disclosure if reading from an SD card that triggers errors, with no additional execution privileges needed. User interaction is not needed for...

The vulnerability of the microprogramming software of Mitsubishi MELFA series SD/SQ and F industrial robots lies in the insufficient protection of operational data during code debugging. This allows attackers to circumvent security restrictions and gain unauthorized access to protected information.

The vulnerability of the microprogrammed software in Mitsubishi MELFA industrial robots of the SD/SQ and F series is related to insufficient protection of operational data during code debugging. Exploiting this vulnerability allows an attacker to bypass security restrictions and gain unauthorized...

CVE-2022-33323

CVE-2022-33323 affects Mitsubishi Electric MELFA MELFA SD/SQ and F-Series robot controllers. Root cause: active debug code enables an authentication bypass allowing a remote, unauthenticated telnet login to gain unauthorized access. Affected firmware versions include S7x/R7x and prior; fixes are ...

CVE-2022-33323 Authentication Bypass Vulnerability in Robot Controller of MELFA SD/SQ series and F-series

Active Debug Code vulnerability in robot controller of Mitsubishi Electric Corporation industrial robot MELFA SD/SQ Series and MELFA F-Series allows a remote unauthenticated attacker to gain unauthorized access by authentication bypass through an unauthorized telnet login. As for the affected mod...

PT-2023-1355 · Mitsubishi · Melfa Sd/Sq Series +1

Name of the Vulnerable Software and Affected Versions: Mitsubishi Electric Corporation industrial robot MELFA SD/SQ Series and MELFA F-Series affected versions not specified Description: The issue concerns a remote unauthenticated attacker gaining unauthorized access through an unauthorized telne...

PHOENIX CONTACT PLCNext AXC F 2152 Channel Accessible By Non-Endpoint (CVE-2019-10997)

An issue was discovered on Phoenix Contact AXC F 2152 No.2404267 before 2019.0 LTS and AXC F 2152 STARTERKIT No.1046568 before 2019.0 LTS devices. Protocol Fuzzing on PC WORX Engineer by a man in the middle attacker stops the PLC service. The device must be rebooted, or the PLC service must be...

PHOENIX CONTACT PLCNext AXC F 2152 Improper Access Control (CVE-2019-10998)

An issue was discovered on Phoenix Contact AXC F 2152 No.2404267 before 2019.0 LTS and AXC F 2152 STARTERKIT No.1046568 before 2019.0 LTS devices. Unlimited physical access to the PLC may lead to a manipulation of SD cards data. SD card manipulation may lead to an authentication bypass opportunit...

CVE-2022-24118

Certain General Electric Renewable Energy products allow attackers to use a code to trigger a reboot into the factory default configuration. This affects iNET and iNET II before 8.3.0, SD before 6.4.7, TD220X before 2.0.16, and TD220MAX before 1.2.6...

Design/Logic Flaw

Certain General Electric Renewable Energy products download firmware without an integrity check. This affects iNET and iNET II before 8.3.0, SD before 6.4.7, TD220X before 2.0.16, and TD220MAX before 1.2.6...

Default configuration

Certain General Electric Renewable Energy products allow attackers to use a code to trigger a reboot into the factory default configuration. This affects iNET and iNET II before 8.3.0, SD before 6.4.7, TD220X before 2.0.16, and TD220MAX before 1.2.6...

The vulnerability of the command-line interface of microprogramming software for Cisco SD-WAN vBond Orchestrator, Cisco SD-WAN vEdge Cloud Routers, Cisco SD-WAN vEdge Routers, Cisco SD-WAN vSmart Controller, and the centralized network management system Cisco SD-WAN vManage arises from incorrect path name restrictions related to restricted access directories. This vulnerability allows attackers to create or re-record critical files.

The vulnerability of the command-line interface of microprogramming software for Cisco SD-WAN vBond Orchestrator, Cisco SD-WAN vEdge Cloud Routers, Cisco SD-WAN vEdge Routers, Cisco SD-WAN vSmart Controller, and the centralized network management system Cisco SD-WAN vManage is related to an...