CVE-2023-28895 Hard-coded password for access to power controller chip memory

The password for access to the debugging console of the PoWer Controller chip PWC of the MIB3 infotainment is hard-coded in the firmware. The console allows attackers with physical access to the MIB3 unit to gain full control over the PWC chip. Vulnerability found on Škoda Superb III 3V3 - 2.0 TD...

CVE-2023-28895

The CVE-2023-28895 entry concerns Škoda MIB3 infotainment’s PoWer Controller (PWC) with a hard-coded password in the firmware. This allows an attacker with physical access to gain full control of the PWC chip on Škoda Superb III (3V3) 2.0 TDI (2022). Connected documents confirm the hardware/softw...

CVE-2023-36857

Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a replay vulnerability which could allow an attacker to replay older captured packets of traffic to the device to gain access...

CVE-2023-36857

CVE-2023-36857 affects Baker Hughes Bently Nevada 3500 System TDI Firmware version 5.05. The vulnerability is an authentication bypass by capture-replay: the device can accept out-of-sequence messages from older communications, allowing an attacker to replay captured traffic to gain access. Impac...

CVE-2023-34437 Baker Hughes Bently Nevada 3500 System Incorrect Permission Assignment for Critical Resource

Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a vulnerability in their password retrieval functionality which could allow an attacker to access passwords stored on the device...

CVE-2023-34437

CVE-2023-34437 affects Baker Hughes Bently Nevada 3500 System TDI Firmware 5.05. The vulnerability is in the password retrieval functionality and could allow an attacker to access passwords stored on the device. The NVD and CISA-ICS advisories identify the affected appliance as the Bently Nevada ...

CVE-2023-34441

The CVE-2023-34441 vulnerability affects Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05. It involves cleartext transmission of authentication secrets used with the device, allowing an attacker to steal the authentication secret from communication traffic and reuse it for arbit...

CVE-2023-34441 Baker Hughes Bently Nevada 3500 System Cleartext Transmission of Sensitive Information

Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a cleartext transmission vulnerability which could allow an attacker to steal the authentication secret from communication traffic to the device and reuse it for arbitrary requests...

CVE-2023-34441 Baker Hughes Bently Nevada 3500 System Cleartext Transmission of Sensitive Information

Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a cleartext transmission vulnerability which could allow an attacker to steal the authentication secret from communication traffic to the device and reuse it for arbitrary requests...

CVE-2022-29952

Bently Nevada condition monitoring equipment through 2022-04-29 mishandles authentication. It utilizes the TDI command and data protocols 60005/TCP, 60007/TCP for communications between the monitoring controller and System 1 and/or Bently Nevada Monitor Configuration BNMC software. These protocol...

CVE-2022-29952

CVE-2022-29952 affects Bently Nevada condition monitoring equipment (e.g., 3701/4X, 60M100) and relates to missing authentication for the TDI command/data protocols on ports 60005/TCP and 60007/TCP. Public documentation confirms that these protocols provide configuration management and historical...

CVE-2022-29952

Bently Nevada condition monitoring equipment through 2022-04-29 mishandles authentication. It utilizes the TDI command and data protocols 60005/TCP, 60007/TCP for communications between the monitoring controller and System 1 and/or Bently Nevada Monitor Configuration BNMC software. These protocol...

Security Bulletin: There are multiple vulnerabilities in IBM Runtime Environment Java Technology Edition Version 7.0 and Version 8.0 that is used by Security Directory Integrator. These issues were disclosed as part of the IBM Java SDK updates in Jul 2019

Summary There are multiple vulnerabilities in IBM Runtime Environment Java Technology Edition Version 7.0 and Version 8.0 that is used by Security Directory Integrator. These issues were disclosed as part of the IBM Java SDK updates in Jul 2019 Vulnerability Details CVE-2019-4473 Description On t...

tdi-north.com XSS vulnerability

Open Bug Bounty ID: OBB-672009 Description| Value ---|--- Affected Website:| tdi-north.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

tdi-north.com XSS vulnerability

Open Bug Bounty ID: OBB-656926 Description| Value ---|--- Affected Website:| tdi-north.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

AVG Internet Security 2013.x < 2013.3495 / 2015.x < 2015.5557 Local Privilege Escalation

The remote Windows host has a version of AVG Internet Security installed that is 2013.x prior to 2013.3495 or 2015.x prior to 2015.5557. It is, therefore, affected by a local privilege escalation vulnerability due to a flaw in the TDI driver avgtdix.sys that occurs when handling 0x830020f8 IOCTL...

Memory corruption

The TDI driver avgtdix.sys in AVG Internet Security before 2013.3495 Hot Fix 18 and 2015.x before 2015.5315 and Protection before 2015.5315 allows local users to write to arbitrary memory locations, and consequently gain privileges, via a crafted 0x830020f8 IOCTL call...

CVE-2014-9632

The TDI driver avgtdix.sys in AVG Internet Security before 2013.3495 Hot Fix 18 and 2015.x before 2015.5315 and Protection before 2015.5315 allows local users to write to arbitrary memory locations, and consequently gain privileges, via a crafted 0x830020f8 IOCTL call...

CVE-2014-9632

The CVE-2014-9632 entry affects AVG Internet Security/Protection: the TDI driver avgtdix.sys allows local privilege escalation by writing to arbitrary memory via a crafted 0x830020f8 IOCTL. Affected: AVG Internet Security 2013.x before 2013.3495 Hot Fix 18 and 2015.x before 2015.5315, Protection ...

CVE-2014-9632

The TDI driver avgtdix.sys in AVG Internet Security before 2013.3495 Hot Fix 18 and 2015.x before 2015.5315 and Protection before 2015.5315 allows local users to write to arbitrary memory locations, and consequently gain privileges, via a crafted 0x830020f8 IOCTL call...