CVE-2020-28213

A CWE-494: Download of Code Without Integrity Check vulnerability exists in PLC Simulator on EcoStruxureª Control Expert now Unity Pro all versions that could cause unauthorized command execution when sending specially crafted requests over Modbus...

CVE-2020-28212

A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists in PLC Simulator on EcoStruxureª Control Expert now Unity Pro all versions that could cause unauthorized command execution when a brute force attack is done over Modbus...

CVE-2020-28212

CVE-2020-28212 describes an authentication- bypass risk in EcoStruxure Control Expert PLC Simulator (Unity Pro) via brute-forcing Modbus sessions. Root cause: CWE-307 improper restriction of excessive authentication attempts, enabling a remote attacker to gain unauthorized command execution with ...

PT-2020-6317 · Schneider Electric · Ecostruxure Control Expert

Name of the Vulnerable Software and Affected Versions: EcoStruxure Control Expert all versions Description: The issue is related to the lack of restrictions on authentication attempts, which could allow a remote attacker to bypass the authentication procedure. This vulnerability may lead to...

CVE-2020-12776

CVE-2020-12776 affects Openfind Mail2000 and is described as a Broken Access Control vulnerability that can enable unauthorized command execution after an attacker obtains an administrator access token or cookie. The available documents provide a high-severity impact (CVE is associated with high ...

Design/Logic Flaw

An issue was discovered in RiteCMS 2.2.1. An authenticated user can directly execute system commands by uploading a php web shell in the "Filemanager" section...

OpenClinic GA Authorization Issue Vulnerability (CNVD-2021-17438)

OpenClinic GA is an open source hospital information management system. The system supports financial management, clinical management and laboratory management and other functions. An authorization issue vulnerability exists in OpenClinic GA versions 5.09.02 and 5.89.05b, which can be exploited b...

Security Bulletin: A vulnerability has been identified in IBM Spectrum Scale GUI where an unauthorised user can execute commands (CVE-2020-4348)

Summary A security vulnerability has been identified in all levels of IBM Spectrum Scale GUI that could allow an unauthorised user to execute commands . A fix for this vulnerability is available. Vulnerability Details CVEID: CVE-2020-4348 DESCRIPTION: IBM Spectrum Scale could allow an authenticat...

IBM Security Identity Governance and Intelligence Input Validation Error Vulnerability

IBM Security Identity Governance and Intelligence IGI is a suite of identity governance solutions from IBM in the United States. The product includes features such as lifecycle management, access risk assessment and identity management. An input validation error vulnerability exists in IBM Securi...

SUSE-SU-2020:1392-1 Security update for salt

This update for salt fixes the following issues: Security issues fixed: - CVE-2020-11651: Fixed the improper validation of method calls in salt-master, that could have allowed unauthenticated remote users to run arbitrary commands on salt minions bsc1170595. - CVE-2020-11652: Fixed an improper pa...

SAP Adaptive Server Enterprise SQL Injection Vulnerability (CNVD-2020-29750)

SAP Adaptive Server Enterprise is a relational database server from SAP. A SQL injection vulnerability exists in SAP Adaptive Server Enterprise. An attacker could exploit this vulnerability by executing specially crafted query statements to elevate privileges, modify database objects, or execute...

CyberArk PSMP 10.9.1 - Policy Restriction Bypass

Exploit Title: CyberArk PSMP 10.9.1 - Policy Restriction Bypass Google Dork: NA Date: 2020-02-25 Exploit Author: LAHBAL Said Vendor Homepage: https://www.cyberark.com/ Software Link: https://www.cyberark.com/ Version: PSMP = 11.1 Prerequisites Policy allows us to overwrite PSMRemoteMachine...

Command Execution Vulnerability in Marlboze/Marlboze-w30 Series Cameras at Shenzhen Anjubao Electronics Co.

Marbleizer camera software enables all kinds of hardware alarm effects, so that you can enjoy a real-time home monitoring experience, so that you can easily understand all the situations in the family. Shenzhen Anjubao Electronics Co., Ltd Marlboze/Marlboze-w30 series cameras have a command...

ASUS ZenFone 4 Selfie Access Control Error Vulnerability (CNVD-2020-14737)

The ASUS ZenFone 4 Selfie is a smartphone from Asus ASUS of Taiwan, China. An access control error vulnerability exists in ASUS ZenFone 4 Selfie. The vulnerability arises from a network system or product that does not properly restrict access to resources from unauthorized roles. An attacker coul...

ASUS ZenFone Max 4 Access Control Error Vulnerability (CNVD-2020-14732)

The ASUS ZenFone Max 4 is a smartphone from Asus ASUS of Taiwan, China. An access control error vulnerability exists in the ASUS ZenFone Max 4. The vulnerability arises from a network system or product that does not properly restrict access to resources from unauthorized roles. An attacker could...

ASUS ZenFone 3 Laser Access Control Error Vulnerability

The ASUS ZenFone 3 Laser is a smartphone from Asus ASUS of Taiwan, China. An access control error vulnerability exists in ASUS ZenFone 3 Laser. The vulnerability arises from a network system or product that does not properly restrict access to resources from unauthorized roles. An attacker could...

ASUS ZenFone 4 Selfie Access Control Error Vulnerability (CNVD-2020-14727)

The ASUS ZenFone 4 Selfie is a smartphone from Asus ASUS of Taiwan, China. An access control error vulnerability exists in ASUS ZenFone 4 Selfie. The vulnerability arises from a network system or product that does not properly restrict access to resources from unauthorized roles. An attacker coul...

ASUS ZenFone 5Q Access Control Error Vulnerability (CNVD-2020-14785)

The ASUS ZenFone 5Q is a smartphone from Asus ASUS of Taiwan, China. An access control error vulnerability exists in the ASUS ZenFone 5Q. The vulnerability arises from a network system or product that does not properly restrict access to resources from unauthorized roles. An attacker could exploi...

Unspecified Vulnerability in ASUS ASUS_X015_1

The ASUS ASUSX0151 is a smartphone from Asus ASUS of Taiwan, China. Asus ASUSX0151 build fingerprint: asus/CNX015/ASUSX0151:7.0/NRD90M/CNX015-14.00.1709.35-20171215:user/release-keys has a security vulnerability in the com. A security vulnerability exists in the lovelyfont.defcontainer app. An...

CVE-2019-15418

The Asus ASUSX00K1 Android device with a build fingerprint of asus/CNX00K/ASUSX00K1:7.0/NRD90M/CNX00K-14.01.1711.27-20180420:user/release-keys contains a pre-installed app with a package name of com.lovelyfont.defcontainer app versionCode=5, versionName=5.0.1 that allows unauthorized command...