The vulnerability of microprogramming software for controlling and monitoring air consumption in pneumatic systems such as Festo MSE6-C2M, MSE6-D2M, and MSE6-E2M allows a intruder to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of microprogramming software for controlling and monitoring air consumption in pneumatic systems such as Festo MSE6-C2M, MSE6-D2M, and MSE6-E2M is related to the presence of undocumented configuration commands. Exploiting this vulnerability could allow a malicious actor to...

Festo MSE6-C2M/D2M/E2M

SUMMARY Incomplete user documentation of undocumented, authenticated test mode and further remote accessible functions. The supported features may be covered only partly by the corresponding user documentation. Festo developed the products according to the respective state of the art. As a...

The vulnerability of the CE_A protocol implementation in the data collection and transmission device CE805M allows a hacker to modify the equipment settings.

The vulnerability of the CEA protocol implementation in the data collection and transmission device CE805M is related to an undocumented user account called SUPERVISOR. Exploiting this vulnerability could allow a malicious actor to remotely alter the equipment’s settings...

CVE-2023-36926

Due to missing authentication check in SAP Host Agent - version 7.22, an unauthenticated attacker can set an undocumented parameter to a particular compatibility value and in turn call read functions. This allows the attacker to gather some non-sensitive information about the server. There is no...

SAP Host Agent 授权问题漏洞

SAP Host Agent is a set of agent programs from SAP that supports a number of lifecycle management tasks such as operating system monitoring, database monitoring and system instance monitoring. An information disclosure vulnerability exists in SAP Host Agent that stems from a lack of authenticatio...

New P2PInfect Worm Targets Redis Servers with Undocumented Breach Methods

The P2PInfect peer-to-peer P2 worm has been observed employing previously undocumented initial access methods to breach susceptible Redis servers and rope them into a botnet. "The malware compromises exposed instances of the Redis data store by exploiting the replication feature," Cado Security...

KbDevice digital video recorders 安全漏洞

The KbDevice KB-AHR04D is an AHD hybrid recorder from KbDevice. A security vulnerability exists in KbDevice digital video recorders that stems from the fact that the product contains undocumented functionality that is not part of the specification and cannot be accessed through interfaces or...

Uniview IP Camera 安全漏洞

Uniview IP Camera is a camera from Uniview China. A security vulnerability exists in the Uniview IP Camera that originates from an undocumented UDP service on port 7788, which allows an unauthenticated attacker to cause an internal buffer overflow and enable code execution. Affected products and...

PYSEC-2023-79

Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, internal calls with default arguments are compiled incorrectly. Depending on the number of arguments provided in the call, the defaults are added not right-to-left, but left-to-right. If the type...

Design/Logic Flaw

Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, internal calls with default arguments are compiled incorrectly. Depending on the number of arguments provided in the call, the defaults are added not right-to-left, but left-to-right. If the type...

PYSEC-2023-79

Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, internal calls with default arguments are compiled incorrectly. Depending on the number of arguments provided in the call, the defaults are added not right-to-left, but left-to-right. If the type...

CVE-2023-32059 Vyper vulnerable to incorrect ordering of arguments for kwargs passed to internal calls

Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, internal calls with default arguments are compiled incorrectly. Depending on the number of arguments provided in the call, the defaults are added not right-to-left, but left-to-right. If the type...

CVE-2023-32059 Vyper vulnerable to incorrect ordering of arguments for kwargs passed to internal calls

Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, internal calls with default arguments are compiled incorrectly. Depending on the number of arguments provided in the call, the defaults are added not right-to-left, but left-to-right. If the type...

PT-2023-23572 · Vyper · Vyper

Name of the Vulnerable Software and Affected Versions: Vyper versions prior to 0.3.8 Description: The issue concerns internal calls with default arguments in Vyper, a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, these calls are compiled incorrectly,...

CVE-2023-29107

A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 All versions = V2.0 = V2.0 V2.1. The export endpoint discloses some undocumented files. This could allow an unauthenticated remote attacker to gain access to additional information resources...

CVE-2023-29107

A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 All versions = V2.0 = V2.0 V2.1. The export endpoint discloses some undocumented files. This could allow an unauthenticated remote attacker to gain access to additional information resources...

CVE-2023-29107

A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 All versions = V2.0 = V2.0 V2.1. The export endpoint discloses some undocumented files. This could allow an unauthenticated remote attacker to gain access to additional information resources...

PT-2023-22155 · Siemens · Simatic Cloud Connect 7 Cc712 +1

Name of the Vulnerable Software and Affected Versions: SIMATIC Cloud Connect 7 CC712 versions 2.0 through 2.1 SIMATIC Cloud Connect 7 CC716 versions 2.0 through 2.1 Description: A vulnerability has been identified that could allow an unauthenticated remote attacker to gain access to additional...

ASB-A-259385017

In retrieveAppEntry of NotificationAccessDetails.java, there is a missing permission check. This could lead to local escalation of privilege across user boundaries with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2022-45291

PWS Personal Weather Station Dashboard PWSDashboard LTS December 2020 2012lts allows remote code execution by injecting PHP code into settings.php. Attacks can use the PWSprintfile.php, PWSframetext.php, PWSlistfile.php, PWSwinter.php, and PWSeasyweathersetup.php endpoints. A contributing factor ...