CVE-2023-25911

CVE-2023-25911 describes an authenticated OS command injection in Danfoss AK-EM100 web applications, exploitable via web-application parameters. Multiple connected sources confirm the issue and the impact (high/critical) with network access and low attack complexity, requiring low privileges and ...

CVE-2023-25911 Authenticated OS Command Injection in Danfoss AK-EM100

The Danfoss AK-EM100 web applications allow for an authenticated user to perform OS command injection through the web application parameters...

CVE-2023-22585

The CVE-2023-22585 entry concerns the Danfoss AK-EM100 web applications, where the vulnerable component is the web application itself and the root cause is a Reflected Cross-Site Scripting vulnerability in the title parameter. This allows injection of malicious scripts when user-supplied input is...

CVE-2023-22586

CVE-2023-22586 concerns the Danfoss AK-EM100 web applications, where a vulnerability in the web app’s file parameter allows Local File Inclusion. The description is consistently reported across NVD/Red Hat/CVE lists as a Local File Inclusion issue affecting Danfoss AK-EM100. The connected sources...

PT-2023-18571 · Danfoss · Danfoss Ak-Em100

Name of the Vulnerable Software and Affected Versions: Danfoss AK-EM100 affected versions not specified Description: The issue concerns Local File Inclusion in the file parameter of the web application. This allows for potential access to sensitive files on the system. Recommendations: At the...

Danfoss AK-EM100 web applications 跨站脚本漏洞

Danfoss AK-EM100 web applications is a web application from Danfoss, Denmark. It provides a web-based graphical user interface to the store that allows a range of everyday users to locally or remotely monitor data, alarms and reports on all their refrigeration equipment. A security vulnerability...

Danfoss AK-EM100 web applications 安全漏洞

Danfoss AK-EM100 web applications is a web application from Danfoss, Denmark. It provides a web-based graphical user interface to the store that allows a range of everyday users to locally or remotely monitor data, alarms and reports on all their refrigeration equipment. A security vulnerability...

PT-2023-18570 · Danfoss · Danfoss Ak-Em100

Name of the Vulnerable Software and Affected Versions: Danfoss AK-EM100 affected versions not specified Description: The issue concerns Reflected Cross-Site Scripting in the title parameter of the web application. This allows for potential malicious script injection. Recommendations: At the momen...

Danfoss AK-EM100 web applications 信息泄露漏洞

Danfoss AK-EM100 web applications is a web application from Danfoss, Denmark. It provides a web-based graphical user interface to the store that allows a range of everyday users to locally or remotely monitor data, alarms, and reports on all of their refrigeration equipment. An information...

Amazon Linux AMI : mod_security (ALAS-2023-1763)

The version of modsecurity installed on the remote host is prior to 2.8.0-5.28. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1763 advisory. In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web...

EulerOS 2.0 SP5 : python-werkzeug (EulerOS-SA-2023-2167)

According to the versions of the python-werkzeug package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Werkzeug is a comprehensive WSGI web application library. Browsers may allow 'nameless' cookies that look like =value instead of...

EulerOS 2.0 SP5 : mod_security (EulerOS-SA-2023-2160)

According to the versions of the modsecurity package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web Application...

Cross site scripting

Pydio Cells through 4.1.2 allows XSS. Pydio Cells implements the download of files using presigned URLs which are generated using the Amazon AWS SDK for JavaScript 1. The secrets used to sign these URLs are hardcoded and exposed through the JavaScript files of the web application. Therefore, it i...

Amazon Linux 2023 : python3-flask (ALAS2023-2023-183)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-183 advisory. Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy t...

CVE-2023-32751

Pydio Cells through 4.1.2 allows XSS. Pydio Cells implements the download of files using presigned URLs which are generated using the Amazon AWS SDK for JavaScript 1. The secrets used to sign these URLs are hardcoded and exposed through the JavaScript files of the web application. Therefore, it i...

Medium: mod_security

Issue Overview: In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web Application Firewall. NOTE: this is related to CVE-2022-39956 but can be considered independent changes to the ModSecurity C language codebase. CVE-2022-48279...

CVE-2023-29168

The local Vuforia web application does not support HTTPS, and federated credentials are passed via basic authentication...

Design/Logic Flaw

The local Vuforia web application does not support HTTPS, and federated credentials are passed via basic authentication...

CVE-2023-29168

CVE-2023-29168 affects PTC Vuforia Studio: the local Vuforia web application does not support HTTPS and federated credentials are passed via basic authentication, exposing credentials. Affected products: Vuforia Studio all versions prior to 9.9. According to the ICS advisory, it is exploitable re...

CVE-2023-2013

An issue has been discovered in GitLab CE/EE affecting all versions starting from 1.2 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. An issue was found that allows someone to abuse a discrepancy between the Web application display a...