CVE-2023-4487 GE Digital CIMPLICITY Process Control

GE CIMPLICITY 2023 is by a process control vulnerability, which could allow a local attacker to insert malicious configuration files in the expected web server execution path to escalate privileges and gain full control of the HMI software...

PT-2023-5230 · Ge · Ge Cimpicity

Name of the Vulnerable Software and Affected Versions: GE CIMPLICITY version 2023 Description: The issue is related to a process control vulnerability in GE CIMPLICITY 2023, which could allow a local attacker to insert malicious configuration files in the expected web server execution path to...

Moderate: Red Hat Security Advisory: Red Hat JBoss Web Server 5.7.4 release and security update

Red Hat JBoss Web Server 5.7.4 zip release is now available for Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Windows Server. Red Hat Product Security has rated this release as having a security impact of Moderate. A Common Vulnerability Scoring System CV...

Moderate: Red Hat Security Advisory: Red Hat JBoss Web Server 5.7.4 release and security update

An update is now available for Red Hat JBoss Web Server 5.7.4 on Red Hat Enterprise Linux versions 7, 8, and 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Security Bulletin: The IBM® Engineering Lifecycle Engineering product using IBM WebSphere Application Server traditional is vulnerable to spoofing when using Web Server Plug-ins (CVE-2022-39161)

Summary When WebSphere Application Server traditional is used with the optionally installed Web Server Plug-ins component, the lack of hostname verification with the Web Plugins could allow an authenticated attacker to conduct spoofing attacks. A man in the middle attacker could conduct an exploi...

GE CIMPLICITY Security Breach

GE CIMPLICITY is a client/server based HMI/SCADA solution from General Electric GE. The solution captures and shares real-time and historical data across all levels of the enterprise, enabling operational visualization of process, equipment, and resource monitoring. A security vulnerability exist...

The vulnerability of the NPort IAW5000A-I/O Series web server software allows a perpetrator to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the NPort IAW5000A-I/O Series web server software is related to the presence of a hard-coded key, which could potentially facilitate manipulation of the firmware. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and...

Easy Address Book Web Server 1.6 Buffer Overflow / Cross Site Scripting

Exploit Title: Easy Address Book Web Server v1.6 - Multiple Vulnerabilities Discovery by: Rafael Pedrero Discovery Date: 2021-01-10 CVE: CVE-2023-4491, CVE-2023-4492, CVE-2023-4493 Vendor Homepage: http://www.efssoft.com/web-address-book-server.html Software Link : http://www.efssoft.com/eabws.ex...

"Internal Server Error 43549" response from Gateway with malformed request "/epatype?Param"

Security scanning report vulnerability on ADC: Web Server Misconfiguration - Server Error Message when http request url includes "/epatype?"...

CVE-2023-40577

Prometheus Alertmanager is vulnerable to cross-site scripting due to improper validation of user-supplied input by the /api/v1/alerts endpoint. This issue could allow a remote attacker to inject malicious script into a web page, which would be executed in a victim's web browser within the hosting...

The vulnerability of the web-server of the programmable logical controller ioLogik, related to deficiencies in access control, allows a intruder to gain unauthorized access to confidential data.

The vulnerability of the web-server-based programmable logic controller ioLogik is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to confidential data...

The vulnerability of the web-server of the programmable logical controller ioLogik arises from an improper limitation on the displayed layers of the user interface. This allows a intruder to compromise the integrity of the protected information.

The vulnerability of the web-server of the programmable logical controller ioLogik is related to an incorrect limitation on the displayed layers of the user interface. Exploiting this vulnerability allows a remote attacker to compromise the integrity of the protected information...

The vulnerability of the web server of the programmable logical controller ioLogik arises from the use of cookies to store confidential information without the HttpOnly flag. This allows a violator to gain unauthorized access to the protected information.

The vulnerability of the web server of the programmable logical controller ioLogik relates to the use of cookies for storing confidential information without the HttpOnly flag. Exploiting this vulnerability may allow an attacker, operating remotely, to gain unauthorized access to the protected...

The vulnerability of the web-server of the programmable logical controller ioLogik lies in the lack of protection for service data, allowing a intruder to gain unauthorized access to the protected information.

The vulnerability of the web-server of the programmable logical controller ioLogik is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

Security Bulletin: NVIDIA DGX H100 - August 2023

NVIDIA has released a firmware security update for the NVIDIA DGX™ H100 system. This update addresses issues that may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering. To protect your system, download and install this firmware update...

[SECURITY] Fedora 37 Update: caddy-2.6.4-1.fc37

Caddy is the web server with automatic HTTPS...

[SECURITY] Fedora 38 Update: caddy-2.6.4-1.fc38

Caddy is the web server with automatic HTTPS...

Fedora: Security Advisory for caddy (FEDORA-2023-4926525509)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for caddy (FEDORA-2023-74e5545901)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-3406

Path Traversal issue in M-Files Classic Web versions below 23.6.12695.3 and LTS Service Release Versions before 23.2 LTS SR3 allows authenticated user to read some restricted files on the web server...