The vulnerability of the httpd function’s unescape function in the cgi.c file of the Asuswrt-Merlin New Gen microprogramming system allows a hacker to cause memory corruption.

The vulnerability of the unescape function in httpd’s cgi.c file of the Asuswrt-Merlin New Gen software relates to the escape operation going beyond buffer boundaries in memory. Exploiting this vulnerability could allow a remote attacker to cause memory corruption by sending a specially crafted...

Jenkins LTS < 2.401.1 / Jenkins weekly < 2.400 XSRF

According to its its self-reported version number, the version of Jenkins running on the remote web server is Jenkins LTS prior to 2.401.1 or Jenkins weekly prior to 2.400. It is, therefore, affected by the following vulnerability: - In Jenkins 2.399 and earlier, LTS 2.387.3 and earlier, POST...

CVE-2023-25367

Siglent SDS 1104X-E SDS1xx4X-EV6.1.37R9.ADS allows unfiltered user input resulting in Remote Code Execution RCE with SCPI interface or web server...

CVE-2023-25367

Siglent SDS 1104X-E SDS1xx4X-EV6.1.37R9.ADS allows unfiltered user input resulting in Remote Code Execution RCE with SCPI interface or web server...

Design/Logic Flaw

Siglent SDS 1104X-E SDS1xx4X-EV6.1.37R9.ADS allows unfiltered user input resulting in Remote Code Execution RCE with SCPI interface or web server...

CVE-2023-25367

Siglent SDS 1104X-E SDS1xx4X-EV6.1.37R9.ADS allows unfiltered user input resulting in Remote Code Execution RCE with SCPI interface or web server...

CVE-2023-25367

CVE-2023-25367 affects Siglent SDS 1104X-E SDS1xx4X-E_V6.1.37R9.ADS. The issue is unfiltered user input allowing Remote Code Execution via the SCPI interface or web server. Root cause: insufficient input validation and, in some sources, lack of authentication on the SCPI interface, enabling remot...

CVE-2023-25367

Siglent SDS 1104X-E SDS1xx4X-EV6.1.37R9.ADS allows unfiltered user input resulting in Remote Code Execution RCE with SCPI interface or web server...

golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption

A flaw was found in Golang Go, where it is vulnerable to a denial of service caused by an issue during multipart form parsing. By sending a specially crafted input, a remote attacker can consume large amounts of CPU and memory, resulting in a denial of service...

PT-2023-3379 · Siemens · Cp-8050 Master Module +1

Name of the Vulnerable Software and Affected Versions: CP-8031 MASTER MODULE versions prior to CPCI85 V05 CP-8050 MASTER MODULE versions prior to CPCI85 V05 Description: A vulnerability has been identified that involves an exposed UART console login interface. This issue could allow an attacker...

CVE-2023-1897

Atlas Copco Power Focus 6000 web server does not sanitize the login information stored by the authenticated user’s browser, which could allow an attacker with access to the user’s computer to gain credential information of the controller...

CVE-2023-1898

Atlas Copco Power Focus 6000 web server uses a small amount of session ID numbers. An attacker could enter a session ID number to retrieve data for an active user’s session...

Code injection

Atlas Copco Power Focus 6000 web server is not a secure connection by default, which could allow an attacker to gain sensitive information by monitoring network traffic between user and controller...

Design/Logic Flaw

Atlas Copco Power Focus 6000 web server does not sanitize the login information stored by the authenticated user’s browser, which could allow an attacker with access to the user’s computer to gain credential information of the controller...

CVE-2023-1897 CVE-2023-1897

Atlas Copco Power Focus 6000 web server does not sanitize the login information stored by the authenticated user’s browser, which could allow an attacker with access to the user’s computer to gain credential information of the controller...

CVE-2023-1897

Atlas Copco Power Focus 6000 web server is affected by CVE-2023-1897: it does not sanitize login information stored by the authenticated user’s browser, allowing a user‑with‑access‑to‑their‑computer attacker to obtain credentials for the controller. Affected product: Power Focus 6000 web server (...

CVE-2023-1897 CVE-2023-1897

Atlas Copco Power Focus 6000 web server does not sanitize the login information stored by the authenticated user’s browser, which could allow an attacker with access to the user’s computer to gain credential information of the controller...

CVE-2023-1898 CVE-2023-1898

Atlas Copco Power Focus 6000 web server uses a small amount of session ID numbers. An attacker could enter a session ID number to retrieve data for an active user’s session...

CVE-2023-1898

CVE-2023-1898 affects Atlas Copco Power Focus 6000 web server. The issue is a small space of session IDs that could allow an attacker to enter a valid session ID and retrieve data for an active user’s session. Reported as a high-severity, remotely exploitable condition with low attack complexity ...

CVE-2023-1899 CVE-2023-1899

Atlas Copco Power Focus 6000 web server is not a secure connection by default, which could allow an attacker to gain sensitive information by monitoring network traffic between user and controller...