PT-2020-9415 · Siemens · Simatic S7-300 Cpu 317Tf-3 Pn/Dp +14

Name of the Vulnerable Software and Affected Versions: SIMATIC ET 200pro IM154-8 PN/DP CPU versions prior to V3.X.17 SIMATIC ET 200pro IM154-8F PN/DP CPU versions prior to V3.X.17 SIMATIC ET 200pro IM154-8FX PN/DP CPU versions prior to V3.X.17 SIMATIC ET 200S IM151-8 PN/DP CPU versions prior to...

The vulnerability of the OSSL Module web server of the Oracle HTTP Server and the SSL API component of the Oracle Security Service, which allows a hacker to cause a service failure.

The vulnerability of the OSSL Module web server of the Oracle HTTP Server and the SSL API component of the Oracle Security Service is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to cause service failures using the HTTPS protocol...

The vulnerability of Siemens industrial switches SCALANCE X-200, SCALANCE X-200IRT, and SCALANCE X-300’s web servers allows attackers to execute cross-site scripting attacks.

The vulnerability of Siemens industrial switches SCALANCE X-200, SCALANCE X-200IRT, and SCALANCE X-300 relates to the lack of protective measures for the web page structure. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks...

Siemens OZW Web Server

1. EXECUTIVE SUMMARY CVSS v3 5.3 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: OZW web server Vulnerability: Information disclosure 2. RISK EVALUATION Successful exploitation of this vulnerability could allow unauthenticated users to access project files...

CVE-2019-13163

The Fujitsu TLS library allows a man-in-the-middle attack. This affects Interstage Application Development Cycle Manager V10 and other versions, Interstage Application Server V12 and other versions, Interstage Business Application Manager V2 and other versions, Interstage Information Integrator V...

Design/Logic Flaw

The Fujitsu TLS library allows a man-in-the-middle attack. This affects Interstage Application Development Cycle Manager V10 and other versions, Interstage Application Server V12 and other versions, Interstage Business Application Manager V2 and other versions, Interstage Information Integrator V...

CVE-2019-13163

The Fujitsu TLS library allows a man-in-the-middle attack. This affects Interstage Application Development Cycle Manager V10 and other versions, Interstage Application Server V12 and other versions, Interstage Business Application Manager V2 and other versions, Interstage Information Integrator V...

Node.js third-party modules: [sirloin] Web Server Directory Traversal via Crafted GET Request

I would like to report path traversal in Sirloin module. It allows an attacker to read system files via path traversal local/remote Module module name: Sirloin version: 0.15.0 latest release build npm page: https://www.npmjs.com/package/sirloin Module Description This high performance, extremely...

Waitress denial of service vulnerability

Waitress is a WSGI Web Server Gateway Interface server for Python. A denial of service vulnerability exists in Waitress, which can be exploited to cause a denial of service by sending specially designed headers containing invalid characters that consume all available CPU resources...

Command execution vulnerability in multiple D-Link routers (CNVD-2020-15533)

The D-Link DIR-878, DIR-882, and DIR-867 are all router products from AUO D-Link. A command execution vulnerability exists in multiple D-Link routers, which can be exploited by an attacker to gain control of a web server...

Visma Bug Bounty Program: Unrestricted file upload when creating quotes allows for Stored XSS

An attacker is able to bypass the restrictions which limit user uploads to .PDF only. Utilizing this exploit an attacker can upload malicious content to the web server. First the system checks the MIME-Type, and if it fails too match Content-Type: application/pdf then the upload won't be processe...

PHP 7.2.x < 7.2.27 / PHP 7.3.x < 7.3.14 / 7.4.x < 7.4.2 Multiple Vulnerabilities

According to its banner, the version of PHP running on the remote web server is either 7.2.x prior to 7.2.27, 7.3.x prior to 7.3.14, or 7.4.x prior to 7.4.2. It is, therefore, affected by multiple vulnerabilities: - An buffer overflow on the mbflfiltconvbig5wchar function. An unauthenticated,...

ALPINE-CVE-2020-8492

Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service ReDoS attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking...

Fedora: Security Advisory for elog (FEDORA-2020-f49fe7f011)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

PHP 7.3.x < 7.3.14 Multiple Vulnerabilities

According to its banner, the version of PHP running on the remote web server is prior to 7.2.27, 7.3.x prior to 7.3.14, or 7.4.x prior to 7.4.2. It is, therefore, affected by multiple vulnerabilities: - A buffer overflow exists in mbflfiltconvbig5wchar due to an input validation error...

SRC-2021-0002 : CSCart templates.manage Server Side Template Injection Remote Code Execution Vulnerability

Vulnerability Details: This vulnerability allows remote attackers to execute arbitrary code on affected installations of CSCart. Authentication is required to exploit this vulnerability with the Files privilege. The specific flaw exists within the templates.manage dispatch method. The issue resul...

CVE-2012-5626

EJB method in Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 5; Red Hat JBoss Operations Network 3.1; Red Hat JBoss Portal 4 and 5; Red Hat JBoss SOA Platform 4.2, 4.3, and 5; in Red Hat JBoss Enterprise Web Server 1 ignores roles specified using the @RunAs annotation...

CVE-2012-5626

EJB method in Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 5; Red Hat JBoss Operations Network 3.1; Red Hat JBoss Portal 4 and 5; Red Hat JBoss SOA Platform 4.2, 4.3, and 5; in Red Hat JBoss Enterprise Web Server 1 ignores roles specified using the @RunAs annotation...

Razer: SQL Injection at https://sea-web.gold.razer.com/lab/cash-card-incomplete-translog-resend via period-hour Parameter

The tester discovered a SQL injection issue that allowed access to data via Razer Gold Thailand's sea-web server. Razer appreciates the clear and thorough report...

Huawei EulerOS: Security Advisory for httpd (EulerOS-SA-2019-1631)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...