19893 matches found
Path traversal
GE Digital Proficy iFIX 2022, GE Digital Proficy iFIX v6.1, and GE Digital Proficy iFIX v6.5 are vulnerable to code injection, which may allow an attacker to insert malicious configuration files in the expected web server execution path and gain full control of the HMI software...
CVE-2023-0598
GE Digital Proficy iFIX (2022, v6.1, v6.5) are affected by CVE-2023-0598 due to improper generation of code (CWE-94). An attacker could insert malicious configuration files in the web server execution path and gain full control of the HMI software. ICSA-23-073-03 lists the affected products and n...
A New Approach to Discover, Monitor, and Reduce Your Modern Web Attack Surface
Web applications reign the internet universe, but also bring new risks that let attackers poke holes in an ever-expanding attack surface. Stolen credentials have been the historical culprit. Recent analysis saw a spike in exploits targeting web applications directly through specially-crafted...
Lexmark Printer Multiple Input Validation Vulnerabilities (Mar 2023)
Multiple Lexmark printer devices are prone to multiple input validation vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...
GE iFIX 代码注入漏洞
GE iFIX is General Electric's GE platform for improving productivity and process control through industrial-grade SCADA and high-performance HMI. A code injection vulnerability exists in GE iFIX. An attacker could use this vulnerability to insert a malicious configuration file into the intended w...
PT-2023-4729 · NetGear · Netgear R6400V2
Name of the Vulnerable Software and Affected Versions: NETGEAR R6400v2 versions prior to 1.0.4.118 Description: The issue is related to a Buffer Overflow in the httpd service of the NETGEAR R6400v2 Wi-Fi router's firmware, which can be exploited by remote unauthenticated attackers to execute...
Apache HTTP Server: mod_proxy_uwsgi HTTP response splitting
...
Atlassian Jira 6.5.x < 6.5.0.2 Software Tempo Plugin Xml Denial Of Service
According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 6.0.5. It is, therefore, affected by a issue in the TM Software Tempo Plugin which does not properly restrict the capabilities of 3rd party XML parsers, which allows remote...
PT-2023-7457 · Ge Digital · Ge Digital Proficy Ifix
Name of the Vulnerable Software and Affected Versions: GE Digital Proficy iFIX versions 6.1 through 6.5 GE Digital Proficy iFIX 2022 Description: The issue is related to incorrect code generation management in the GE Proficy HMI/SCADA iFIX software, which may allow an attacker to gain full contro...
CVE-2023-0354
The Akuvox E11 web server can be accessed without any user authentication, and this could allow an attacker to access sensitive information, as well as create and download packet captures with known default URLs...
CVE-2023-0351
The Akuvox E11 web server backend library allows command injection in the device phone-book contacts functionality. This could allow an attacker to upload files with executable command instructions...
Command injection
The Akuvox E11 web server backend library allows command injection in the device phone-book contacts functionality. This could allow an attacker to upload files with executable command instructions...
Authentication flaw
The Akuvox E11 web server can be accessed without any user authentication, and this could allow an attacker to access sensitive information, as well as create and download packet captures with known default URLs...
CVE-2023-0351 CVE-2023-0351
The Akuvox E11 web server backend library allows command injection in the device phone-book contacts functionality. This could allow an attacker to upload files with executable command instructions...
CVE-2023-0351
The CVE-2023-0351 issue affects Akuvox E11 (all versions) where the web server backend library allows command injection in the device’s phone-book contacts functionality, enabling an attacker to upload files with executable command instructions. Public sources cite a high-severity CVSSv3.1 base s...
CVE-2023-0351 CVE-2023-0351
The Akuvox E11 web server backend library allows command injection in the device phone-book contacts functionality. This could allow an attacker to upload files with executable command instructions...
CVE-2023-0354 CVE-2023-0354
The Akuvox E11 web server can be accessed without any user authentication, and this could allow an attacker to access sensitive information, as well as create and download packet captures with known default URLs...
CVE-2023-0354 CVE-2023-0354
The Akuvox E11 web server can be accessed without any user authentication, and this could allow an attacker to access sensitive information, as well as create and download packet captures with known default URLs...
CVE-2023-0354
The CVE-2023-0354 entry concerns Akuvox E11, a SIP video doorphone. Public docs confirm a vulnerability where the E11 web server can be accessed without authentication, enabling an attacker to view sensitive information and to create/download packet captures via known default URLs. Affected produ...
Large-scale Cyber Attack Hijacks East Asian Websites for Adult Content Redirects
A widespread malicious cyber operation has hijacked thousands of websites aimed at East Asian audiences to redirect visitors to adult-themed content since early September 2022. The ongoing campaign entails injecting malicious JavaScript code to the hacked websites, often connecting to the target...