Kestrel Web Server 输入验证错误漏洞

Kestrel Web Server is a cross-platform web server for ASP.NET Core. An input validation error vulnerability exists in Kestrel Web Server. The following products and releases are affected:Microsoft Visual Studio 2019 version 16.9 includes 16.0 - 16.8,Microsoft Visual Studio 2019 version 16.11...

CVE-2021-25004

The SEUR Oficial WordPress plugin before 1.7.2 creates a PHP file with a random name when installed, even though it is used for support purposes, it allows to download any file from the web server without restriction after knowing the URL and a password than an administrator can see in the plugin...

Cross site request forgery (csrf)

The RVM WordPress plugin before 6.4.2 does not have proper authorisation, CSRF checks and validation of the rvmuploadregionsfilepath parameter in the rvmimportregions AJAX action, allowing any authenticated user, such as subscriber, to read arbitrary files on the web server...

CVE-2021-25004

The CVE-2021-25004 entry concerns WordPress plugin SEUR Oficial (versions before 1.7.2). The vulnerability arises from the plugin creating a PHP file with a random name used for support, which enables an authenticated attacker to download arbitrary files from the web server when given the URL and...

CVE-2021-24947

WordPress RVM – Responsive Vector Maps plugin (versions

CVE-2022-22680

Exposure of sensitive information to an unauthorized actor vulnerability in Web Server in Synology DiskStation Manager DSM before 7.0.1-42218-2 allows remote attackers to obtain sensitive information via unspecified vectors...

CVE-2022-22680

Exposure of sensitive information to an unauthorized actor vulnerability in Web Server in Synology DiskStation Manager DSM before 7.0.1-42218-2 allows remote attackers to obtain sensitive information via unspecified vectors...

CVE-2022-22680

The CVE-2022-22680 issue affects Synology DiskStation Manager (DSM) Web Server prior to version 7.0.1-42218-2, causing exposure of sensitive information to unauthorized actors via unspecified vectors. The vulnerability is classified with CVSS scores up to 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N ...

CVE-2022-22680

Exposure of sensitive information to an unauthorized actor vulnerability in Web Server in Synology DiskStation Manager DSM before 7.0.1-42218-2 allows remote attackers to obtain sensitive information via unspecified vectors...

Siemens BACnet Field Panels Authentication Bypass Using an Alternate Path or Channel (CVE-2017-9946)

A vulnerability has been identified in Siemens APOGEE PXC and TALON TC BACnet Automation Controllers in all versions V3.5. An attacker with network access to the integrated web server 80/tcp and 443/tcp could bypass the authentication and download sensitive information from the device. This plugi...

Siemens SIMATIC S7-1500 Cross-site Scripting (CVE-2014-2246)

Cross-site scripting XSS vulnerability in the integrated web server on Siemens SIMATIC S7-1500 CPU PLC devices with firmware before 1.5.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. This plugin only works with Tenable.ot. Please visit...

Siemens SICAM A8000 RTUs Protection Mechanism Failure (CVE-2020-28396)

A vulnerability has been identified in SICAM A8000 CP-8000 All versions V16, SICAM A8000 CP-8021 All versions V16, SICAM A8000 CP-8022 All versions V16. A web server misconfiguration of the affected device can cause insecure ciphers usage by a users browser. An attacker in a privileged position...

Rockwell Automation MicroLogix Cleartext Transmission of Sensitive Information (CVE-2016-9334)

An issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 controller 1763-L16AWA, Series A and B, Version 14.000 and prior versions; 1763-L16BBB, Series A and B, Version 14.000 and prior versions; 1763-L16BWA, Series A and B, Version 14.000 and prior versions; and 1763-L16DWD,...

Siemens SIPROTEC Information Disclosure (CVE-2016-4784)

A vulnerability has been identified in firmware variant PROFINET IO for EN100 Ethernet module : All versions V1.04.01; Firmware variant Modbus TCP for EN100 Ethernet module : All versions V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions V1.03; Firmware variant IEC 104...

Schneider Electric Modicon Cross-site Scripting (CVE-2018-7831)

An Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 allowing an attacker to send a specially crafted URL to a currently authenticated web server user to execute a...

Siemens SIMATIC CP 343-1/CP 443-1 Modules and SIMATIC S7-300/S7-400 CPUs (CVE-2016-8672)

A vulnerability has been identified in SIMATIC CP 343-1 Advanced incl. SIPLUS NET variant All versions V3.0.53, SIMATIC CP 443-1 Advanced incl. SIPLUS NET variant All versions V3.2.17, SIMATIC S7-300 PN/DP CPU family incl. SIPLUS variants All versions, SIMATIC S7-400 PN/DP CPU family incl. SIPLUS...

Rockwell Automation Allen-Bradley MicroLogix 1100 and 1400 Exposure of Sensitive Information to an Unauthorized Actor (CVE-2017-7899)

An Information Exposure issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and B, Version 16.00 and prior versions; 1763-L16BBB, Series A and B, Version 16.00 and prior versions; 1763-L16BWA, Series A and B, Version 16.00...

Siemens SICAM MMU, SICAM T, and SICAM SGU Improper Neutralization of Script-Related HTML Tags in a Web Page (CVE-2020-10043)

A vulnerability has been identified in SICAM MMU All versions V2.05, SICAM SGU All versions, SICAM T All versions V2.18. The web server could allow Cross-Site Scripting XSS attacks if unsuspecting users are tricked into accessing a malicious link. This plugin only works with Tenable.ot. Please...

Rockwell Automation MicroLogix Incorrect Permission Assignment for Critical Resource (CVE-2016-9338)

An issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 controller 1763-L16AWA, Series A and B, Version 14.000 and prior versions; 1763-L16BBB, Series A and B, Version 14.000 and prior versions; 1763-L16BWA, Series A and B, Version 14.000 and prior versions; and 1763-L16DWD,...

Siemens SIPROTEC Information Disclosure (CVE-2016-4785)

A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions V1.04.01; Firmware variant Modbus TCP for EN100 Ethernet module : All versions V1.11.00; Firmware variant DNP3 TCP for EN100 Ethernet module : All versions V1.03; Firmware variant IEC 104...