Vulnerabilidades

An authenticated malicious user could acquire the simple mail transfer protocol (SMTP) Password in cleartext format, despite it being protected and hidden behind asterisks. The attacker could then perform further attacks using the SMTP credentials.

An unauthenticated remote attacker could force all authenticated users, such as administrative users, to perform unauthorized actions by viewing the logs. This action would also grant the attacker privilege escalation.

A vulnerability in Cisco access points (AP) software could allow an authenticated, local attacker to inject arbitrary commands and execute them with root privileges. This vulnerability is due to improper input validation of commands that are issued from a wireless controller to an AP. An attacker with Administrator…

A vulnerability in the management CLI of Cisco access point (AP) software could allow an authenticated, local attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient input validation of commands supplied by the user. An attacker could exploit this…

In multiple products of CODESYS v3 in multiple versions a remote low privileged user could utilize this vulnerability to read and modify system files and OS resources or DoS the device.

The CODESYS runtime system in multiple versions allows an remote low privileged attacker to use a path traversal vulnerability to access and modify all system files as well as DoS the device.

SAUTER Controls Nova 200–220 Series with firmware version 3.3-006 and prior and BACnetstac version 4.2.1 and prior have only FTP and Telnet available for device management. Any sensitive information communicated through these protocols, such as credentials, is sent in cleartext. An attacker could obtain sensitive…

SOLDR (System of Orchestration, Lifecycle control, Detection and Response) 1.1.0 allows stored XSS via the module editor.

In the Linux kernel 6.0.8, there is an out-of-bounds read in ntfs_attr_find in fs/ntfs/attrib.c.

A SQL injection vulnerability in BMC Control-M before 9.0.20.214 allows attackers to execute arbitrary SQL commands via the memname JSON field.

A vulnerability in the web-based management interface of Cisco Application Policy Infrastructure Controller (APIC) and Cisco Cloud Network Controller, formerly Cisco Cloud APIC, could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. This…

VMware Carbon Black App Control 8.7.x anterior a 8.7.8, 8.8.x anterior a 8.8.6 y 8.9.x.anterior a 8.9.4 contienen una vulnerabilidad de inyección. Un actor malintencionado con acceso privilegiado a la consola de administración de App Control puede utilizar entradas especialmente manipuladas que permitan el acceso al…

Out-of-bounds write in firmware for some Intel(R) Ethernet Network Controllers and Adapters E810 Series before version 1.7.0.8 and some Intel(R) Ethernet 700 Series Controllers and Adapters before version 9.101 may allow a privileged user to potentially enable denial of service via local access.

Uncaught exception in webserver for the Integrated BMC in some Intel(R) platforms before versions 2.86, 2.09 and 2.78 may allow a privileged user to potentially enable denial of service via network access.

Kardex Mlog MCC 5.7.12+0-a203c2a213-master allows remote code execution. It spawns a web interface listening on port 8088. A user-controllable path is handed to a path-concatenation method (Path.Combine from .NET) without proper sanitisation. This yields the possibility of including local files, as well as remote…

Media CP Media Control Panel latest version. Reflected XSS possible through unspecified endpoint.

Media CP Media Control Panel latest version. Insufficiently protected credential change.

Media CP Media Control Panel latest version. CSRF possible through unspecified endpoint.

Media CP Media Control Panel latest version. A Permissive Flash Cross-domain Policy may allow information disclosure.

In SAP GRC (Process Control) - versions GRCFND_A V1200, GRCFND_A V8100, GRCPINW V1100_700, GRCPINW V1100_731, GRCPINW V1200_750, remote-enabled function module in the proprietary SAP solution enables an authenticated attacker with minimal privileges to access all the confidential data stored in the database.…

ConnectWise Control anterior a 22.9.10032 (anteriormente conocido como ScreenConnect) no puede validar los parámetros proporcionados por el usuario, como el parámetro h de Bin/ConnectWiseControl.Client.exe. Esto da como resultado datos reflejados e inyección de código malicioso en un ejecutable descargado. El…

En ConnectWise Control hasta 22.9.10032 (anteriormente conocido como ScreenConnect), después de firmar un archivo ejecutable, se pueden agregar instrucciones adicionales sin invalidar la firma, como instrucciones que dan como resultado ofrecer al usuario final un archivo ejecutable (diferente) controlado por el…

Los dispositivos Control By Web X-400 son vulnerables a un ataque de cross-site scripting, lo que podría resultar en la transferencia de información privada y de sesión al atacante.

Los dispositivos Control By Web X-600M ejecutan scripts Lua y son vulnerables a la inyección de código, lo que podría permitir a un atacante ejecutar código arbitrario de forma remota.

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.