A low privileged remote attacker can use a command injection vulnerability in the API which performs
remote code execution as the user-app user due to improper input validation. The confidentiality is partly affected.
AFFECTED_PRODUCTS:
Phoenixcontact Charx Sec 3000 Firmware,
Phoenixcontact Charx Sec 3050 Firmware,
Phoenixcontact Charx Sec 3100 Firmware
... (+1)
An unauthenticated remote attacker can extract a session token with a MitM attack and gain web-based
management access with the privileges of the currently logged in user due to cleartext transmission of sensitive information. No additio...
AFFECTED_PRODUCTS:
Phoenixcontact Charx Sec 3000 Firmware,
Phoenixcontact Charx Sec 3050 Firmware,
Phoenixcontact Charx Sec 3100 Firmware
... (+1)
A local low privileged attacker can use an untrusted search path in a CHARX system utility to gain root
privileges.Â
AFFECTED_PRODUCTS:
Phoenixcontact Charx Sec 3000 Firmware,
Phoenixcontact Charx Sec 3050 Firmware,
Phoenixcontact Charx Sec 3100 Firmware
... (+1)
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The affected systems could allow log messages to be forwarded to a specific client under certain circumstances. An attacker could leverage this vulnerability to forward log messages to a specific compromised client.
AFFECTED_PRODUCTS:
Siemens Ruggedcom Crossbow
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). Downloading files overwrites files with the same name in the
installation directory of the affected systems. The filename for
the target file can be specified, thus arbitrary files can be
overwritten by an attacke...
AFFECTED_PRODUCTS:
Siemens Ruggedcom Crossbow
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The bulk import feature of the affected systems allow a privileged user to upload files to the root installation directory of the system. By replacing specific files, an attacker could tamper specific files or even achi...
AFFECTED_PRODUCTS:
Siemens Ruggedcom Crossbow
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The affected systems allow a privileged user to upload firmware files to the root installation directory of the system. By replacing specific files, an attacker could tamper specific files or even achieve remote code ex...
AFFECTED_PRODUCTS:
Siemens Ruggedcom Crossbow
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The affected systems allow a privileged user to upload generic files to the root installation directory of the system. By replacing specific files, an attacker could tamper specific files or even achieve remote code exe...
AFFECTED_PRODUCTS:
Siemens Ruggedcom Crossbow
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The affected systems allow any unauthenticated client to disconnect any active user from the server. An attacker could use this vulnerability to prevent any user to perform actions in the system, causing a denial of ser...
AFFECTED_PRODUCTS:
Siemens Ruggedcom Crossbow
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The affected client systems do not properly sanitize input data before sending it to the SQL server. An attacker could use this vulnerability to compromise the whole database.
AFFECTED_PRODUCTS:
Siemens Ruggedcom Crossbow
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The affected systems allow any authenticated user to send arbitrary SQL commands to the SQL server. An attacker could use this vulnerability to compromise the whole database.
AFFECTED_PRODUCTS:
Siemens Ruggedcom Crossbow
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The affected systems allow the upload of arbitrary files of any unauthenticated user. An attacker could leverage this vulnerability and achieve arbitrary code execution with system privileges.
AFFECTED_PRODUCTS:
Siemens Ruggedcom Crossbow
Cross Site Scripting vulnerability in Evertz microsystems MViP-II Firmware 8.6.5, XPS-EDGE-* Build 1467, evEDGE-EO-* Build 0029, MMA10G-* Build 0498, 570IPG-X19-10G Build 0691 allows a remote attacker to execute arbitrary code via a crafted payload to the login parameters.
Dell PowerScale OneFS versions 8.2.x through 9.7.0.1 contains an improper input validation vulnerability. A low privileged remote attacker could potentially exploit this vulnerability, leading to loss of integrity.
AFFECTED_PRODUCTS:
Dell Powerscale Onefs,
Dell Powerscale Onefs,
Dell Powerscale Onefs
... (+1)
Dell PowerScale OneFS versions 8.2.x through 9.7.0.1 contains an allocation of resources without limits or throttling vulnerability. A local unauthenticated attacker could potentially exploit this vulnerability, leading to denial of service.
AFFECTED_PRODUCTS:
Dell Powerscale Onefs,
Dell Powerscale Onefs,
Dell Powerscale Onefs
... (+1)
Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains a use of a broken or risky cryptographic algorithm vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to information disclosure.
AFFECTED_PRODUCTS:
Dell Powerscale Onefs,
Dell Powerscale Onefs,
Dell Powerscale Onefs
... (+1)
Dell PowerScale OneFS versions 8.2.x through 9.7.0.1 contains an execution with unnecessary privileges vulnerability. A local high privileged attacker could potentially exploit this vulnerability, leading to escalation of privileges.
AFFECTED_PRODUCTS:
Dell Powerscale Onefs,
Dell Powerscale Onefs,
Dell Powerscale Onefs
... (+1)
Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains an improper handling of unexpected data type vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to denial of service.
AFFECTED_PRODUCTS:
Dell Powerscale Onefs,
Dell Powerscale Onefs,
Dell Powerscale Onefs
... (+1)
Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains an external control of file name or path vulnerability. A local high privilege attacker could potentially exploit this vulnerability, leading to denial of service.
AFFECTED_PRODUCTS:
Dell Powerscale Onefs,
Dell Powerscale Onefs,
Dell Powerscale Onefs
... (+1)
VMware Workstation and Fusion contain an information disclosure vulnerability in the Host Guest File Sharing (HGFS) functionality. A malicious actor with local administrative privileges on a virtual machine may be able to read privileged information contained in hypervisor memory from a virtual mach...
AFFECTED_PRODUCTS:
VMware Workstation,
VMware Fusion
VMware Workstation and Fusion contain an information disclosure vulnerability in the vbluetooth device. A malicious actor with local administrative privileges on a virtual machine may be able to read privileged information contained in hypervisor memory from a virtual machine.
AFFECTED_PRODUCTS:
VMware Workstation,
VMware Fusion
VMware Workstation and Fusion contain a heap buffer-overflow vulnerability in the Shader functionality. A malicious actor with non-administrative access to a virtual machine with 3D graphics enabled may be able to exploit this vulnerability to create a denial of service condition.
AFFECTED_PRODUCTS:
VMware Workstation,
VMware Fusion
VMware Workstation and Fusion contain a use-after-free vulnerability in the vbluetooth device. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.
AFFECTED_PRODUCTS:
VMware Workstation,
VMware Fusion
An attacker who successfully exploited these vulnerabilities could cause the robot to stop, make the robot controller inaccessible.
The vulnerability could potentially be exploited to perform unauthorized actions by an attacker. This vulnerability arises under specific condition when specially cr...
An attacker who successfully exploited these vulnerabilities could cause the robot to stop, make the robot controller inaccessible, or execute arbitrary code.Â
The vulnerability could potentially be exploited to perform unauthorized actions by an attacker. This vulnerability arises under specific...
OS command injection vulnerabilities in GE HealthCare ultrasound devices
Potential buffer overflow
in unsafe UEFI variable handling
in Phoenix SecureCoreâ„¢ for Intel Gemini Lake.This issue affects:
SecureCoreâ„¢ for Intel Gemini Lake: from 4.1.0.1 before 4.1.0.567.
AFFECTED_PRODUCTS:
Phoenixtech Securecore Technology
Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices
The YITH WooCommerce Gift Cards plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_mail_status' and 'save_email_settings' functions in all versions up to, and including, 4.12.0. This makes it possible for unauthenticated attackers t...
Potential buffer overflow
in unsafe UEFI variable handling
in Phoenix SecureCoreâ„¢ for select Intel platforms
This issue affects:
Phoenix
SecureCoreâ„¢ for Intel Kaby Lake: from 4.0.1.1 before 4.0.1.998;
Phoenix
SecureCoreâ„¢ for Intel Coffee Lake: from 4.1.0.1 before 4.1.0.562;
Phoenix...
AFFECTED_PRODUCTS:
Phoenixtech Securecore Technology,
Phoenixtech Securecore Technology,
Phoenixtech Securecore Technology
... (+6)
The WP Compress – Image Optimizer [All-In-One plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 6.20.01. This is due to insufficient validation on the redirect url supplied via the 'css' parameter. This makes it possible for unauthenticated attackers to redire...
AFFECTED_PRODUCTS:
Wpcompress Wp Compress
A vulnerability has been identified in Security Configuration Tool (SCT) (All versions), SIMATIC Automation Tool (All versions < V5.0 SP2), SIMATIC BATCH V9.1 (All versions < V9.1 SP2 Upd5), SIMATIC NET PC Software V16 (All versions < V16 Update 8), SIMATIC NET PC Software V17 (All versions), SIMATI...
Exposed IOCTL with Insufficient Access Control in Phoenix WinFlash Driver on Windows allows Privilege Escalation which allows for modification of system firmware.This issue affects WinFlash Driver: before 4.5.0.0.
AFFECTED_PRODUCTS:
Phoenixtech Winflash
Use after free issue in editcap could cause denial of service via crafted capture file
AFFECTED_PRODUCTS:
Fedoraproject Fedora,
Fedoraproject Fedora,
Wireshark Wireshark
... (+2)
MONGO and ZigBee TLV dissector infinite loops in Wireshark 4.2.0 to 4.2.4, 4.0.0 to 4.0.14, and 3.6.0 to 3.6.22 allow denial of service via packet injection or crafted capture file
AFFECTED_PRODUCTS:
Fedoraproject Fedora,
Fedoraproject Fedora,
Wireshark Wireshark
... (+2)
Memory handling issue in editcap could cause denial of service via crafted capture file
AFFECTED_PRODUCTS:
Fedoraproject Fedora,
Fedoraproject Fedora,
Wireshark Wireshark
... (+2)
An flaw was found in the OpenStack Platform (RHOSP) director, a toolset for installing and managing a complete RHOSP environment. Plaintext passwords may be stored in log files, which can expose sensitive information to anyone with access to the logs.
A vulnerability has been discovered in Agentejo Cockpit CMS v0.5.5 that consists in an arbitrary file upload in ‘/media/api’ parameter via post request. An attacker could upload files to the server, compromising the entire infrastructure.
AFFECTED_PRODUCTS:
Agentejo Cockpit
Vulnerability in School ERP Pro+Responsive 1.0 that allows SQL injection through the '/SchoolERP/office_admin/' index in the parameters groups_id, examname, classes_id, es_voucherid, es_class, etc. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server a...
Vulnerability in School ERP Pro+Responsive 1.0 that allows XSS via the index '/schoolerp/office_admin/' in the parameters es_bankacc, es_bank_name, es_bank_pin, es_checkno, es_teller_number, dc1 and dc2. An attacker could send a specially crafted JavaScript payload to an authenticated user and parti...
Vulnerability in School ERP Pro+Responsive 1.0 that allows XSS via the username and password parameters in '/index.php'. This vulnerability allows an attacker to partially take control of the victim's browser session.
A vulnerability was found in SourceCodester Online Computer and Laptop Store 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /classes/SystemSettings.php?f=update_settings. The manipulation leads to unrestricted upload. The attack can be l...
AFFECTED_PRODUCTS:
Oretnom23 Online Computer And Laptop Store
A vulnerability was found in Campcodes Online Laundry Management System 1.0. It has been classified as problematic. Affected is an unknown function of the file admin_class.php. The manipulation of the argument type with the input 1 leads to improper authorization. It is possible to launch the attack...
AFFECTED_PRODUCTS:
Campcodes Online Laundry Management System
A vulnerability was found in Campcodes Online Laundry Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file /index.php. The manipulation of the argument page leads to file inclusion. The attack may be initiated remotely. The exploit has been disc...
AFFECTED_PRODUCTS:
Campcodes Online Laundry Management System
A vulnerability has been found in Campcodes Online Laundry Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file manage_user.php of the component HTTP Request Parameter Handler. The manipulation of the argument id leads to improper control of resource...
AFFECTED_PRODUCTS:
Campcodes Online Laundry Management System
A vulnerability, which was classified as critical, was found in Ruijie RG-UAC up to 20240506. This affects an unknown part of the file /view/networkConfig/GRE/gre_add_commit.php. The manipulation of the argument name/remote/local/IP leads to os command injection. It is possible to initiate the attac...
A vulnerability, which was classified as critical, has been found in Ruijie RG-UAC up to 20240506. Affected by this issue is some unknown functionality of the file /view/bugSolve/viewData/detail.php. The manipulation of the argument filename leads to os command injection. The attack may be launched...
A vulnerability classified as critical was found in Ruijie RG-UAC up to 20240506. Affected by this vulnerability is an unknown functionality of the file /view/networkConfig/RouteConfig/StaticRoute/static_route_edit_commit.php. The manipulation of the argument oldipmask/oldgateway leads to os command...
A vulnerability classified as critical has been found in Ruijie RG-UAC up to 20240506. Affected is an unknown function of the file /view/networkConfig/physicalInterface/interface_commit.php. The manipulation of the argument name leads to os command injection. It is possible to launch the attack remo...
A vulnerability has been found in SourceCodester Open Source Clinic Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file setting.php. The manipulation of the argument logo leads to unrestricted upload. The attack can be launched rem...
AFFECTED_PRODUCTS:
Nikhil-Bhalerao Open Source Clinic Management System