Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
178 results · page 3 of 4
Dec 1, 2021Affected versions of CODESYS Git in Versions prior to V1.1.0.0 lack certificate validation in HTTPS handshakes.CVE-2021-34599 · Other software · CODESYS · reported by info@cert.vde.comHigh 7.4
Affected versions of CODESYS Git in Versions prior to V1.1.0.0 lack certificate validation in HTTPS handshakes. CODESYS Git does not implement certificate validation by default, so it does not verify that the server provides a valid and trusted HTTPS certificate. Since the certificate of the server to which the connection is made is not properly verified, the server connection is vulnerable to a man-in-the-middle attack.
- Product
- CODESYS Git
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comcustomers.codesys.com
Oct 26, 2021A crafted request may cause a read access to an uninitialized pointer in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resultCVE-2021-34596 · Other software · CODESYS · reported by info@cert.vde.comMedium 6.5
A crafted request may cause a read access to an uninitialized pointer in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resulting in a denial-of-service condition.
- Product
- CODESYS V2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comcustomers.codesys.com
Oct 26, 2021A crafted request with invalid offsets may cause an out-of-bounds read or write access in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions CVE-2021-34595 · Other software · CODESYS · reported by info@cert.vde.comHigh 8.1
A crafted request with invalid offsets may cause an out-of-bounds read or write access in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resulting in a denial-of-service condition or local memory overwrite.
- Product
- CODESYS V2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comcustomers.codesys.com
Oct 26, 2021In CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56 unauthenticated crafted invalid requests may result in several denial-of-servCVE-2021-34593 · Other software · CODESYS · reported by info@cert.vde.comHigh 7.5
In CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56 unauthenticated crafted invalid requests may result in several denial-of-service conditions. Running PLC programs may be stopped, memory may be leaked, or further communication clients may be blocked from accessing the PLC.
- Product
- CODESYS V2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Oct 26, 2021In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests may cause a Null pointer dereference in the CODESYS web server and may result in a dCVE-2021-34586 · Other software · CODESYS · reported by info@cert.vde.comHigh 7.5
In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests may cause a Null pointer dereference in the CODESYS web server and may result in a denial-of-service condition.
- Product
- CODESYS V2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comtenable.com
Oct 26, 2021In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests can trigger a parser error.CVE-2021-34585 · Other software · CODESYS · reported by info@cert.vde.comHigh 7.5
In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests can trigger a parser error. Since the parser result is not checked under all conditions, a pointer dereference with an invalid address can occur. This leads to a denial of service situation.
- Product
- CODESYS V2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comtenable.com
Oct 26, 2021Crafted web server requests can be utilised to read partial stack or heap memory or may trigger a denial-of- service condition due to a crash in the CODESYS V2 CVE-2021-34584 · Other software · CODESYS · reported by info@cert.vde.comCritical 9.1
Crafted web server requests can be utilised to read partial stack or heap memory or may trigger a denial-of- service condition due to a crash in the CODESYS V2 web server prior to V1.1.9.22.
- Product
- CODESYS V2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comtenable.com
Oct 26, 2021Crafted web server requests may cause a heap-based buffer overflow and could therefore trigger a denial-of- service condition due to a crash in the CODESYS V2 wCVE-2021-34583 · Other software · CODESYS · reported by info@cert.vde.comHigh 7.5
Crafted web server requests may cause a heap-based buffer overflow and could therefore trigger a denial-of- service condition due to a crash in the CODESYS V2 web server prior to V1.1.9.22.
- Product
- CODESYS V2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comtenable.com
Aug 25, 2021An unsafe deserialization vulnerability exists in the Engine.plugin ProfileInformation ProfileData functionality of CODESYS GmbH CODESYS Development System 3.5.CVE-2021-21869 · Other software · Codesys · reported by talos-cna@cisco.comHigh 7.8
An unsafe deserialization vulnerability exists in the Engine.plugin ProfileInformation ProfileData functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.
- Product
- Codesys
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comtalosintelligence.com
Aug 18, 2021An unsafe deserialization vulnerability exists in the ObjectManager.plugin Project.get_MissingTypes() functionality of CODESYS GmbH CODESYS Development System 3CVE-2021-21868 · Other software · Codesys · reported by talos-cna@cisco.comHigh 7.8
An unsafe deserialization vulnerability exists in the ObjectManager.plugin Project.get_MissingTypes() functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.
- Product
- Codesys
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comtalosintelligence.com
Aug 18, 2021An unsafe deserialization vulnerability exists in the ObjectManager.plugin ObjectStream.ProfileByteArray functionality of CODESYS GmbH CODESYS Development SysteCVE-2021-21867 · Other software · Codesys · reported by talos-cna@cisco.comHigh 7.8
An unsafe deserialization vulnerability exists in the ObjectManager.plugin ObjectStream.ProfileByteArray functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.
- Product
- Codesys
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comtalosintelligence.com
Aug 5, 2021A unsafe deserialization vulnerability exists in the ComponentModel Profile.FromFile() functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.1CVE-2021-21863 · Other software · Codesys · reported by talos-cna@cisco.comHigh 7.8
A unsafe deserialization vulnerability exists in the ComponentModel Profile.FromFile() functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.
- Product
- Development System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comcustomers.codesys.com
Aug 4, 2021In CODESYS EtherNetIP before 4.1.0.0, specific EtherNet/IP requests may cause a null pointer dereference in the downloaded vulnerable EtherNet/IP stack that is CVE-2021-36765 · Other software · Codesys · reported by MITREHigh 7.5
In CODESYS EtherNetIP before 4.1.0.0, specific EtherNet/IP requests may cause a null pointer dereference in the downloaded vulnerable EtherNet/IP stack that is executed by the CODESYS Control runtime system.
- Product
- Ethernetip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comcustomers.codesys.com
Aug 4, 2021In CODESYS Gateway V3 before 3.5.17.10, there is a NULL Pointer Dereference.CVE-2021-36764 · Other software · Codesys · reported by MITREHigh 7.5
In CODESYS Gateway V3 before 3.5.17.10, there is a NULL Pointer Dereference. Crafted communication requests may cause a Null pointer dereference in the affected CODESYS products and may result in a denial-of-service condition.
- Product
- Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comcustomers.codesys.com
Aug 3, 2021In CODESYS V3 web server before 3.5.17.10, files or directories are accessible to External Parties.CVE-2021-36763 · Other software · Codesys · reported by MITREHigh 7.5
In CODESYS V3 web server before 3.5.17.10, files or directories are accessible to External Parties.
- Product
- Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comcustomers.codesys.com
Aug 3, 2021All versions of the CODESYS V3 Runtime Toolkit for VxWorks from version V3.5.8.0 and before version V3.5.17.10 have Improper Handling of Exceptional Conditions.CVE-2021-33486 · Other software · Codesys · reported by MITREHigh 7.5
All versions of the CODESYS V3 Runtime Toolkit for VxWorks from version V3.5.8.0 and before version V3.5.17.10 have Improper Handling of Exceptional Conditions.
- Product
- Runtime Toolkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comcustomers.codesys.com
Aug 3, 2021CODESYS Control Runtime system before 3.5.17.10 has a Heap-based Buffer Overflow.CVE-2021-33485 · Other software · Codesys · reported by MITRECritical 9.8
CODESYS Control Runtime system before 3.5.17.10 has a Heap-based Buffer Overflow.
- Product
- Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comcustomers.codesys.com
Aug 2, 2021A unsafe deserialization vulnerability exists in the ObjectManager.plugin ProfileInformation.ProfileData functionality of CODESYS GmbH CODESYS Development SysteCVE-2021-21866 · Other software · Codesys · reported by talos-cna@cisco.comHigh 7.8
A unsafe deserialization vulnerability exists in the ObjectManager.plugin ProfileInformation.ProfileData functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.
- Product
- Development System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comtalosintelligence.com
Aug 2, 2021A unsafe deserialization vulnerability exists in the PackageManagement.plugin ExtensionMethods.Clone() functionality of CODESYS GmbH CODESYS Development System CVE-2021-21865 · Other software · Codesys · reported by talos-cna@cisco.comHigh 7.8
A unsafe deserialization vulnerability exists in the PackageManagement.plugin ExtensionMethods.Clone() functionality of CODESYS GmbH CODESYS Development System 3.5.16. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.
- Product
- Development System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comtalosintelligence.com
Aug 2, 2021A unsafe deserialization vulnerability exists in the ComponentModel ComponentManager.StartupCultureSettings functionality of CODESYS GmbH CODESYS Development SyCVE-2021-21864 · Other software · Codesys · reported by talos-cna@cisco.comHigh 7.8
A unsafe deserialization vulnerability exists in the ComponentModel ComponentManager.StartupCultureSettings functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability.
- Product
- Development System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comtalosintelligence.com
May 25, 2021CODESYS V2 runtime system before 2.4.7.55 has Improper Input Validation.CVE-2021-30195 · Other software · Wago · reported by MITREHigh 7.5
CODESYS V2 runtime system before 2.4.7.55 has Improper Input Validation.
- Product
- 750-893 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comcustomers.codesys.com
May 25, 2021CODESYS V2 Web-Server before 1.1.9.20 has an Out-of-bounds Read.CVE-2021-30194 · Other software · Wago · reported by MITRECritical 9.1
CODESYS V2 Web-Server before 1.1.9.20 has an Out-of-bounds Read.
- Product
- 750-893 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comcustomers.codesys.com
May 25, 2021CODESYS V2 Web-Server before 1.1.9.20 has an Out-of-bounds Write.CVE-2021-30193 · Other software · Wago · reported by MITRECritical 9.8
CODESYS V2 Web-Server before 1.1.9.20 has an Out-of-bounds Write.
- Product
- 750-893 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comcustomers.codesys.com
May 25, 2021CODESYS V2 Web-Server before 1.1.9.20 has an Improperly Implemented Security Check.CVE-2021-30192 · Other software · Wago · reported by MITRECritical 9.8
CODESYS V2 Web-Server before 1.1.9.20 has an Improperly Implemented Security Check.
- Product
- 750-893 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comcustomers.codesys.com
May 25, 2021CODESYS V2 Web-Server before 1.1.9.20 has a a Buffer Copy without Checking the Size of the Input.CVE-2021-30191 · Other software · Wago · reported by MITREHigh 7.5
CODESYS V2 Web-Server before 1.1.9.20 has a a Buffer Copy without Checking the Size of the Input.
- Product
- 750-893 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comcustomers.codesys.com
May 25, 2021CODESYS V2 Web-Server before 1.1.9.20 has Improper Access Control.CVE-2021-30190 · Other software · Wago · reported by MITRECritical 9.8
CODESYS V2 Web-Server before 1.1.9.20 has Improper Access Control.
- Product
- 750-893 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comcustomers.codesys.com
May 25, 2021CODESYS V2 Web-Server before 1.1.9.20 has a Stack-based Buffer Overflow.CVE-2021-30189 · Other software · Wago · reported by MITRECritical 9.8
CODESYS V2 Web-Server before 1.1.9.20 has a Stack-based Buffer Overflow.
- Product
- 750-893 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comcustomers.codesys.com
May 25, 2021CODESYS V2 runtime system SP before 2.4.7.55 has a Stack-based Buffer Overflow.CVE-2021-30188 · Other software · Wago · reported by MITRECritical 9.8
CODESYS V2 runtime system SP before 2.4.7.55 has a Stack-based Buffer Overflow.
- Product
- 750-893 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comcustomers.codesys.com
May 25, 2021CODESYS V2 runtime system SP before 2.4.7.55 has a Heap-based Buffer Overflow.CVE-2021-30186 · Other software · Wago · reported by MITREHigh 7.5
CODESYS V2 runtime system SP before 2.4.7.55 has a Heap-based Buffer Overflow.
- Product
- 750-893 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comcustomers.codesys.com
May 25, 2021CODESYS V2 runtime system SP before 2.4.7.55 has Improper Neutralization of Special Elements used in an OS Command.CVE-2021-30187 · Other software · Wago · reported by MITREMedium 5.3
CODESYS V2 runtime system SP before 2.4.7.55 has Improper Neutralization of Special Elements used in an OS Command.
- Product
- 750-893 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comcustomers.codesys.com
May 4, 2021The Package Manager of CODESYS Development System 3 before 3.5.17.0 does not check the validity of packages before installation and may be used to install CODESCVE-2021-29240 · Other software · Codesys · reported by MITREHigh 7.8
The Package Manager of CODESYS Development System 3 before 3.5.17.0 does not check the validity of packages before installation and may be used to install CODESYS packages with malicious content.
- Product
- Development System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comcustomers.codesys.com
May 3, 2021CODESYS Control Runtime system before 3.5.17.0 has improper input validation.CVE-2021-29242 · Other software · Codesys · reported by MITREHigh 7.3
CODESYS Control Runtime system before 3.5.17.0 has improper input validation. Attackers can send crafted communication packets to change the router's addressing scheme and may re-route, add, remove or change low level communication packages.
- Product
- Control For Beaglebone SL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comcustomers.codesys.com
May 3, 2021CODESYS Gateway 3 before 3.5.16.70 has a NULL pointer dereference that may result in a denial of service (DoS).CVE-2021-29241 · Other software · Codesys · reported by MITREHigh 7.5
CODESYS Gateway 3 before 3.5.16.70 has a NULL pointer dereference that may result in a denial of service (DoS).
- Product
- Control For Beaglebone SL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comcustomers.codesys.com
May 3, 2021CODESYS Development System 3 before 3.5.17.0 displays or executes malicious documents or files embedded in libraries without first checking their validity.CVE-2021-29239 · Other software · Codesys · reported by MITREHigh 7.8
CODESYS Development System 3 before 3.5.17.0 displays or executes malicious documents or files embedded in libraries without first checking their validity.
- Product
- Development System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comcustomers.codesys.com
May 3, 2021CODESYS Automation Server before 1.16.0 allows cross-site request forgery (CSRF).CVE-2021-29238 · Other software · Codesys · reported by MITREHigh 8.8
CODESYS Automation Server before 1.16.0 allows cross-site request forgery (CSRF).
- Product
- Automation Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comcustomers.codesys.com
Jul 22, 2020CODESYS Control runtime system before 3.5.16.10 allows Uncontrolled Memory Allocation.CVE-2020-15806 · Other software · Codesys · reported by MITREHigh 7.5
CODESYS Control runtime system before 3.5.16.10 allows Uncontrolled Memory Allocation.
- Product
- Control For Beaglebone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comcodesys.com
May 14, 2020An issue was discovered in CODESYS Development System before 3.5.16.0.CVE-2020-12068 · Other software · Codesys · reported by MITREMedium 6.5
An issue was discovered in CODESYS Development System before 3.5.16.0. CODESYS WebVisu and CODESYS Remote TargetVisu are susceptible to privilege escalation.
- Product
- Control For Beaglebone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comcodesys.com
May 7, 2020An exploitable code execution vulnerability exists in the PLC_Task functionality of 3S-Smart Software Solutions GmbH CODESYS Runtime 3.5.14.30.CVE-2020-6081 · Other software · Codesys · reported by talos-cna@cisco.comHigh 8.8
An exploitable code execution vulnerability exists in the PLC_Task functionality of 3S-Smart Software Solutions GmbH CODESYS Runtime 3.5.14.30. A specially crafted network request can cause remote code execution. An attacker can send a malicious packet to trigger this vulnerability.
- Product
- Runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Mar 26, 2020An exploitable memory corruption vulnerability exists in the Name Service Client functionality of 3S-Smart Software Solutions CODESYS GatewayService.CVE-2019-5105 · Other software · Codesys · reported by talos-cna@cisco.comHigh 7.5
An exploitable memory corruption vulnerability exists in the Name Service Client functionality of 3S-Smart Software Solutions CODESYS GatewayService. A specially crafted packet can cause a large memcpy, resulting in an access violation and termination of the process. An attacker can send a packet to a device running the GatewayService.exe to trigger this vulnerability. All variants of the CODESYS V3 products in all versions prior V3.5.16.10 containing the CmpRouter or CmpRouterEmbedded component are affected, regardless of the CPU type or operating system: CODESYS Control for BeagleBone, CODESYS Control for emPC-A/iMX6, CODESYS Control for IOT2000, CODESYS Control for Linux, CODESYS Control for PLCnext, CODESYS Control for PFC100, CODESYS Control for PFC200, CODESYS Control for Raspberry Pi, CODESYS Control RTE V3, CODESYS Control RTE V3 (for Beckhoff CX), CODESYS Control Win V3 (also part of the CODESYS Development System setup), CODESYS Control V3 Runtime System Toolkit, CODESYS V3 Embedded Target Visu Toolkit, CODESYS V3 Remote Target Visu Toolkit, CODESYS V3 Safety SIL2, CODESYS Edge Gateway V3, CODESYS Gateway V3, CODESYS HMI V3, CODESYS OPC Server V3, CODESYS PLCHandler SDK,
- Product
- Codesys
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comtalosintelligence.com
Mar 26, 2020CODESYS V3 web server before 3.5.15.40, as used in CODESYS Control runtime systems, has a buffer overflow.CVE-2020-10245 · Other software · Codesys · reported by MITRECritical 9.8
CODESYS V3 web server before 3.5.15.40, as used in CODESYS Control runtime systems, has a buffer overflow.
- Product
- Control For Beaglebone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comtenable.com
Jan 24, 2020CODESYS Control V3, Gateway V3, and HMI V3 before 3.5.15.30 allow uncontrolled memory allocation which can result in a remote denial of service condition.CVE-2020-7052 · Other software · Codesys · reported by MITREMedium 6.5
CODESYS Control V3, Gateway V3, and HMI V3 before 3.5.15.30 allow uncontrolled memory allocation which can result in a remote denial of service condition.
- Product
- Control For Beaglebone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comtenable.com
Dec 20, 20193S-Smart CODESYS SP Realtime NT before V2.3.7.28, CODESYS Runtime Toolkit 32 bit full before V2.4.7.54, and CODESYS PLCWinNT before V2.4.7.54 allow a NULL pointCVE-2019-19789 · Other software · Codesys · reported by MITREMedium 6.5
3S-Smart CODESYS SP Realtime NT before V2.3.7.28, CODESYS Runtime Toolkit 32 bit full before V2.4.7.54, and CODESYS PLCWinNT before V2.4.7.54 allow a NULL pointer dereference.
- Product
- Plcwinnt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comcodesys.com
Nov 20, 2019CODESYS 3 web server before 3.5.15.20, as distributed with CODESYS Control runtime systems, has a Buffer Overflow.CVE-2019-18858 · Other software · Codesys · reported by MITRECritical 9.8
CODESYS 3 web server before 3.5.15.20, as distributed with CODESYS Control runtime systems, has a Buffer Overflow.
- Product
- Control For Beaglebone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comtenable.com
Oct 25, 2019CODESYS V2.3 ENI server up to V3.2.2.24 has a Buffer Overflow.CVE-2019-16265 · Other software · Codesys · reported by MITRECritical 9.8
CODESYS V2.3 ENI server up to V3.2.2.24 has a Buffer Overflow.
- Product
- ENI Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comcodesys.com
Sep 17, 20193S-Smart Software Solutions GmbH CODESYS V3 Library Manager, all versions prior to 3.5.16.0, allows the system to display active library content without checkinCVE-2019-13538 · Other software · Codesys · reported by ics-cert@hq.dhs.govHigh 8.6
3S-Smart Software Solutions GmbH CODESYS V3 Library Manager, all versions prior to 3.5.16.0, allows the system to display active library content without checking its validity, which may allow the contents of manipulated libraries to be displayed or executed. The issue also exists for source libraries, but 3S-Smart Software Solutions GmbH strongly recommends distributing compiled libraries only.
- Product
- Codesys
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comus-cert.gov
Sep 17, 20193S-Smart Software Solutions GmbH CODESYS V3 OPC UA Server, all versions 3.5.11.0 to 3.5.15.0, allows an attacker to send crafted requests from a trusted OPC UA CVE-2019-13542 · Other software · GmbH · reported by ics-cert@hq.dhs.govMedium 6.5
3S-Smart Software Solutions GmbH CODESYS V3 OPC UA Server, all versions 3.5.11.0 to 3.5.15.0, allows an attacker to send crafted requests from a trusted OPC UA client that cause a NULL pointer dereference, which may trigger a denial-of-service condition.
- Product
- 3S-Smart Software Solutions GmbH CODESYS V3 OPC UA Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.govus-cert.gov
Sep 17, 2019An issue was discovered in 3S-Smart CODESYS before 3.5.15.0 .CVE-2019-9009 · Other software · Codesys · reported by MITREHigh 7.5
An issue was discovered in 3S-Smart CODESYS before 3.5.15.0 . Crafted network packets cause the Control Runtime to crash.
- Product
- Control For Beaglebone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comus-cert.gov
Sep 17, 2019An issue was discovered in 3S-Smart CODESYS V3 through 3.5.12.30.CVE-2019-9008 · Other software · Codesys · reported by MITREHigh 8.8
An issue was discovered in 3S-Smart CODESYS V3 through 3.5.12.30. A user with low privileges can take full control over the runtime.
- Product
- Control For Beaglebone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcustomers.codesys.comcodesys.com
Sep 13, 2019CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which could cause a stack overflow aCVE-2019-13548 · Other software · Codesys · reported by ics-cert@hq.dhs.govCritical 9.8
CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which could cause a stack overflow and create a denial-of-service condition or allow remote code execution.
- Product
- Control For Beaglebone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.govus-cert.gov
Sep 13, 2019CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which may allow access to files outsCVE-2019-13532 · Other software · Codesys · reported by ics-cert@hq.dhs.govHigh 7.5
CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https requests which may allow access to files outside the restricted working directory of the controller.
- Product
- Control For Beaglebone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.govus-cert.gov
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.