Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
498 results · page 3 of 10
Oct 25, 2024In ProtocolMiscHwConfigChangeAdapter::GetData() of protocolmiscadapter.cpp, there is a possible out-of-bounds read due to a missing bounds check.CVE-2024-47015 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comMedium 5.5
In ProtocolMiscHwConfigChangeAdapter::GetData() of protocolmiscadapter.cpp, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with baseband firmware compromise required. User Interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2024iniNet Solutions SpiderControl SCADA PC HMI Editor has a path traversal vulnerability.CVE-2024-10313 · Other software · iniNet Solutions · reported by ics-cert@hq.dhs.govHigh 8.6
iniNet Solutions SpiderControl SCADA PC HMI Editor has a path traversal vulnerability. When the software loads a malicious ‘ems' project template file constructed by an attacker, it can write files to arbitrary directories. This can lead to overwriting system files, causing system paralysis, or writing to startup items, resulting in remote control.
- Product
- SpiderControl SCADA PC HMI Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2024In LAquis SCADA version 4.7.1.511, a cross-site scripting vulnerability could allow an attacker to inject arbitrary code into a web page.CVE-2024-9414 · Other software · LCDS - Leão Consultoria e Desenvolvimento de Sistemas Ltda ME · reported by ics-cert@hq.dhs.govHigh 7
In LAquis SCADA version 4.7.1.511, a cross-site scripting vulnerability could allow an attacker to inject arbitrary code into a web page. This could allow an attacker to steal cookies, redirect users, or perform unauthorized actions.
- Product
- LAquis SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2024CheckUser in ScadaServerEngine/MainLogic.cs in Rapid SCADA through 5.8.4 allows an empty password.CVE-2024-47221 · Other software · Rapidscada · reported by MITREHigh 7.5
CheckUser in ScadaServerEngine/MainLogic.cs in Rapid SCADA through 5.8.4 allows an empty password.
- Product
- Rapid Scada
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024SpiderControl SCADA Web Server has a vulnerability that could allow an attacker to upload specially crafted malicious files without authentication.CVE-2024-8232 · Other software · iniNet Solutions GmbH · reported by ics-cert@hq.dhs.govHigh 8.7
SpiderControl SCADA Web Server has a vulnerability that could allow an attacker to upload specially crafted malicious files without authentication.
- Product
- SpiderControl SCADA Web Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2024An HTTP parameter may contain a URL value and could cause the web application to redirect the request to the specified URL.CVE-2024-7941 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comMedium 4.3
An HTTP parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.
- Product
- MicroSCADA SYS600
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpublisher.hitachienergy.com
Aug 27, 2024The product exposes a service that is intended for local only to all network interfaces without any authentication.CVE-2024-7940 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comHigh 8.3
The product exposes a service that is intended for local only to all network interfaces without any authentication.
- Product
- MicroSCADA SYS600
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpublisher.hitachienergy.com
Aug 27, 2024A vulnerability exists in the query validation of the MicroSCADA Pro/X SYS600 product.CVE-2024-4872 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comCritical 9.9
A vulnerability exists in the query validation of the MicroSCADA Pro/X SYS600 product. If exploited this could allow an authenticated attacker to inject code towards persistent data. Note that to successfully exploit this vulnerability an attacker must have a valid credential.
- Product
- MicroSCADA X SYS600
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpublisher.hitachienergy.com
Aug 27, 2024An attacker with local access to machine where MicroSCADA X SYS600 is installed, could enable the session logging supporting the product and try to exploit a seCVE-2024-3982 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comHigh 8.2
An attacker with local access to machine where MicroSCADA X SYS600 is installed, could enable the session logging supporting the product and try to exploit a session hijacking of an already established session. By default, the session logging level is not enabled and only users with administrator rights can enable it.
- Product
- MicroSCADA SYS600
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpublisher.hitachienergy.com
Aug 27, 2024The MicroSCADA Pro/X SYS600 product allows an authenticated user input to control or influence paths or file names that are used in filesystem operations.CVE-2024-3980 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comCritical 9.9
The MicroSCADA Pro/X SYS600 product allows an authenticated user input to control or influence paths or file names that are used in filesystem operations. If exploited the vulnerability allows the attacker to access or modify system files or other files that are critical to the application.
- Product
- MicroSCADA X SYS600
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpublisher.hitachienergy.com
Aug 17, 2024A vulnerability has been found in Scada-LTS 2.7.8 and classified as problematic.CVE-2024-7901 · Other software · Scada-lts · reported by VulDBMedium 5.3
A vulnerability has been found in Scada-LTS 2.7.8 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /Scada-LTS/app.shtm#/alarms/Scada of the component Message Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: A fix is planned for the upcoming release at the end of September 2024.
- Product
- Scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2024mySCADA myPRO uses a hard-coded password which could allow an attacker to remotely execute code on the affected device.CVE-2024-4708 · Other software · mySCADA · reported by ics-cert@hq.dhs.govCritical 9.3
mySCADA myPRO uses a hard-coded password which could allow an attacker to remotely execute code on the affected device.
- Product
- myPRO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2024SDG Technologies PnPSCADA allows a remote attacker to attach various entities without requiring system authentication.CVE-2024-2882 · Other software · SDG Technologies · reported by ics-cert@hq.dhs.govCritical 9.3
SDG Technologies PnPSCADA allows a remote attacker to attach various entities without requiring system authentication. This breach could potentially lead to unauthorized control, data manipulation, and access to sensitive information within the SCADA system.
- Product
- PnPSCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2024There are multiple ways in LCDS LAquis SCADA for an attacker to access locations outside of their own directory.CVE-2024-5040 · Other software · LCDS · reported by ics-cert@hq.dhs.govHigh 8.5
There are multiple ways in LCDS LAquis SCADA for an attacker to access locations outside of their own directory.
- Product
- LAquis SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2024Triangle MicroWorks SCADA Data Gateway Restore Workspace Directory Traversal Remote Code Execution Vulnerability.CVE-2022-0369 · Other software · Triangle MicroWorks · reported by zdi-disclosures@trendmicro.comHigh 8.8
Triangle MicroWorks SCADA Data Gateway Restore Workspace Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Triangle MicroWorks SCADA Data Gateway. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the Restore Workspace feature. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-17227.
- Product
- SCADA Data Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
May 2, 2024Triangle MicroWorks SCADA Data Gateway DbasSectorFileToExecuteOnReset Exposed Dangerous Function Remote Code Execution Vulnerability.CVE-2023-39468 · Other software · Triangle MicroWorks · reported by zdi-disclosures@trendmicro.comHigh 7.2
Triangle MicroWorks SCADA Data Gateway DbasSectorFileToExecuteOnReset Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Triangle MicroWorks SCADA Data Gateway. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of DbasSectorFileToExecuteOnReset parameter. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-20799.
- Product
- SCADA Data Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrianglemicroworks.comzerodayinitiative.com
May 2, 2024Triangle MicroWorks SCADA Data Gateway certificate Information Disclosure Vulnerability.CVE-2023-39467 · Other software · Triangle MicroWorks · reported by zdi-disclosures@trendmicro.comMedium 5.3
Triangle MicroWorks SCADA Data Gateway certificate Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Triangle MicroWorks SCADA Data Gateway. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of certificate web directory. The issue results from the exposure of sensitive information in the application webroot. An attacker can leverage this vulnerability to disclose sensitive information. Was ZDI-CAN-20798.
- Product
- SCADA Data Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrianglemicroworks.comzerodayinitiative.com
May 2, 2024Triangle MicroWorks SCADA Data Gateway get_config Missing Authentication Information Disclosure Vulnerability.CVE-2023-39466 · Other software · Triangle MicroWorks · reported by zdi-disclosures@trendmicro.comMedium 5.3
Triangle MicroWorks SCADA Data Gateway get_config Missing Authentication Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Triangle MicroWorks SCADA Data Gateway. Authentication is not required to exploit this vulnerability. The specific flaw exists within the get_config endpoint. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose sensitive information. Was ZDI-CAN-20797.
- Product
- SCADA Data Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrianglemicroworks.comzerodayinitiative.com
May 2, 2024Triangle MicroWorks SCADA Data Gateway Use of Hard-coded Cryptograhic Key Information Disclosure Vulnerability.CVE-2023-39465 · Other software · Triangle MicroWorks · reported by zdi-disclosures@trendmicro.comHigh 7.5
Triangle MicroWorks SCADA Data Gateway Use of Hard-coded Cryptograhic Key Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Triangle MicroWorks SCADA Data Gateway. Authentication is not required to exploit this vulnerability. The specific flaw exists within the TmwCrypto class. The issue results from the usage of a hard-coded cryptograhic key and the usage of a hard-coded certificate. An attacker can leverage this vulnerability to disclose sensitive information. Was ZDI-CAN-20615.
- Product
- SCADA Data Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrianglemicroworks.comzerodayinitiative.com
May 2, 2024Triangle MicroWorks SCADA Data Gateway GTWWebMonitorService Unquoted Search Path Remote Code Execution Vulnerability.CVE-2023-39464 · Other software · Triangle MicroWorks · reported by zdi-disclosures@trendmicro.comHigh 7.2
Triangle MicroWorks SCADA Data Gateway GTWWebMonitorService Unquoted Search Path Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute code on affected installations of Triangle MicroWorks SCADA Data Gateway. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the configuration of the GTWWebMonitorService service. The path to the service executable contains spaces not surrounded by quotations. An attacker can leverage this vulnerability to execute arbitrary code in the context of root. Was ZDI-CAN-20538.
- Product
- SCADA Data Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrianglemicroworks.comzerodayinitiative.com
May 2, 2024Triangle MicroWorks SCADA Data Gateway Trusted Certification Unrestricted Upload of File Remote Code Execution Vulnerability.CVE-2023-39463 · Other software · Triangle MicroWorks · reported by zdi-disclosures@trendmicro.comHigh 7.2
Triangle MicroWorks SCADA Data Gateway Trusted Certification Unrestricted Upload of File Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Triangle MicroWorks SCADA Data Gateway. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the trusted certification feature. The issue lies in the handling of the OpcUaSecurityCertificateAuthorityTrustDir variable, which allows an arbitrary file write with attacker-controlled data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-20537.
- Product
- SCADA Data Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrianglemicroworks.comzerodayinitiative.com
May 2, 2024Triangle MicroWorks SCADA Data Gateway Workspace Unrestricted Upload Vulnerability.CVE-2023-39462 · Other software · Triangle MicroWorks · reported by zdi-disclosures@trendmicro.comMedium 6.5
Triangle MicroWorks SCADA Data Gateway Workspace Unrestricted Upload Vulnerability. This vulnerability allows remote attackers to upload arbitrary files on affected installations of Triangle MicroWorks SCADA Data Gateway. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of workspace files. The issue results from the lack of proper validation of user-supplied data, which can allow the upload of arbitrary files. An attacker can leverage this in conjunction with other vulnerabilitites to execute arbitrary code in the context of root. Was ZDI-CAN-20536.
- Product
- SCADA Data Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrianglemicroworks.comzerodayinitiative.com
May 2, 2024Triangle MicroWorks SCADA Data Gateway Event Log Improper Output Neutralization For Logs Arbitrary File Write Vulnerability.CVE-2023-39461 · Other software · Triangle MicroWorks · reported by zdi-disclosures@trendmicro.comMedium 4.4
Triangle MicroWorks SCADA Data Gateway Event Log Improper Output Neutralization For Logs Arbitrary File Write Vulnerability. This vulnerability allows remote attackers to write arbitrary files on affected installations of Triangle MicroWorks SCADA Data Gateway. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handling of event logs. The issue results from improper sanitization of log output. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-20535.
- Product
- SCADA Data Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrianglemicroworks.comzerodayinitiative.com
May 2, 2024Triangle MicroWorks SCADA Data Gateway Event Log Directory Traversal Arbitrary File Creation Vulnerability.CVE-2023-39460 · Other software · Triangle MicroWorks · reported by zdi-disclosures@trendmicro.comHigh 7.2
Triangle MicroWorks SCADA Data Gateway Event Log Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of Triangle MicroWorks SCADA Data Gateway. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the creation of event logs. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-20534.
- Product
- SCADA Data Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrianglemicroworks.comzerodayinitiative.com
May 2, 2024Triangle MicroWorks SCADA Data Gateway Directory Traversal Arbitrary File Creation Vulnerability.CVE-2023-39459 · Other software · Triangle MicroWorks · reported by zdi-disclosures@trendmicro.comHigh 7.8
Triangle MicroWorks SCADA Data Gateway Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of Triangle MicroWorks SCADA Data Gateway. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of workspace files. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to create files in the context of Administrator. Was ZDI-CAN-20531.
- Product
- SCADA Data Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrianglemicroworks.comzerodayinitiative.com
May 2, 2024Triangle MicroWorks SCADA Data Gateway Use of Hard-coded Credentials Authentication Bypass Vulnerability.CVE-2023-39458 · Other software · Triangle MicroWorks · reported by zdi-disclosures@trendmicro.comMedium 5.3
Triangle MicroWorks SCADA Data Gateway Use of Hard-coded Credentials Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Triangle MicroWorks SCADA Data Gateway. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of certificates. The service uses a hard-coded default SSL certificate. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-20509.
- Product
- SCADA Data Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrianglemicroworks.comzerodayinitiative.com
May 2, 2024Triangle MicroWorks SCADA Data Gateway Missing Authentication Vulnerability.CVE-2023-39457 · Other software · Triangle MicroWorks · reported by zdi-disclosures@trendmicro.comCritical 9.8
Triangle MicroWorks SCADA Data Gateway Missing Authentication Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Triangle MicroWorks SCADA Data Gateway. Authentication is not required to exploit this vulnerability. The specific flaw exists due to the lack of user authentication. The issue results from missing authentication in the default system configuration. An attacker can leverage this vulnerability to execute arbitrary code in the context of root. Was ZDI-CAN-20501.
- Product
- SCADA Data Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrianglemicroworks.comzerodayinitiative.com
Apr 30, 2024The entire parent directory - C:\ScadaPro and its sub-directories and files are configured by default to allow user, including unprivileged users, to write orCVE-2024-3746 · Other software · Measuresoft · reported by ics-cert@hq.dhs.govMedium 6.8
The entire parent directory - C:\ScadaPro and its sub-directories and files are configured by default to allow user, including unprivileged users, to write or overwrite files.
- Product
- ScadaPro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2024 There is an SQL injection vulnerability in Advantech WebAccess/SCADA software that allows an authenticated attacker to remotely inject SQL code in the databaseCVE-2024-2453 · Other software · Advantech · reported by ics-cert@hq.dhs.govMedium 6.4
There is an SQL injection vulnerability in Advantech WebAccess/SCADA software that allows an authenticated attacker to remotely inject SQL code in the database. Successful exploitation of this vulnerability could allow an attacker to read or modify data on the remote database.
- Product
- WebAccess/SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2024In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an attacker can append path traversal characters to the filename when using a specific commCVE-2024-22096 · Other software · Rapid Software LLC · reported by ics-cert@hq.dhs.govMedium 6.5
In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an attacker can append path traversal characters to the filename when using a specific command, allowing them to read arbitrary files from the system.
- Product
- Rapid SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrapidscada.orgcisa.gov
Feb 1, 2024In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an authorized user can write directly to the Scada directory.CVE-2024-22016 · Other software · Rapid Software LLC · reported by ics-cert@hq.dhs.govHigh 7.8
In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an authorized user can write directly to the Scada directory. This may allow privilege escalation.
- Product
- Rapid SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrapidscada.orgcisa.gov
Feb 1, 2024In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, the affected product stores plaintext credentials in various places.CVE-2024-21869 · Other software · Rapid Software LLC · reported by ics-cert@hq.dhs.govMedium 6.2
In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, the affected product stores plaintext credentials in various places. This may allow an attacker with local access to see them.
- Product
- Rapid SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrapidscada.orgcisa.gov
Feb 1, 2024In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, the affected product responds back with an error message containing sensitive data if it reCVE-2024-21866 · Other software · Rapid Software LLC · reported by ics-cert@hq.dhs.govMedium 5.3
In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, the affected product responds back with an error message containing sensitive data if it receives a specific malformed request.
- Product
- Rapid SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrapidscada.orgcisa.gov
Feb 1, 2024In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an attacker can redirect users to malicious pages through the login page.CVE-2024-21794 · Other software · Rapid Software LLC · reported by ics-cert@hq.dhs.govMedium 5.4
In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an attacker can redirect users to malicious pages through the login page.
- Product
- Rapid SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrapidscada.orgcisa.gov
Feb 1, 2024In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, the product uses hard-coded credentials, which may allow an attacker to connect to a specifCVE-2024-21764 · Other software · Rapid Software LLC · reported by ics-cert@hq.dhs.govCritical 9.8
In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, the product uses hard-coded credentials, which may allow an attacker to connect to a specific port.
- Product
- Rapid SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrapidscada.orgcisa.gov
Feb 1, 2024In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an attacker can supply a malicious configuration file by utilizing a Zip Slip vulnerabilityCVE-2024-21852 · Other software · Rapid Software LLC · reported by ics-cert@hq.dhs.govHigh 8.8
In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an attacker can supply a malicious configuration file by utilizing a Zip Slip vulnerability in the unpacking routine to achieve remote code execution.
- Product
- Rapid SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrapidscada.orgcisa.gov
Jan 12, 2024An issue was discovered in Scada-LTS v2.7.5.2 build 4551883606 and before, allows remote attackers with low-level authentication to escalate privileges, executeCVE-2023-33472 · Other software · scada-lts · reported by MITREHigh 8.8
An issue was discovered in Scada-LTS v2.7.5.2 build 4551883606 and before, allows remote attackers with low-level authentication to escalate privileges, execute arbitrary code, and obtain sensitive information via Event Handlers function.
- Product
- scada-lts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhev0x.github.iohev0x.github.io
Dec 8, 2023In SignalStrengthAdapter::FillGsmSignalStrength() of protocolmiscadapter.cpp, there is a possible out of bounds read due to a missing bounds check.CVE-2023-48411 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comMedium 5.5
In SignalStrengthAdapter::FillGsmSignalStrength() of protocolmiscadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with baseband firmware compromise required. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 8, 2023In ProtocolMiscCarrierConfigSimInfoIndAdapter of protocolmiscadapter.cpp, there is a possible out of bounds read due to a missing bounds check.CVE-2023-48404 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comHigh 7.5
In ProtocolMiscCarrierConfigSimInfoIndAdapter of protocolmiscadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Dec 8, 2023In ProtocolMiscATCommandAdapter::Init() of protocolmiscadapter.cpp, there is a possible out of bounds read due to a missing bounds check.CVE-2023-48399 · Computers, phones & browsers · Google · reported by dsap-vuln-management@google.comMedium 5.5
In ProtocolMiscATCommandAdapter::Init() of protocolmiscadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with baseband firmware compromise required. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 25, 2023 EisBaer Scada - CWE-749: Exposed Dangerous Method or FunctionCVE-2023-42494 · Other software · EisBaer Scada · reported by cna@cyber.gov.ilHigh 7.5
EisBaer Scada - CWE-749: Exposed Dangerous Method or Function
- Product
- v3.0.6433.1964
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023 EisBaer Scada - CWE-256: Plaintext Storage of a PasswordCVE-2023-42493 · Other software · EisBaer Scada · reported by cna@cyber.gov.ilHigh 7.1
EisBaer Scada - CWE-256: Plaintext Storage of a Password
- Product
- v3.0.6433.1964
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023 EisBaer Scada - CWE-321: Use of Hard-coded Cryptographic KeyCVE-2023-42492 · Other software · EisBaer Scada · reported by cna@cyber.gov.ilHigh 7.1
EisBaer Scada - CWE-321: Use of Hard-coded Cryptographic Key
- Product
- v3.0.6433.1964
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023EisBaer Scada - CWE-285: Improper AuthorizationCVE-2023-42491 · Other software · EisBaer Scada · reported by cna@cyber.gov.ilHigh 8.8
EisBaer Scada - CWE-285: Improper Authorization
- Product
- EisBaer Scada
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023 EisBaer Scada - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CVE-2023-42490 · Other software · EisBaer Scada · reported by cna@cyber.gov.ilHigh 7.5
EisBaer Scada - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- Product
- v3.0.6433.1964
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023 EisBaer Scada - CWE-732: Incorrect Permission Assignment for Critical ResourceCVE-2023-42489 · Other software · EisBaer Scada · reported by cna@cyber.gov.ilHigh 7.5
EisBaer Scada - CWE-732: Incorrect Permission Assignment for Critical Resource
- Product
- v3.0.6433.1964
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2023 EisBaer Scada - CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2023-42488 · Other software · EisBaer Scada · reported by cna@cyber.gov.ilHigh 7.5
EisBaer Scada - CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- Product
- v3.0.6433.1964
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2023In ProtocolMiscLceIndAdapter::GetConfLevel() of protocolmiscadapter.cpp, there is a possible out of bounds read due to a missing bounds check.CVE-2023-35648 · Computers, phones & browsers · Google · reported by security@android.comCritical 9.8
In ProtocolMiscLceIndAdapter::GetConfLevel() of protocolmiscadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with baseband firmware compromise required. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Sep 15, 2023A vulnerability classified as problematic was found in Supcon InPlant SCADA up to 20230901.CVE-2023-4986 · Other software · Supcon · reported by VulDBLow 2.5
A vulnerability classified as problematic was found in Supcon InPlant SCADA up to 20230901. Affected by this vulnerability is an unknown functionality of the file Project.xml. The manipulation leads to password hash with insufficient computational effort. Local access is required to approach this attack. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-239797 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- InPlant SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Sep 15, 2023A vulnerability classified as critical has been found in Supcon InPlant SCADA up to 20230901.CVE-2023-4985 · Other software · Supcon · reported by VulDBMedium 5.9
A vulnerability classified as critical has been found in Supcon InPlant SCADA up to 20230901. Affected is an unknown function of the file Project.xml. The manipulation leads to improper authentication. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-239796. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- InPlant SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comvuldb.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.