CVE Vulnerability Catalog

An insufficiently protected credentials issue exists in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*. If this vulnerability is exploited, sensitive information may be restored from a backup file.

A stack-based buffer overflow vulnerability exists in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*. Receiving a specially crafted request created and sent by a remote attacker may cause a denial-of-service (DoS) condition.

A missing authentication for critical function vulnerability exists in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*. An attacker may execute a REST API without authentication, which could allow the attacker to retrieve I/O values and/or control the output.

A plaintext storage of a password issue exists in CONPROSYS nano Series. An attacker with physical access to the product may obtain credentials.

An out-of-bounds write vulnerability exists in CONPROSYS nano Series. Receiving a specially crafted request created and sent by a remote attacker may cause a denial-of-service (DoS) condition.

A cross-site scripting vulnerability exists in CONPROSYS nano Series. If exploited, an arbitrary script may be executed on a logged-in user's web browser.

An unrestricted upload of a file with a dangerous type exists in CONPROSYS TM Series. A remote authenticated attacker can upload a specially crafted file, potentially leading to arbitrary command execution on the product.

An improper neutralization of special elements used in an OS command ('OS Command Injection') exists in CONPROSYS TM Series. An attacker who can log in to the product may execute arbitrary OS commands.

An exposure of information through directory listing issue exists in CONPROSYS PAC Series. Accessing a specific URL may allow a remote unauthenticated attacker to obtain the directory list without authentication.

An improper neutralization of special elements used in an OS command ('OS Command Injection') exists in CONPROSYS PAC Series. An attacker who can log in to the product may execute arbitrary OS commands.

A cross-site scripting vulnerability exists in CONPROSYS PAC Series. If exploited, an arbitrary script may be executed on a logged-in user's web browser.

An exposure of information through directory listing issue exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series. Accessing a specific URL may allow a remote unauthenticated attacker to obtain the directory list without authentication.

An improper neutralization of special elements used in an OS command ('OS Command Injection') exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series. An attacker who can log in to the product may execute arbitrary OS commands.

A cross-site scripting vulnerability exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series. If exploited, an arbitrary script may be executed in a logged-in user's web browser.

A buffer overflow vulnerability exists in Contec EC1000 series. A remote attacker can send a specially crafted request to the product's web service, potentially leading to arbitrary program execution.

A cross-site scripting vulnerability exists in Contec EC1000 series. If exploited, an arbitrary script may be executed in a logged-in user's web browser.

A buffer overflow vulnerability exists in Contec RP-WAH-SR Series. A remote attacker can send a specially crafted request to the product's web service, potentially leading to arbitrary program execution.

A cross-site scripting vulnerability exists in Contec RP-WAH-SR Series. If exploited, an arbitrary script may be executed in a logged-in user's web browser.

A path traversal vulnerability exists in SGA1000. An attacker with FTP access to the product may view and/or alter arbitrary files on the server.

A cross-site scripting vulnerability exists in SGA1000. If exploited, an arbitrary script may be executed in a logged-in user's web browser.