CVE Vulnerability Catalog

An issue was discovered in Smiths-Medical CADD-Solis Medication Safety Software (versions 1.0, 2.0, 3.0, and 3.1) that allows an authenticated user to gain elevated privileges on the SQL database. This enables modification of drug libraries, addition and deletion of users, and changes to user permissions.

An INFORMATION EXPOSURE flaw was discovered in the BINOM3 Universal Multifunctional Electric Power Quality Meter. This vulnerability can be exploited to gain privileged access to the device.

An issue was discovered in BINOM3 Universal Multifunctional Electric Power Quality Meter related to lack of authentication for remote service, allowing access to application setup and configuration.

An issue was discovered on Phoenix Contact mGuard devices updated to Version 8.4.0, where updating the device resets the admin user's password to its default value.

A SQL injection vulnerability was discovered in Advantech WebAccess Version 8.1. To exploit this vulnerability, an attacker must supply malformed input to the WebAccess software.

An issue was discovered in Advantech WebAccess Version 8.1 that allows authentication bypass. A malicious user can access pages unrestricted by accessing a specific URL on the web server.

An issue was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11_U05, and VMU-C PV prior to firmware Version A17. Successful exploitation of this CROSS-SITE REQUEST FORGERY (CSRF) vulnerability can allow execution of unauthorized actions on the device such as configuration parameter changes, and saving modified configuration.

An access control flaw was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11_U05 and VMU-C PV prior to firmware Version A17, allowing access to most application functions without authentication.

An issue was discovered in Honeywell XL Web II controller XL1000C500 and XLWeb 500 related to improper privilege management. A user with low privileges can access a specific URL and change system parameters.

An issue was discovered in Honeywell XL Web II controller (XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior) related to storing passwords in clear text.

An issue exists in Honeywell XL Web II controllers, specifically XL1000C500 and XLWeb 500, related to the plaintext storage of passwords. Any user can disclose a password by accessing a specific URL.

Wykryto problem w różnych wersjach urządzeń Moxa NPort, który pozwala na aktualizację oprogramowania układowego przez sieć bez uwierzytelnienia. To może prowadzić do zdalnego wykonania kodu.

W urządzeniach Moxa NPort występuje problem z autoryzacją w wersjach przed określonymi numerami. Atakujący może wykorzystać atak brute force, aby określić parametry potrzebne do ominięcia uwierzytelnienia.

An issue was discovered in WAGO 750-8202/PFC200 prior to FW04, WAGO 750-881 prior to FW09, and WAGO 0758-0874-0000-0111 that allows a malicious user to edit and view settings without authentication by accessing a specific URL on the web server.

W urządzeniach Moxa NPort występuje problem z administracyjnymi hasłami, które mogą być próbowane bez konieczności uwierzytelnienia. Dotyczy to wielu wersji różnych serii NPort, w tym 5110, 5130, 5150, 5200, 5400, 5600 oraz innych.

An issue was discovered in Rockwell Automation Logix5000 Programmable Automation Controller versions FRN 16.00 through 21.00 related to the processing of malformed CIP packets. An attacker may exploit this vulnerability to overflow a stack-based buffer, potentially allowing code execution on the controller or causing a fault that results in a denial of service.

An issue was discovered in Moxa SoftCMS versions prior to 1.6 related to improper input sanitization. A remote attacker may gain access to SoftCMS with administrator privileges through specially crafted input (SQL INJECTION).

An issue was discovered in Siemens SICAM PAS before version 8.00 related to a factory account with hard-coded passwords. Attackers might gain privileged access to the database over Port 2638/TCP.

An issue was discovered in Lynxspring JENEsys BAS Bridge versions 1.1.8 and older related to insufficient safeguards in the application's database for protecting credentials.

An issue was discovered in IBHsoftec S7-SoftPLC prior to version 4.12b related to a buffer overflow in PLC controllers. Object memory can read a network packet larger than the available space, leading to a Heap-based Buffer Overflow.