GHSA-4374-P667-P6C8 vulnerabilities
Vulnerabilities for packages: aws-ebs-csi-driver, flux-kustomize-controller, oauth2-proxy, goreleaser, prometheus-operator, atlantis, ollama, kubernetes-csi-external-resizer, crossplane-provider-aws, nats, istio-cni, up, gobuster, prometheus-bind-exporter, flux-image-automation-controller,...
7.5AI Score
GHSA-45X7-PX36-X8W8 vulnerabilities
Vulnerabilities for packages: terragrunt, flux-kustomize-controller, sops, oauth2-proxy, goreleaser, kyverno-policy-reporter, atlantis, ollama, cloudflared, rekor, actions-runner-controller, crossplane-provider-aws, nats-server, nats, istio-cni, kube-rbac-proxy, nri-mssql, tekton-pipelines, up,...
7.5AI Score
CVE-2024-0323 FTP uses unsecure encryption mechanisms
The FTP server used on the B&R Automation Runtime supports unsecure encryption mechanisms, such as SSLv3, TLSv1.0 and TLS1.1. An network-based attacker can exploit the flaws to conduct man-in-the-middle attacks or to decrypt communications between the affected product...
9.5AI Score
0.001EPSS
Exploit for HTTP Request Smuggling in Apache Http Server
CVE 2023 25690 - Proof of Concept Published: 7 March 2023...
8.1AI Score
0.007EPSS
Siemens Automation License Manager CVE-2012-4691 Denial of Service
The remote host has a version of Siemens Automation License Manager installed that is affected by an excessive memory consumption denial of service vulnerability that can be triggered by sending a specially crafted packet to the Automation Licensing Manager TCP service listening on port...
3.9AI Score
RHEL 7 / 8 : Red Hat Automation Platform 1.2.5 (RHSA-2021:3473)
The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:3473 advisory. Red Hat Ansible Automation Platform integrates Red Hats automation suite consisting of Red Hat Ansible Tower, Red Hat Ansible Engine, and...
8.2AI Score
A flaw was found in the Ansible Automation Platform. When creating a new keypair, the ec2_key module prints out the private key directly to the standard output. This flaw allows an attacker to fetch those keys from the log files, compromising the system's confidentiality, integrity, and...
6.8AI Score
0.0004EPSS
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many.....
6.9AI Score
0.003EPSS
Rockwell Automation Arena Simulation Software Free After Use Vulnerability
Rockwell Automation Arena Simulation Software is a suite of simulation software from Rockwell Automation that provides 3D animation and graphics capabilities. A free after-use vulnerability exists in Rockwell Automation Arena Simulation Software, which can be exploited by an attacker to insert...
7.8CVSS
6.9AI Score
0.0004EPSS
An issue was discovered in the GlobalWatchlist extension in MediaWiki through 1.36.2. The rev-deleted-user and ntimes messages were not properly escaped and allowed for users to inject HTML and...
6.6AI Score
0.001EPSS
Horde/Horde Groupware - Local File Inclusion
Horde before 3.2.4 and 3.3.3 and Horde Groupware before 1.1.5 are susceptible to local file inclusion in framework/Image/Image.php because it allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the Horde_Image driver...
6.7AI Score
0.04EPSS
Rockwell Automation MicroLogix 1100 PLC < FRN 10.0 Authentication Mechanism DoS
The Rockwell Automation MicroLogix 1100 PLC integrated web server is a firmware version that is prior to FRN 10.0. It is, therefore, affected by a denial of service vulnerability due to a failure of the authentication mechanism to properly handle remote connections or commands. A remote attacker...
2.3AI Score
Siemens Automation License Manager 'almaxcx.dll' ActiveX Arbitrary File Overwrite Vulnerability
The remote host has the almaxcx.dll ActiveX control that is affected by an arbitrary file overwrite vulnerability that can be triggered by providing an absolute path when calling the control's Save() method in a specially crafted HTML...
2.3AI Score
CVE-2022-3205 Controller: cross site scripting in automation controller ui
Cross site scripting in automation controller UI in Red Hat Ansible Automation Platform 1.2 and 2.0 where the project name is susceptible to XSS...
6.2AI Score
0.001EPSS
CVE-2024-29895 Cacti CVE-2024-29895 POC A command injection...
8.6AI Score
0.0004EPSS
Summary IBM WebSphere Adapter for FTP is shipped with IBM Business Automation Workflow and is vulnerable to a machine-in-the-middle attack. Vulnerability Details ** CVEID: CVE-2023-48795 DESCRIPTION: **OpenSSH is vulnerable to a machine-in-the-middle attack, caused by a flaw in the extension...
6.8AI Score
0.962EPSS
An issue was discovered in MediaWiki through 1.38.1. The lemma length of a Wikibase lexeme is currently capped at a thousand characters. Unfortunately, this length is not validated, allowing much larger lexemes to be created, which introduces various denial-of-service attack vectors within the...
6.6AI Score
0.002EPSS
Open-School 3.0/Community Edition 2.3 - Cross-Site Scripting
Open-School 3.0, and Community Edition 2.3, allows cross-site scripting via the osv/index.php?r=students/guardians/create id...
6AI Score
0.006EPSS
In GNU Less before 609, crafted data can result in "less -R" not filtering ANSI escape sequences sent to the...
7.3AI Score
0.002EPSS
Unified Automation UaGateway OPC UA Server Null Pointer Dereference Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Unified Automation UaGateway. Authentication is required to exploit this...
6.5CVSS
6.9AI Score
0.0005EPSS
[SECURITY] Fedora 40 Update: qt6-qtwebsockets-6.7.1-1.fc40
The QtWebSockets module implements the WebSocket protocol as specified in R FC 6455. It solely depends on Qt (no external...
6.2AI Score
Siemens Automation License Manager 5.x < 6.0.8 Privilege Escalation (SSA-388646)
The version of Siemens Automation License Manager installed on the remote host is version 5.x prior to 6.0.8. It is, therefore, affected by a privilege escalation vulnerability due to improper validation of user privileges when executing some operations. An authenticated, local attacker could...
4AI Score
An unquoted executable path exists in the Rockwell Automation FactoryTalk® Remote Access™ possibly resulting in remote code execution if exploited. While running the FTRA installer package, the executable path is not properly quoted, which could allow a threat actor to enter a malicious executable....
7.8AI Score
0.0004EPSS
Protection mechanism failure in some 3rd and 4th Generation Intel(R) Xeon(R) Processors when using Intel(R) SGX or Intel(R) TDX may allow a privileged user to potentially enable escalation of privilege via local...
7.2AI Score
0.001EPSS
In the Linux kernel, the following vulnerability has been resolved: net: ll_temac: platform_get_resource replaced by wrong function The function platform_get_resource was replaced with devm_platform_ioremap_resource_byname and is called using 0 as name. This eventually ends up in...
6.9AI Score
0.0004EPSS
In the Linux kernel, the following vulnerability has been resolved: net: ll_temac: platform_get_resource replaced by wrong function The function platform_get_resource was replaced with devm_platform_ioremap_resource_byname and is called using 0 as name. This eventually ends up in...
6.7AI Score
0.0004EPSS
In the Linux kernel, the following vulnerability has been resolved: net: ll_temac: platform_get_resource replaced by wrong function The function platform_get_resource was replaced with devm_platform_ioremap_resource_byname and is called using 0 as name. This eventually ends up in...
6.8AI Score
0.0004EPSS
Protection mechanism failure in some 3rd and 4th Generation Intel(R) Xeon(R) Processors when using Intel(R) SGX or Intel(R) TDX may allow a privileged user to potentially enable escalation of privilege via local...
6.1CVSS
7.4AI Score
0.001EPSS
andre-r-rowe-photography.seehouseat.com Cross Site Scripting vulnerability OBB-3844869
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently...
6.2AI Score
A vulnerability was found in Poly Trio 8800 7.2.6.0019 and classified as critical. Affected by this issue is some unknown functionality of the component Test Automation Mode. The manipulation leads to backdoor. It is possible to launch the attack on the physical device. The exploit has been...
6.6CVSS
7.1AI Score
0.0004EPSS
In the Linux kernel, the following vulnerability has been resolved: interconnect: Don't access req_list while it's being manipulated The icc_lock mutex was split into separate icc_lock and icc_bw_lock mutexes in [1] to avoid lockdep splats. However, this didn't adequately protect access to...
6.7AI Score
0.0004EPSS
Inductive Automation Ignition JavaSerializationCodec Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authentication is not required to exploit...
9.8CVSS
8.3AI Score
0.001EPSS
Inductive Automation Ignition ExtendedDocumentCodec Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authentication is required to exploit this...
8.8CVSS
8.3AI Score
0.0005EPSS
Inductive Automation Ignition ModuleInvoke Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authentication is required to exploit this...
8.8CVSS
8.3AI Score
0.0005EPSS
Inductive Automation Ignition ParameterVersionJavaSerializationCodec Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authentication is not...
9.8CVSS
8.3AI Score
0.001EPSS
Inductive Automation Ignition Base64Element Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authentication is required to exploit this...
7.2CVSS
8.3AI Score
0.0005EPSS
Inductive Automation Ignition downloadLaunchClientJar Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. User interaction is required to exploit this vulnerability in that the target.....
8CVSS
8AI Score
0.001EPSS
Inductive Automation Ignition AbstractGatewayFunction Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authentication is required to exploit this...
8.8CVSS
8.3AI Score
0.001EPSS
6.7AI Score
0.019EPSS
phpShowtime 2.0 - Directory Traversal
A directory traversal vulnerability in phpShowtime 2.0 allows remote attackers to list arbitrary directories and image files via a .. (dot dot) in the r parameter to...
6.7AI Score
0.013EPSS
Inductive Automation Ignition RunQuery Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. Authentication is required to exploit this vulnerability....
8.8CVSS
8.3AI Score
0.0005EPSS
Unified Automation UaGateway NodeManagerOpcUa Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Unified Automation UaGateway. Authentication is required to exploit this vulnerability when the...
9.1CVSS
8.3AI Score
0.0005EPSS
Unified Automation UaGateway AddServer XML Injection Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Unified Automation UaGateway. Authentication is required to exploit this vulnerability when the...
5.8CVSS
7.2AI Score
0.0005EPSS
Unified Automation UaGateway Certificate Parsing Integer Overflow Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Unified Automation UaGateway. Authentication is not required to exploit this...
8.6CVSS
6.9AI Score
0.001EPSS
Issue Overview: 2024-05-09: CVE-2022-33196 was added to this advisory. Insufficient granularity of access control in out-of-band management in some Intel(R) Atom and Intel Xeon Scalable Processors may allow a privileged user to potentially enable escalation of privilege via adjacent network...
7.2AI Score
0.0004EPSS
r-broker.ru Cross Site Scripting vulnerability OBB-3918433
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently...
6.2AI Score
Incorrect calculation in microcode keying mechanism for some Intel(R) Xeon(R) D Processors with Intel(R) SGX may allow a privileged user to potentially enable information disclosure via local...
5.3CVSS
6.4AI Score
0.0004EPSS
Unified Automation UaGateway OPC UA Server Improper Input Validation Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Unified Automation UaGateway. User interaction is required to exploit this...
6.5CVSS
6.7AI Score
0.0005EPSS
Inductive Automation Ignition getJavaExecutable Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. User interaction is required to exploit this vulnerability in...
8.8CVSS
8AI Score
0.001EPSS
Inductive Automation Ignition ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Inductive Automation Ignition. Authentication is not required to exploit this...
7.5CVSS
6.9AI Score
0.0005EPSS