Archive
August 2023
Vulnerabilities first published in this month (UTC), newest first.
594 results · Clear filters · Feed
-
High 7.8
A vulnerability has been identified in JT2Go (All versions < V14.2.0.5), Teamcenter Visualization V13.2 (All versions <…
-
High 7.8
A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0008), Tecnomatix Plant …
-
High 7.8
A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0008), Tecnomatix Plant …
-
High 7.8
A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0008), Tecnomatix Plant …
-
High 7.8
A vulnerability has been identified in SICAM TOOLBOX II (All versions < V07.10). The affected application's database se…
-
High 7.8
A vulnerability has been identified in Parasolid V34.1 (All versions < V34.1.258), Parasolid V35.0 (All versions < V35.…
-
High 7.8
A vulnerability has been identified in Parasolid V34.1 (All versions < V34.1.258), Parasolid V35.0 (All versions < V35.…
-
High 7.8
A vulnerability has been identified in Parasolid V34.1 (All versions < V34.1.258), Parasolid V35.0 (All versions < V35.…
-
High 7.8
A vulnerability has been identified in Parasolid V34.1 (All versions < V34.1.258), Parasolid V35.0 (All versions < V35.…
-
High 7.8
A vulnerability has been identified in Parasolid V34.1 (All versions < V34.1.258), Parasolid V35.0 (All versions < V35.…
-
High 7.8
A vulnerability has been identified in Parasolid V34.1 (All versions < V34.1.258), Parasolid V35.0 (All versions < V35.…
-
High 7.8
A vulnerability has been identified in Parasolid V34.1 (All versions < V34.1.258), Parasolid V35.0 (All versions < V35.…
-
High 7.8
A vulnerability has been identified in JT Open (All versions < V11.4), JT Utilities (All versions < V13.4). The affecte…
-
High 7.8
A vulnerability has been identified in JT Open (All versions < V11.4), JT Utilities (All versions < V13.4), Parasolid V…
-
High 7.8
A vulnerability has been identified in JT2Go (All versions < V14.2.0.5), Solid Edge SE2022 (All versions < V222.0 Updat…
-
High 8.8
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.4). The affected applications is vulnerabl…
-
High 7.8
A vulnerability has been identified in SICAM TOOLBOX II (All versions < V07.10). Affected applications do not properly …
-
High 7.8
A vulnerability has been identified in Siemens Software Center (All versions < V3.0). A DLL Hijacking vulnerability cou…
-
High 7.5
Buffer Over-read in Audio
Transient DOS in Audio while remapping channel buffer in media codec decoding.
-
High 8.4
Integer Overflow or Wraparound in Audio
Memory corruption while allocating memory in COmxApeDec module in Audio.
-
High 8.4
Integer Overflow or Wraparound in Audio
Memory Corruption in Audio while playing amrwbplus clips with modified content.
-
High 7.7
Key Management Errors in HLOS
Cryptographic issue in HLOS as derived keys used to encrypt/decrypt information is present on stack after use.
-
High 7.1
Improper Authentication in HLOS.
Cryptographic issue in HLOS due to improper authentication while performing key velocity checks using more than one key.
-
High 8.2
Buffer Over-read in Network Services
Information disclosure in Network Services due to buffer over-read while the device receives DNS response.
-
High 7.2
Privilege Escalation for Project Owner and Project User Admin Roles in Ops Manager
In MongoDB Ops Manager v5.0 prior to 5.0.22 and v6.0 prior to 6.0.17 it is possible for an authenticated user with project owner or project user admin access to generate an API key with the privileges of org owner resulting in privilege escalation.
-
High 7.2
Insufficient Session Expiration Vulnerability in Emagic Data Center Management Suite
This vulnerability exists in ESDS Emagic Data Center Management Suit due to non-expiry of session cookie. By reusing the stolen cookie, a remote attacker could gain unauthorized access to the targeted system.
-
High 8.8
OS Command Injection Vulnerability in Emagic Data Center Management Suite
This vulnerability exists in ESDS Emagic Data Center Management Suit due to lack of input sanitization in its Ping component. A remote authenticated attacker could exploit this by injecting OS commands on the targeted system. Successful exploitation of this v…
-
High 8.8
PHOENIX CONTACT: OS Command Injection in WP 6xxx Web panels
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges may use a specific HTTP DELETE request to gain full access to the device.
-
High 8.8
PHOENIX CONTACT: OS Command Injection in WP 6xxx Web panels
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges may use a specific HTTP POST releated to certificate operations to gain full access to the device.
-
High 8.8
PHOENIX CONTACT: Command Injection in WP 6xxx Web panels
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with low privileges may use a command injection in a HTTP POST request releated to font configuration operations to gain full access to the device.
-
High 8.8
SAP Commerce accepts empty passphrases.
SAP Commerce Cloud may accept an empty passphrase for user ID and passphrase authentication, allowing users to log into the system without a passphrase.
-
High 7.6
Cross-Site Scripting (XSS) vulnerability in SAP Business One
SAP business One allows - version 10.0, allows an attacker to insert malicious code into the content of a web page or application and gets it delivered to the client, resulting to Cross-site scripting. This could lead to harmful action affecting the Confident…
-
High 7.5
Improper Authorization check vulnerability in SAP Message Server
The ACL (Access Control List) of SAP Message Server - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, RNL64UC 7.22, RNL64UC 7.22EXT, RNL64UC 7.53, KRNL64NUC 7.22, KRNL64NUC 7.22EXT, can be bypassed in certain conditions, which may enable an authe…
-
High 7.6
Binary hijack in SAP BusinessObjects Business Intelligence (Installer)
SAP Business Objects Installer - versions 420, 430, allows an authenticated attacker within the network to overwrite an executable file created in a temporary directory during the installation process. On replacing this executable with a malicious file, an at…
-
High 7.8
Code Injection vulnerability in SAP PowerDesigner
SAP SQLA for PowerDesigner 17 bundled with SAP PowerDesigner 16.7 SP06 PL03, allows an attacker with local access to the system, to place a malicious library, that can be executed by the application. An attacker could thereby control the behavior of the appli…
-
High 7.1
SQL Injection vulnerability in SAP Business One B1i Layer
B1i module of SAP Business One - version 10.0, application allows an authenticated user with deep knowledge to send crafted queries over the network to read or modify the SQL data. On successful exploitation, the attacker can cause high impact on confidential…
-
High 8.8
wger Workout Manager Cross-Site Request Forgery vulnerability
Cross Site Request Forgery (CSRF) vulnerability in wger Project wger Workout Manager 2.2.0a3 allows a remote attacker to gain privileges via the user-management feature in the gym/views/gym.py, templates/gym/reset_user_password.html, templates/user/overview.h…
-
High 8.3
PrestaShop XSS vulnerability through Validate::isCleanHTML method
PrestaShop is an open source e-commerce web application. Versions prior to 1.7.8.10, 8.0.5, and 8.1.1 are vulnerable to cross-site scripting through the `isCleanHTML` method. Versions 1.7.8.10, 8.0.5, and 8.1.1 contain a patch. There are no known workarounds.
-
High 8.1
import-in-the-middle allows unsanitized user controlled input in module generation
import-in-the-middle is a module loading interceptor specifically for ESM modules. The import-in-the-middle loader works by generating a wrapper module on the fly. The wrapper uses the module specifier to load the original module and add some wrapping code. P…
-
High 8.1
Sentry vulnerable to privilege escalation via ApiTokensEndpoint
Sentry is an error tracking and performance monitoring platform. Starting in version 22.1.0 and prior to version 23.7.2, an attacker with access to a token with few or no scopes can query `/api/0/api-tokens/` for a list of all tokens created by a user, includ…