Category
ICS / OT
4,112 known vulnerabilities.
425 results · Clear filters · Feed
-
Critical 9.8
Partial string comparison in CODESYS gateway server
In CODESYS Gateway Server V2 for versions prior to V2.3.9.38 only a part of the the specified password is been compared to the real CODESYS Gateway password. An attacker may perform authentication by specifying a small password that matches the corresponding …
-
Critical 9.8
Insufficient Verification of Data Vulnerability in ProConOS/ProConOS eCLR SDK and MULTIPROG Engineering tool
An unauthenticated, remote attacker could upload malicious logic to the devices based on ProConOS/ProConOS eCLR in order to gain full control over the device.
-
Critical 9.8
Insufficient Verification of Data Vulnerability in PHOENIX CONTACT classic line industrial controllers
An unauthenticated, remote attacker could upload malicious logic to devices based on ProConOS/ProConOS eCLR in order to gain full control over the device.
-
Critical 9.8
A vulnerability has been identified in SICAM GridEdge (Classic) (All versions < V2.6.6). The affected application does …
-
Critical 9.4
A CWE-798: Use of Hard-coded Credentials vulnerability exists that could allow arbitrary code to be executed when root …
-
Critical 9.1
Remote Code Execution in all versions of various RAD-ISM-900-EN-* devices by PHOENIX CONTACT
On various RAD-ISM-900-EN-* devices by PHOENIX CONTACT an admin user could use the configuration file uploader in the WebUI to execute arbitrary code with root privileges on the OS due to an improper validation of an integrity check value in all versions of t…
-
Critical 9.1
Remote Code Execution in all versions of various RAD-ISM-900-EN-* devices by PHOENIX CONTACT
On various RAD-ISM-900-EN-* devices by PHOENIX CONTACT an admin user could use the traceroute utility integrated in the WebUI to execute arbitrary code with root privileges on the OS due to an improper input validation in all versions of the firmware.
-
Critical 9.0
Arctic Wireless Gateway Firewall vulnerability
A vulnerability in ABB ARG600 Wireless Gateway series that could allow an attacker to exploit the vulnerability by remotely connecting to the serial port gateway, and/or protocol converter, depending on the configuration.
-
Critical 9.8
A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not properly validate paramet…
-
Critical 9.8CVE-2022-1378 EPSS 19%
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_…
-
Critical 9.8
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_…
-
Critical 9.8
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_…
-
Critical 9.8
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_…
-
Critical 9.8
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_…
-
Critical 9.8
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in dlSlo…
-
Critical 9.8
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in ReadR…
-
Critical 9.8
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in ReadR…
-
Critical 9.8
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in ReadR…
-
Critical 9.8CVE-2022-1367 EPSS 19%
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in Handl…
-
Critical 9.8CVE-2022-1366 EPSS 19%
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in Handl…
-
Critical 10.0
An authentication bypass vulnerability exists in the Web Application functionality of Moxa MXView Series 3.2.4. A speci…
-
Critical 10.0
ICSA-22-090-05 Rockwell Automation Logix Controllers
An attacker with the ability to modify a user program may change user program code on some ControlLogix, CompactLogix, and GuardLogix Control systems. Studio 5000 Logix Designer writes user-readable program code to a separate location than the executed compil…
-
Critical 9.8
Moxa NPort IAW5000A-I/O Series Serial Device Server Stack-based Buffer Overflow
Five buffer overflows in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote attacker to initiate a denial-of-service attack and execute arbitrary code.
-
Critical 9.8
Moxa NPort IAW5000A-I/O Series Serial Device Server Improper Input Validation
Improper input validation in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote attacker to execute commands.
-
Critical 9.8
Delta Electronics DIAEnergie SQL Injection in GetCalcTagList
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in GetCalcTagList. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.
-
Critical 9.8
Delta Electronics DIAEnergie SQL Injection in GetDemandAnalysisData
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in GetDemandAnalysisData. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system co…
-
Critical 9.8
Delta Electronics DIAEnergie SQL Injection in DIAE_hierarchyHandler.ashx
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in HandlerPageP_KID.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system command…
-
Critical 9.8
Delta Electronics DIAEnergie SQL Injection in DIAE_tagHandler.ashx
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in DIAE_tagHandler.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system com…
-
Critical 9.8
Delta Electronics DIAEnergie SQL Injection in HandlerDialogECC.ashx
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in HandlerECC.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.
-
Critical 9.8
Delta Electronics DIAEnergie SQL Injection in DIAE_HandlerTag_KID.ashx
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_loopmapHandler.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system comm…
-
Critical 9.8
Delta Electronics DIAEnergie SQL Injection in HandlerExport.ashx/Calendar.ashx
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in HandlerExport.ashx/Calendar. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute sys…
-
Critical 9.8
Delta Electronics DIAEnergie SQL Injection in DIAE_eccoefficientHandler.ashx
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in DIAE_eccoefficientHandler.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute …
-
Critical 9.8
Delta Electronics DIAEnergie SQL Injection in GetLatestDemandNode and GetDemandAnalysisData
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in GetLatestDemandNode. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.
-
Critical 9.8
Delta Electronics DIAEnergie SQL Injection in DIAE_dmdsetHandler.ashx
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in DIAE_dmdsetHandler.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system …
-
Critical 9.8
Delta Electronics DIAEnergie SQL Injection in DIAE_hierarchyHandler.ashx
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in HandlerTag_KID.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.
-
Critical 9.8
Delta Electronics DIAEnergie SQL Injection in HandlerDialog_KID.ashx
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in HandlerDialog_KID.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system c…
-
Critical 9.8
Delta Electronics DIAEnergie SQL Injection in HandlerPage_KID.ashx
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in HandlerPage_KID.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system com…
-
Critical 9.8CVE-2022-25347 EPSS 11%
Delta Electronics DIAEnergie Path Traversal
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) is vulnerable to path traversal attacks, which may allow an attacker to write arbitrary files to locations on the file system.
-
Critical 9.8
Delta Electronics DIAEnergie SQL Injection in HandlerCommon.ashx
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in HandlerCommon.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system comma…
-
Critical 9.8
Delta Electronics DIAEnergie SQL Injection in GetQueryData
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in GetQueryData. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.