Category
ICS / OT
4,112 known vulnerabilities.
873 results · Clear filters · Feed
-
Medium 6.5
CODESYS: Multiple products prone to Improper Input Validation
Multiple CODESYS products in multiple versions are prone to a improper input validation vulnerability. An authenticated remote attacker may craft specific requests that use the vulnerability leading to a denial-of-service condition.
-
Medium 4.3
CODESYS V3: Improper Input Validation
Improper Input Validation vulnerability in multiple CODESYS V3 products allows an authenticated remote attacker to block consecutive logins of a specific type.
-
Medium 4.7
Rockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting Attack
A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious user with admin privileges and network access to view user data and modify the web interface. Additionally, a malicious…
-
Medium 4.7
Rockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting Attack
A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious user with admin privileges and network access to view user data and modify the web interface. Additionally, a malicious…
-
Medium 4.7
Rockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting Attack
A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious user with admin privileges and network access to view user data and modify the web interface. Additionally, a malicious…
-
Medium 4.7
Rockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting Attack
A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious user with admin privileges and network access to view user data and modify the web interface. Additionally, a malicious…
-
Medium 4.7
Rockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting Attack
A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious user with admin privileges and network access to view user data and modify the web interface. Additionally, a malicious…
-
Medium 4.7
Rockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting Attack
A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious user with admin privileges and network access to view user data and modify the web interface. Additionally, a malicious…
-
Medium 5.5
Rockwell Automation ArmorStart ST Vulnerable to Cross-Site Scripting Attack
A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product A cross site scripting vulnerability was discovered that could potentially allow a malicious user to view and modify sensitive data or make the web page unavail…
-
Medium 5.3
A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Conne…
-
Medium 5.3
A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Conne…
-
Medium 5.9
A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Conne…
-
Medium 6.0
A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Conne…
-
Medium 4.3
A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Conne…
-
Medium 6.5
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause denial of service…
-
Medium 6.7
A CWE-613: Insufficient Session Expiration vulnerability exists that could allow an attacker to maintain unauthorized a…
-
Medium 5.6
A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exis…
-
Medium 6.1
A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists on …
-
Medium 6.1
A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists on …
-
Medium 6.5
A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause the user to be t…
-
Medium 6.3
A CWE-427 - Uncontrolled Search Path Element vulnerability exists that could allow an attacker with a local privileged …
-
Medium 5.5
A CWE-269: Improper Privilege Management vulnerability exists that could cause a local user to perform a denial of serv…
-
Medium 6.7
A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT (All versions…
-
Medium 5.9
A vulnerability has been identified in Polarion ALM (All versions < V22R2). The application contains a XML External Ent…
-
Medium 5.3
A vulnerability has been identified in Mendix Forgot Password (Mendix 7 compatible) (All versions < V3.7.1), Mendix For…
-
Medium 6.2
A vulnerability has been identified in SIMATIC IPC1047 (All versions), SIMATIC IPC1047E (All versions with maxView Stor…
-
Medium 5.4
Information Disclosure vulnerability in My Control System (on-premise)
Insecure Storage of Sensitive Information vulnerability in ABB My Control System (on-premise) allows an attacker who successfully exploited this vulnerability to gain access to the secure application data or take control of the application. Of the services th…
-
Medium 5.3
Improper Check for Unusual or Exceptional Conditions
Improper Input Validation vulnerability in ABB AC500 V2 PM5xx allows Client-Server Protocol Manipulation.This issue affects AC500 V2: from 2.0.0 before 2.8.6.
-
Medium 5.3CVE-2023-1258 Public exploit
Flow-X disclosure of sensitive information to unauthenticated users
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ABB Flow-X firmware on Flow-X embedded hardware (web service modules) allows Footprinting.This issue affects Flow-X: before 4.0.
-
Medium 4.8
SDM600 API permission check
A vulnerability exists in a SDM600 endpoint. An attacker could exploit this vulnerability by running multiple parallel requests, the SDM600 web services become busy rendering the application unresponsive. This issue affects: All SDM600 versions prior to versi…
-
Medium 6.5
CVE-2023-1137
Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability in which a low-level user could extract files and plaintext credentials of administrator users, resulting in privilege escalation.
-
Medium 6.5
A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could allow the …
-
Medium 6.5
A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Data Server TCP interface that coul…
-
Medium 6.5
A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could cause acce…
-
Medium 5.3
Rockwell Automation Modbus TCP AOI Server Could Leak Sensitive Information
Rockwell Automation Modbus TCP Server AOI prior to 2.04.00 is vulnerable to an unauthorized user sending a malformed message that could cause the controller to respond with a copy of the most recent response to the last valid request. If exploited, an unautho…
-
Medium 6.3
Easily guessable session ID's in NE843 Pulsar Plus Controller
Use of Insufficiently Random Values vulnerability in ABB Pulsar Plus System Controller NE843_S, ABB Infinity DC Power Plant.This issue affects Pulsar Plus System Controller NE843_S : comcode 150042936; Infinity DC Power Plant: H5692448 G104 G842 G224L G630-4 …
-
Medium 6.6
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.2). The client query handler of the affect…
-
Medium 5.0
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.2). The client query handler of the affect…
-
Medium 6.2
MMS File Transfer Vulnerability impact on Distribution Automation products
Improper Initialization vulnerability in ABB Relion protection relays - 611 series, ABB Relion protection relays - 615 series IEC 4.0 FP1, ABB Relion protection relays - 615 series CN 4.0 FP1, ABB Relion protection relays - 615 series IEC 5.0, ABB Relion prot…
-
Medium 5.3
WAGO: Origin validation error through CORS misconfiguration
A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combination with CVE-2022-45138 this could lead to disclosure of device information like CPU diagnostics. A…