Category
ICS / OT
4,112 known vulnerabilities.
873 results · Clear filters · Feed
-
Medium 5.9
A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i8…
-
Medium 5.9
A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i801, RUGGEDCOM i802, RUGGEDCOM i803, RUGGEDCOM M2100,…
-
Medium 6.7
A vulnerability has been identified in RUGGEDCOM i800 (All versions < V4.3.8), RUGGEDCOM i801 (All versions < V4.3.8), …
-
Medium 5.5
Due to usernames/passwords being stored in plaintext in Random Access Memory (RAM), a local, authenticated attacker cou…
-
Medium 6.1
The web interface of the 1734-AENTR communication module is vulnerable to stored XSS. A remote, unauthenticated attacke…
-
Medium 5.3
The web interface of the 1734-AENTR communication module mishandles authentication for HTTP POST requests. A remote, un…
-
Medium 4.2
OWASP Related Vulnerabilities in Hitachi Energy’s LinkOne Product
Cross-site Scripting (XSS) vulnerability in Hitachi Energy LinkOne allows an attacker that manages to exploit the vulnerability can take advantage to exploit multiple web attacks and stole sensitive information. This issue affects: Hitachi Energy LinkOne 3.20…
-
Medium 5.9
Buffer Over-read vulnerability in Mitsubishi Electric MC Works64 versions 4.00A to 4.04E, Mitsubishi Electric GENESIS64…
-
Medium 6.5CVE-2021-31558 EPSS 11%
Delta Electronics DIAEnergie (Update A)
DIAEnergie Version 1.7.5 and prior is vulnerable to stored cross-site scripting when an unauthenticated user injects arbitrary code into the parameter “descr” of the script “DIAE_hierarchyHandler.ashx”.
-
Medium 4.8
Phoenix Contact: FL MGUARD XSS through web-based management and REST API
In Phoenix Contact FL MGUARD 1102 and 1105 in Versions 1.4.0, 1.4.1 and 1.5.0 a user with high privileges can inject HTML code (XSS) through web-based management or the REST API with a manipulated certificate file.
-
Medium 5.5
A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 U…
-
Medium 6.5
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic …
-
Medium 5.3
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic …
-
Medium 6.5
Beckhoff: Relative path traversal vulnerability through TwinCAT OPC UA Server
TwinCAT OPC UA Server in TF6100 and TS6100 in product versions before 4.3.48.0 or with TcOpcUaServer versions below 3.2.0.194 are prone to a relative path traversal that allow administrators to create or delete any files on the system.
-
Medium 5.5CVE-2021-38488 EPSS 12%
Delta Electronics DIALink
Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter comment of the API events, which may allow an attacker to remotely execute cod…
-
Medium 5.5CVE-2021-38428 EPSS 11%
Delta Electronics DIALink
Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter name of the API schedule, which may allow an attacker to remotely execute code.
-
Medium 5.5
Delta Electronics DIALink
Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter name of the API devices, which may allow an attacker to remotely execute code.
-
Medium 5.9
Delta Electronics DIALink
The tag interface of Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to an attacker injecting formulas into the tag data. Those formulas may then be executed when it is opened with a spreadsheet application.
-
Medium 5.5
Delta Electronics DIALink
Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter supplier of the API maintenance, which may allow an attacker to remotely execu…
-
Medium 5.5
Delta Electronics DIALink
Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter deviceName of the API modbusWriter-Reader, which may allow an attacker to remo…
-
Medium 6.7
Certificate verification vulnerability in Update Manager of PCM600 Engineering Tool
A certificate validation vulnerability in PCM600 Update Manager allows attacker to get unwanted software packages to be installed on computer which has PCM600 installed.
-
Medium 6.5
CODESYS V2 runtime: Access of Uninitialized Pointer may result in denial-of-service
A crafted request may cause a read access to an uninitialized pointer in CODESYS V2 Runtime Toolkit 32 Bit full and PLCWinNT prior to versions V2.4.7.56, resulting in a denial-of-service condition.
-
Medium 6.5
ControlTouch Cloud Service vulnerability: Serial Number can be misused during commissioning phase.
The vulnerability origins in the commissioning process where an attacker of the ControlTouch can enter a serial number in a specific way to transfer the device virtually into her/his my.busch-jaeger.de or mybuildings.abb.com profile. A successful attacker can…
-
Medium 6.1
free@home System Access Point FW integrity check can be bypassed.
The vulnerability allows a successful attacker to bypass the integrity check of FW uploaded to the free@home System Access Point.
-
Medium 4.3
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). An unauthenticated attac…
-
Medium 4.3
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). The affected software ha…
-
Medium 4.3
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). The affected software ha…
-
Medium 4.3
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). An unauthenticated attac…
-
Medium 6.5
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). The affected software al…
-
Medium 6.5
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). The status provided by t…
-
Medium 5.5
In WirelessHART-Gateway versions 3.0.9 a vulnerability allows to read and write sensitive data in a cookie
Any cookie-stealing vulnerabilities within the application or browser would enable an attacker to steal the user's credentials to the PEPPERL+FUCHS WirelessHART-Gateway 3.0.9.
-
Medium 5.4
A vulnerability in WirelessHART-Gateway 3.0.8 it is possible to inject arbitrary JavaScript into the application's response
In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 it is possible to inject arbitrary JavaScript into the application's response.
-
Medium 5.5
A vulnerability in WirelessHART-Gateway <= 3.0.9 could lead to information exposure of sensitive information
In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.9 a form contains a password field with autocomplete enabled. The stored credentials can be captured by an attacker who gains control over the user's computer. Therefore the user must have logged in at least once.
-
Medium 5.4
A vulnerability in WirelessHART-Gateway <= 3.0.8 may allow remote attackers to rewrite links and URLs in cached pages to arbitrary strings
In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.8 a vulnerability may allow remote attackers to rewrite links and URLs in cached pages to arbitrary strings.
-
Medium 5.3
Denial of Service Vulnerability in Phoenix Contact FL SWITCH SMCS series products
In Phoenix Contact FL SWITCH SMCS series products in multiple versions fragmented TCP-Packets may cause a Denial of Service of Web-, SNMP- and ICMP-Echo services. The switching functionality of the device is not affected.
-
Medium 5.3
WAGO: PFC200 Denial of Service due to the number of connections to the runtime
On WAGO PFC200 devices in different firmware versions with special crafted packets an attacker with network access to the device could cause a denial of service for the login service of the runtime.
-
Medium 5.3
BECKHOFF: DoS-Vulnerability for TwinCAT OPC UA Server and IPC Diagnostics UA Server
TwinCAT OPC UA Server in versions up to 2.3.0.12 and IPC Diagnostics UA Server in versions up to 3.1.0.1 from Beckhoff Automation GmbH & Co. KG are vulnerable to denial of service attacks. The attacker needs to send several specifically crafted requests to th…
-
Medium 5.3
WAGO: Managed Switches: Unsecure Cookie settings
In multiple managed switches by WAGO in different versions special crafted requests can lead to cookies being transferred to third parties.
-
Medium 5.3
WAGO: Managed Switches: Storage of user credentials in a cookie
In multiple managed switches by WAGO in different versions the webserver cookies of the web based UI contain user credentials.
-
Medium 5.3
WAGO: Managed Switches: Exposure of sensitive information through directory listing
In multiple managed switches by WAGO in different versions the activated directory listing provides an attacker with the index of the resources located inside the directory.