Category
ICS / OT
4,112 known vulnerabilities.
873 results · Clear filters · Feed
-
Medium 5.9
A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause manipulation of …
-
Medium 5.3
Denial-of-Service Vulnerability in MELSEC iQ-F Series
Overly Restrictive Account Lockout Mechanism vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series allows a remote unauthenticated attacker to lockout legitimate users for a certain period by repeatedly attempting to login with incorrect passwor…
-
Medium 6.5
Lack of buffer clearing before reuse may result in incorrect system behavior.
The Honeywell Experion PKS and OneWireless WDM contains Sensitive Information in Resource vulnerability in the component Control Data Access (CDA). An attacker could potentially exploit this vulnerability, leading to a Communication Channel Manipulation, whic…
-
Medium 6.5
Weak Password Requirements vulnerability in Mitsubishi Electric Corporation photovoltaic system monitor “EcoGuideTAB” P…
-
Medium 4.8
A vulnerability has been identified in RUGGEDCOM i800 (All versions), RUGGEDCOM i801 (All versions), RUGGEDCOM i802 (Al…
-
Medium 5.3
A vulnerability has been identified in RUGGEDCOM i800 (All versions), RUGGEDCOM i801 (All versions), RUGGEDCOM i802 (Al…
-
Medium 5.3
A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V11.0), SIPROTEC 5 6MD85 (CP300) (All v…
-
Medium 6.5
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0). The affected application allows to contro…
-
Medium 4.3
A vulnerability has been identified in TIA Project-Server (All versions < V2.1.1), TIA Project-Server V17 (All versions…
-
Medium 6.2
A vulnerability has been identified in TIA Administrator (All versions < V3.0.6). The affected application improperly v…
-
Medium 6.5
Phoenix Contact: DoS of the PLC due to incorrect default permissions possible
An low privileged remote attacker can enforce the watchdog of the affected devices to reboot the PLC due to incorrect default permissions of a config file.
-
Medium 5.2
USB-C Buffer Overflow via Display Interface in EV Charging Stations
A physical attacker with access to the device display via USB-C can send a message to the device which triggers an unsecure copy to a buffer resulting in loss of integrity and a temporary denial-of-service for the stations until they got restarted by the watc…
-
Medium 5.3
MQTT DoS Vulnerability in German EV Charging Stations
An unauthenticated remote attacker can use MQTT messages to crash a service on charging stations complying with German Calibration Law, resulting in a temporary denial-of-service for these stations until they got restarted by the watchdog.
-
Medium 5.3
Hard Coded Key used for AES encryption
Use of Hard-coded Cryptographic Key vulnerability in ABB RMC-100, ABB RMC-100 LITE. An attacker can gain access to salted information to decrypt MQTT information. This issue affects RMC-100: from 2105457-043 through 2105457-045; RMC-100 LITE: from 2106229-015…
-
Medium 6.5
Authentication Bypass to the MQTT configuration Web Interface
Use of Hard-coded Cryptographic Key vulnerability in ABB RMC-100, ABB RMC-100 LITE. When the REST interface is enabled by the user, and an attacker gains access to source code and control network, the attacker can bypass the REST interface authentication and …
-
Medium 6.7
Application does not invalidate session after password reset
Insufficient Session Expiration vulnerability in ABB Lite Panel Pro.This issue affects Lite Panel Pro: through 1.0.1.
-
Medium 6.5
A vulnerability exists in the IEC 61850 in MicroSCADA X SYS600 product. The certificate validation of the TLS protocol …
-
Medium 6.5
A vulnerability exists in the Web interface of the MicroSCADA X SYS600 product. The filtering query in the Web interfac…
-
Medium 6.5
A vulnerability exists in the IEC 61850 of the MicroSCADA X SYS600 product. An IEC 61850-8 crafted message content from…
-
Medium 6.1
A vulnerability exists in MicroSCADA X SYS600 product. If exploited this could allow a local unauthenticated attacker t…
-
Medium 6.5
An authenticated user with file access privilege via FTP access can cause the Relion 670/650 and SAM600-IO series devic…
-
Medium 4.9
Unauthenticated File Read via Web Interface
A web application for configuring the controller is accessible at a specific path. It contains an endpoint that allows a high privileged remote attacker to read files from the system’s file structure.
-
Medium 6.5
Overly Permissive CORS Policy in WAGO Device Manager
An unauthenticated remote attacker can trick an admin to visit a website containing malicious java script code. The current overly permissive CORS policy allows the attacker to obtain any files from the file system.
-
Medium 6.1
A vulnerability has been identified in Mendix Studio Pro 10 (All versions < V10.24.24 for Windows), Mendix Studio Pro 1…
-
Medium 4.8
A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions < V3.2), SCALANCE XCH328 (6GK53…
-
Medium 4.3
A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions < V3.2), SCALANCE XCH328 (6GK53…
-
Medium 6.5
A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions < V3.2), SCALANCE XCH328 (6GK53…
-
Medium 4.3
A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions < V3.1), SCALANCE XC316-8 (6GK5…
-
Medium 5.4
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists impac…
-
Medium 6.5
CWE-20: Improper Input Validation vulnerability exists that could cause Denial of Service when an authenticated malicio…
-
Medium 5.4
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists impac…
-
Medium 6.5
CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause Denial of Service when an authenticate…
-
Medium 5.4
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists in Ce…
-
Medium 6.5
CWE-20: Improper Input Validation vulnerability exists that could cause Denial of Service when an authenticated malicio…
-
Medium 5.5
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists…
-
Medium 5.4
CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability exists when …
-
Medium 4.9
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could …
-
Medium 4.3
WAGO: Switches affected by year 2k38 problem
A low privileged attacker can set the date of the devices to the 19th of January 2038 an therefore exceed the 32-Bit time limit. This causes the date of the switch to be set back to January 1st, 1970.
-
Medium 6.5
A vulnerability exists in the media upload component of the Asset Suite versions listed below. If successfully exploite…
-
Medium 6.2
A vulnerability has been identified in Building X - Security Manager Edge Controller (ACC-AP) (All versions). Affected …