Skip to content
OpenAdvisories

Source

CERT@VDE

Source: https://certvde.com/en/advisories/

All Critical High Medium Low With exploited CVEs

96 results · Clear filters · Feed

  • Medium max 4.3
    VDE-2023-045 1 CVE

    Wago: Vulnerability in Smart Designer Web-Application

    An attacker with privileges can enumerate projects and usernames through an iterative process, by making a request to a specific endpoint.

  • Medium max 5.3
    VDE-2023-015 1 CVE

    WAGO: Improper privilege management in web-based management

    There is a misconfiguration of access rights to a configuration tool of the web-based-management for a specific user, which allows to reset passwords of other users (except root). This allows an authenticated attacker to elevate his privileges.

    WAGO
  • Medium max 4.3
    VDE-2023-041 1 CVE

    MB connect line: Vulnerability allows access to non-critical information in mbCONNECT24 and mymbCONNECT24

    In Red Lion Europe mbCONNECT24 and mymbCONNECT24 and Helmholz myREX24 and myREX24.virtual up to and including 2.14.2 an improperly implemented access validation allows an authenticated, low privileged attacker to gain read access to limited, non-critical devi…

    MB connect line
  • Medium max 4.3
    VDE-2023-043 1 CVE

    Helmholz: Vulnerability allows access to non-critical information in myREX24 and myREX24.virtual

    A vulnerability in the affected products allows an authenticated, low-privileged attacker to gain unauthorized read access to limited, non-critical device information. The issue arises from improper access validation.

    Helmholz
  • Medium max 4.8
    VDE-2023-012 1 CVE

    MB connect line: Cross-site Scripting vulnerability in mbNET/mbNET.rokey

    A stored XXS vulnerability has been found in mbNET and mbNET/.rokey in all versions before 7.3.2.

    MB connect line Red Lion Europe
  • Medium max 4.8
    VDE-2023-029 1 CVE

    Helmholz: Cross-site Scripting vulnerability in REX 200/REX 250

    A stored XXS vulnerability has been found in REX 200 and REX 250 in all versions before 7.3.2.

    Helmholz
  • Medium max 6.1
    VDE-2023-027 1 CVE

    AUMA: Reflected Cross-Site Scripting Vulnerability in SIMA Master Stations

    A reflected cross-site scripting vulnerability exists in the System Diagnostics Manager (SDM) component of SIMA² Master Stations.

    Auma
  • Medium max 6.5
    VDE-2023-019 15 CVEs

    CODESYS: Multiple Vulnerabilities in CmpApp CmpAppBP and CmpAppForce

    CODESYS Control V3 runtime systems are affected by several security vulnerabilities in the communication server implementations for the CODESYS protocol. These may be exploited by authenticated attackers.

    CODESYS
  • Medium max 5.9
    VDE-2022-054 1 CVE

    WAGO: Unauthenticated Configuration Export in web-based management in multiple devices

    A vulnerability in the web-based management (WBM) of WAGOs programmable logic controller (PLC) could allow an unauthenticated remote attacker to retrieve sensitive information.

    WAGO
  • Medium max 6.1
    VDE-2022-056 1 CVE

    Weidmueller: Multiple IoT and control products affected by JavaScript injection vulnerability

    A JavaScript injection vulnerability has been discovered in the XML editing system SCHEMA ST4 onlinehelp by Quanos Solutions GmbH. For details refer to CVE.This vulnerability may allow an attacker to inject JavaScript code via URL to the affected products

    Weidmueller
  • Medium max 5.3
    VDE-2022-011 1 CVE

    MB connect line: Unauthenticated user enumeration in mbCONNECT24 and mymbCONNECT24

    An issue was discovered in the mymbCONNECT24 and mbCONNECT24 software in all versions through V2.11.2.

    MB connect line
  • Medium max 6.5
    VDE-2022-006 1 CVE

    Endress+Hauser: FieldPort SFP50 Memory Corruption in Bluetooth Controller Firmware

    Possible memory corruption in BT controller when it receives an oversized LMP packet over 2-DH1 link and leads to denial of service.

    Endress+Hauser
  • Medium max 5.4
    VDE-2022-004 1 CVE

    WAGO: Web-Based Management Cross-Site Scripting

    The Web-Based Management (WBM) of WAGOs programmable logic controller (PLC) is typically used for administration, commissioning and updates.Various configuration pages of the device are vulnerable to reflected XSS (Cross-Site Scripting) attacks.

    WAGO
  • Medium max 5.3
    VDE-2020-051 1 CVE rev. 2

    Beckhoff: DoS-Vulnerability for TwinCAT OPC UA Server and IPC Diagnostics UA Server

    Some TwinCAT OPC UA Server and IPC Diagnostics UA Server versions from Beckhoff Automation GmbH & Co. KG are vulnerable to denial of service attacks. The attacker needs to send several specifically crafted requests to the running OPC UA server. After some of …

    first Apr 27, 2021
  • Medium max 5.6
    VDE-2018-009 3 CVEs rev. 2

    Pepperl+Fuchs: Security advisory for MELTDOWN and SPECTRE attacks in ecom mobile Devices

    Critical vulnerabilities within several CPUs have been identified by security researchers. These hardware vulnerabilities allow programs to learn about the contents of a system's memory, using side-channel attacks. Potential attack vectors against these vulne…

    Linux Microsoft Pepperl+Fuchs
    first Jul 6, 2018
  • Medium
    VDE-2018-005 1 CVE

    Phoenix Contact: FL SWITCH 3xxx/4xxx/48xx series through 1.33 allows Information Exposure

    Web interface CGI applications may copy the contents of the running configuration file to a commonly accessed file. Clever manipulation of a web login request can expose the contents of this file through to the web browser. A successful web interface login at…

    Phoenix Contact