4,105 results · Feed
-
High max 7.7ICSMA-25-072-01 2 CVEs
Philips Intellispace Cardiovascular (ISCV)
Successful exploitation of these vulnerabilities could allow an attacker to replay the session of the logged in ISCV user and gain access to patient records.
-
Critical max 9.8ICSA-25-077-03 1 CVE
Schneider Electric EcoStruxure Power Automation System
Schneider Electric is aware of a vulnerability in its WebHMI component used in EcoStruxure Power Automation System User Interface product and EcoStruxure Microgrid Operation Large (EMO-L) solution. EcoStruxure Power Automation System User Interface https://ww…
-
Medium max 6.0ICSA-25-077-04 1 CVE
Schneider Electric EcoStruxure Panel Server
Schneider Electric is aware of a vulnerability in its EcoStruxure Panel Server product, all models. The EcoStruxure Panel Server https://www.se.com/us/en/product-range/40739468-ecostruxure-panel-server/#products is a modular gateway with enhanced cybersecurit…
-
High max 7.5ICSA-25-084-01 1 CVE
ABB RMC-100
An update is available that resolves a vulnerability in the product versions listed as affected in this advisory. An attacker who successfully exploited this vulnerability could cause the web UI to stop.
-
High max 7.1
Siemens Mentor Nucleus Networking Module
The DHCP implementation of the networking component (Nucleus NET) in Nucleus Real-Time Operating System (RTOS) contains a vulnerability that could allow an attacker to change the IP address of an affected device to an invalid value. Siemens has released new v…
first Nov 12, 2019 -
High max 7.5
Siemens Nucleus Products IPv6 Stack
The IPv6 stack of the networking component (Nucleus NET) in Nucleus Real-Time Operating System (RTOS) contains two vulnerabilities when processing IPv6 headers which could allow an attacker to cause a denial of service condition. Siemens has released new vers…
first Apr 13, 2021 -
Medium max 9.1ICSA-25-072-02 2 CVEs
Siemens SINEMA Remote Connect Server
SINEMA Remote Connect Server before V3.2 SP3 is affected by multiple vulnerabilities. Siemens has released a new version for SINEMA Remote Connect Server and recommends to update to the latest version.
-
Critical max 9.8ICSA-25-072-05 1 CVE
Siemens SINAMICS S200
A specific range of produced SINAMICS S200 devices contains an unlocked bootloader vulnerability that could allow an attacker to download untrusted firmware that could damage or compromise the device. For delivered products listed below Siemens recommends cou…
-
Critical max 9.8ICSA-25-072-10 6 CVEs
Siemens SINEMA Remote Connect Client
SINEMA Remote Connect Client before V3.2 SP3 is affected by multiple vulnerabilities. Siemens has released a new version for SINEMA Remote Connect Client and recommends to update to the latest version.
-
High max 7.1ICSA-25-063-01 1 CVE
Carrier Block Load
Successful exploitation of this vulnerability could allow a malicious actor to execute arbitrary code with escalated privileges .
-
High max 8.4ICSA-25-063-06 1 CVE
Delta Electronics CNCSoft-G2
Successful exploitation of this vulnerability could allow an attacker to execute code remotely.
-
Critical max 9.8ICSA-25-063-07 4 CVEs
GMOD Apollo
Successful exploitation of these vulnerabilities could allow an attacker to escalate privileges, bypass authentication, upload malicious files, or disclose sensitive information.
-
Critical max 9.8
Edimax IC-7100 IP Camera
Successful exploitation of this vulnerability could allow an attacker to send specially crafted requests to achieve remote code execution on the device.
-
High max 8.8
Planet Fitness Workouts mobile apps do not properly validate TLS certificates
The Planet Fitness Workouts iOS and Android mobile apps fail to properly validate TLS certificates, allowing an attacker with appropriate network access to obtain session tokens and sensitive information. Planet Fitness first addressed this vulnerability in v…
first Sep 23, 2024 -
High max 7.5ICSMA-25-058-01 7 CVEs
Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application
Successful exploitation of these vulnerabilities could allow an attacker to expose information, inject code, manipulate data, or achieve cross-site scripting (XSS), resulting in full session compromise.
-
High max 7.2
Hitachi Energy Relion 670/650/SAM600-IO
Hitachi Energy is aware of a vulnerability report from U.S. Department of Energy CyTRICS researcher of a vulnerability in the Relion® 670/650/SAM600-IO series versions listed below. Remediation is available for some versions. Recommended actions for each affe…
first Nov 4, 2021 -
Medium max 6.7ICSA-25-063-03 1 CVE
Hitachi Energy MACH PS700
Hitachi Energy is aware of a vulnerability in third party component Intel Chipset Device Software, that affects MACH PS700 v2 product versions listed in this document. Authenticated malicious clients successfully exploiting this vulnerability could escalate t…
-
High max 7.5ICSA-25-065-01 8 CVEs
Hitachi Energy PCU400
Hitachi Energy is aware of the multiple vulnerabilities related to various versions of OpenSSL library components used in PCU400 versions listed in this document below for IEC62351-3 secure for IEC104/DNP3 or PCULogger tool. These vulnerabilities if exploited…
-
Critical max 9.8ICSA-25-133-01 16 CVEs
Hitachi Energy Service Suite
Hitachi Energy is aware of the multiple vulnerabilities related to open-source Apache Tomcat components that affect the Service Suite product versions listed in this document. An attacker successfully exploiting these vulnerabilities can cause confidentiality…
-
Critical max 8.8ICSA-25-133-03 4 CVEs
Hitachi Energy MACH GWS products
Hitachi Energy is aware of the multiple vulnerabilities that affect the MACH GWS product versions listed in this document. An attacker successfully exploiting these vulnerabilities can cause confidentiality, integrity and availability impacts. Please refer to…
-
Critical max 9.8
Contec Health CMS8000 Patient Monitor (Update A)
Successful exploitation of these vulnerabilities could allow an attacker to remotely send specially formatted UDP requests or connect to an unknown external network that would allow them to write arbitrary data, resulting in remote code execution. The device …
first Jan 30, 2025 -
High max 8.7ICSA-25-056-01 1 CVE
Rockwell Automation PowerFlex 755
Successful exploitation of this vulnerability could result in exposure of sensitive data.
-
High max 7.1ICSA-25-051-03 1 CVE
Carrier Block Load
Successful exploitation of this vulnerability could allow a malicious actor to execute arbitrary code with escalated privileges.
-
High max 7.5ICSA-25-051-05 1 CVE
Rapid Response Monitoring My Security Account App
Successful exploitation of this vulnerability could allow attacker to access sensitive information of other users.
-
Medium max 5.7ICSMA-25-051-01 1 CVE
Medixant RadiAnt DICOM Viewer
Successful exploitation of this vulnerability could allow an attacker to perform a machine-in-the-middle attack (MITM), resulting in malicious updates being delivered to the user.
-
Critical max 9.1
Ivanti Connect Secure and Ivanti Policy Secure external file control vulnerability
Ivanti Connect Secure and Ivanti Policy Secure contain a vulnerability that allows a remote, authenticated attacker to write arbitrary files. These vulnerabilities are addressed in Ivanti Connect Secure version 22.7R2.4 and Ivanti Policy Secure version 22.7R1…
first Feb 12, 2025 -
Medium max 6.3
TrueFiling authorization bypass via user-controlled keys
TrueFiling trusts some client-controlled identifiers passed in URL requests to retrieve information. Platform users must self-register for an account, and once authenticated, could manipulate those identifiers to gain partial access to case information and th…
first Jan 16, 2025 -
High max 8.4
Delta Electronics CNCSoft-G2 (Update A)
Successful exploitation of these vulnerabilities could cause a buffer overflow condition and allow remote code execution.
first Jul 9, 2024 -
Medium max 7.1
Rockwell Automation GuardLogix 5380 and 5580 (Update A)
Successful exploitation of this vulnerability could allow a remote, non-privileged user to send malicious requests resulting in a major nonrecoverable fault causing a denial-of-service condition.
first Feb 4, 2025 -
Critical max 9.9ICSA-25-051-06 1 CVE
Elseta Vinci Protocol Analyzer
Successful exploitation of this vulnerability could allow an attacker to escalate privileges and perform code execution on the affected system.
-
Critical max 10.0
ABB FLXEON Controllers
An update is available that resolves a privately reported vulnerability in the product versions listed as affected in this advisory. FLXEON devices are not intended to be internet-facing. A product advisory issued in June 2023 informed customers of this param…
first Jan 23, 2025 -
Medium max 5.0
TopQuadrant TopBraid EDG Insecure External Password Storage and XXE Vulnerabilities
TopQuadrant TopBraid EDG stores credentials for external services insecurely and processes untrusted XML entities. An authenticated attacker could obtain credentials for remote services, read local files, or access URLs.
first Sep 10, 2024 -
Critical max 8.7ICSA-25-044-15 2 CVEs
ORing IAP-420
Successful exploitation of these vulnerabilities could allow an attacker to invoke commands to compromise the device via the management interface.
-
Critical max 10.0ICSA-25-044-16 4 CVEs
mySCADA myPRO Manager
Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary OS commands, upload files, and obtain sensitive information without providing associated credentials.
-
High max 7.5ICSA-25-044-17 3 CVEs
Outback Power Mojave Inverter
Successful exploitation of these vulnerabilities could allow an attacker to access sensitive data or inject commands.
-
Critical max 9.8ICSA-25-044-18 1 CVE
Dingtian DT-R0 Series
Successful exploitation of this vulnerability could allow an unauthenticated attacker to modify the device settings and gain administrator access.
-
High max 7.1ICSMA-25-044-01 3 CVEs
Qardio Heart Health IOS and Android Application and QardioARM A100
Successful exploitation of these vulnerabilities could allow an attacker to obtain sensitive information, cause a denial-of-service condition, and obtain firmware files.
-
High max 7.2
2N Access Commander (Update A)
Successful exploitation of these vulnerabilities could allow an attacker to escalate their privileges, execute arbitrary code, or gain root access to the system.
first Nov 14, 2024 -
High max 8.6
Trimble Cityworks (Update A)
Successful exploitation of this vulnerability could allow an authenticated user to perform a remote code execution.
first Feb 6, 2025 -
High max 8.1ICSA-25-077-05 4 CVEs
Schneider Electric ASCO 5310/5350 Remote Annunciator
Schneider Electric is aware of multiple vulnerabilities in its ASCO 5310 Remote Annunciator and ASCO 5350 Remote Annunciator products. The ASCO 5310 Remote Annunciator and ASCO 5350 Remote Annunciator products are stand-alone, industrial grade interface devic…