CVE Vulnerability Catalog

A vulnerability has been found in SeldonIO MLServer up to 1.6.1. Affected is the function _extract_env of the file mlserver/env.py of the component environment_tarball Handler. Such manipulation leads to path traversal. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way.

A flaw has been found in DeepPavlov up to 1.7.0. This impacts the function untar of the component Model Download Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was detected in MosaicML Composer up to 0.32.1. This affects the function tarball.extractall of the file composer/utils/checkpoint.py of the component Checkpoint Extraction. The manipulation results in path traversal. The attack can be executed remotely. The vendor was contacted early about this disclosure.

In Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), and multiple Desigo PXC/PXM devices (All versions >= V2.3), the affected product does not properly validate input bounds before accessing packet data. This could allow an unauthenticated remote attacker to trigger memory reads outside the intended packet boundaries.

In RUGGEDCOM CROSSBOW (All versions < V6.0), affected devices do not properly perform server-side authorization checks for requests to modify the state of scheduled actions. This could allow an authenticated attacker with minimal privileges to retry, stop, or delete scheduled tasks without proper authorization.

In RUGGEDCOM CROSSBOW (All versions < V6.0), affected devices do not properly perform server-side authorization checks for requests to schedule special operations. This could allow an authenticated attacker with minimal privileges to schedule unauthorized operations on devices.

A vulnerability in RUGGEDCOM CROSSBOW (versions < V6.0) involves improper restriction of access to database queries used for subnet management. An authenticated attacker could read, modify, or delete subnet configurations, leading to unauthorized information disclosure and data manipulation.

A vulnerability in RUGGEDCOM CROSSBOW (versions < V6.0) is due to improper restriction of access to various database queries, allowing users to retrieve system-wide information not intended for their privilege level. An authenticated attacker could gather sensitive information about the system's infrastructure, including details on all devices, substations, users, and scheduled activities.

A vulnerability in RUGGEDCOM CROSSBOW (versions < V6.0) involves missing proper authorization checks for device disconnection requests. An authenticated attacker with minimal privileges could disconnect active sessions of other users, including administrators, leading to a denial of service.

In RUGGEDCOM CROSSBOW (all versions before V6.0), affected devices do not properly validate or sanitize input in device group or facility names processed during the Bulk Export workflow. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.

A vulnerability in RUGGEDCOM CROSSBOW (versions < V6.0) is due to lack of input validation and sanitization in the Name and Value fields for custom file labels. An authenticated attacker with administrative privileges could execute arbitrary SQL commands on the underlying database.

A vulnerability in RUGGEDCOM CROSSBOW (versions < V6.0) allows unauthorized access to sensitive configuration items via specific database queries. An authenticated attacker can retrieve administrative credentials for various internal systems, leading to unauthorized information disclosure and privilege escalation.

A vulnerability in RUGGEDCOM CROSSBOW (versions < V6.0) involves lack of validation and sanitization of firmware filenames during upload. An authenticated attacker with specific privileges can execute arbitrary SQL commands on the underlying database.

A vulnerability in RUGGEDCOM CROSSBOW (versions < V6.0) is due to lack of validation and sanitization of the Value field in notification conditions during Notification Profile configuration. An authenticated attacker with specific privileges can execute arbitrary SQL commands on the underlying database.

A vulnerability in RUGGEDCOM CROSSBOW (versions < V6.0) involves lack of validation and sanitization of facility names in the Bulk Import/Export workflow. An authenticated attacker with specific privileges can execute arbitrary SQL commands on the underlying database.

A vulnerability in .NET Client Library for SIMATIC S7 Webserver API (versions < V3.3.62) involves improper redaction of PLC restore passwords from HTTP error exception messages. An attacker with access to logs or other diagnostic output could obtain the plaintext restore password and potentially perform unauthorized operations on the PLC.

A vulnerability in .NET Client Library for SIMATIC S7 Webserver API (versions < V3.3.61) is due to lack of validation of filenames received from remote servers during ticket downloads. An attacker who can manipulate the ticket response can write arbitrary files outside the intended download directory and, when overwriting is enabled, replace existing files accessible to the application.

A vulnerability in Industrial Edge App Publisher (versions < V1.27.9) is due to lack of sanitization of data received from the backend before rendering in the user interface. Because the front end is integrated with Node.js, this allows execution of arbitrary JavaScript, which can be leveraged to achieve remote code execution (RCE) on the victim's machine.

A vulnerability in Industrial Edge App Publisher (versions < V1.27.9) is due to lack of server certificate validation when initiating a TLS connection. This allows an attacker to intercept and relay communication (Man-in-the-Middle attack) and to spoof a trusted entity.

A vulnerability in SIMATIC IPC BX-21A, SIMATIC IPC RW-543A, and SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G is due to the presence of a BIOS vendor test key in the UEFI Secure Boot key database. A local attacker with physical or administrative access can boot an operating system or UEFI application signed with that test key, bypassing UEFI Secure Boot protections even when Secure Boot is enabled, potentially leading to a full loss of confidentiality, integrity, and availability of the device.