CVE Vulnerability Catalog

A vulnerability affects devices that do not properly sanitize calculated signal data contained in imported calculated signal files before rendering it on the Trace page. An attacker could social engineer an authorized user with 'Read diagnostics' right into importing a specially crafted file, allowing attacker-controlled JavaScript to execute in the user's browser session and perform PLC operations within the user's authorization scope.

A vulnerability affects devices that do not properly sanitize calculated signal names contained in imported CSV trace files before including them in error messages on the Trace page. An attacker could social engineer an authorized user with 'Read diagnostics' right into importing a specially crafted trace file, allowing attacker-controlled JavaScript to execute in the user's browser session when the error message is displayed.

A vulnerability affects devices that do not properly sanitize signal names contained in imported CSV trace files before rendering them in selection menus on the Trace page. An attacker could social engineer an authorized user with 'Read diagnostics' right into importing a specially crafted trace file, allowing attacker-controlled JavaScript to execute in the user's browser session when the user interacts with an affected selection menu.

Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page. An attacker can socially engineer an authorized user with the 'Read diagnostics' right into importing a crafted trace file.

Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page. An attacker can socially engineer an authorized user with the 'Read diagnostics' right into importing a crafted trace file.

A vulnerability affects devices that do not properly sanitize calculated signal data contained in imported CSV trace files before rendering it on the Trace page. An attacker could social engineer an authorized user with 'Read diagnostics' right into importing a specially crafted trace file, allowing attacker-controlled JavaScript to execute in the user's browser session and perform PLC operations within the user's authorization scope.

A vulnerability affects devices that do not properly validate and sanitize visual properties of calculated signals contained in imported CSV trace files before rendering them on the Trace page. An attacker could social engineer an authorized user with 'Read diagnostics' right into importing a specially crafted trace file, allowing attacker-controlled JavaScript to execute in the user's browser session and perform PLC operations within the user's authorization scope.

Affected devices do not properly restrict executable content contained in imported trace files. An attacker can socially engineer an authorized user with the 'Read diagnostics' right into importing a crafted trace file.

A vulnerability in SIMATIC WinCC V7.5, V8.0, and V8.1 is due to insufficient restriction of permissions assigned to a database role. An authenticated remote attacker with database access can escalate privileges and execute arbitrary commands on the host system where SIMATIC WinCC is installed, potentially leading to system compromise.

Affected systems do not properly restrict access to internal APIs and paths for authenticated users. An authenticated remote attacker could access sensitive internal information.

A vulnerability in Siemens Industrial Edge Cloud Device, Industrial Edge Device Kit, and other Industrial Edge devices. The systems do not properly restrict access to internal APIs and paths for authenticated users, which could allow a remote attacker to access sensitive internal information.

A flaw was found in m17n-lib. An attacker who supplies crafted input to an application processing ISO-2022 encoded text can cause the library to read uninitialized memory from the stack. This can result in unexpected behavior and limited information disclosure.

TYPO3 forms using FileUpload or ImageUpload elements with a custom saveToFileMount stored uploaded files in the default storage folder 1:/user_upload/ instead of the configured destination. As a result, files could end up in a publicly accessible storage even though a restricted, non-public storage had been configured. Files stored this way are served directly, without the access checks applied to non-public storages.

A security vulnerability has been detected in jbardin scp.py up to 0.16.1. The impacted element is the function _recv_file/_recv_pushd of the SCP Receive Handler component. The manipulation leads to path traversal. Remote exploitation is possible. Upgrading to version 0.16.2 resolves the issue.

A weakness has been identified in beautifier js-beautify up to 1.15.1/2.0.3. The affected element is an unknown function. Executing a manipulation can lead to uncontrolled memory allocation. The attack may be launched remotely. The vendor was contacted but did not respond.

A vulnerability was identified in wbond certvalidator up to 0.11.1. This issue affects some unknown processing of the Certificate Path Builder component. Such manipulation leads to resource consumption. The attack can be launched remotely. The vendor was contacted but did not respond.

A vulnerability in APOGEE MBC, APOGEE MEC, APOGEE PXC Compact, APOGEE PXC Modular, TALON TC Compact, and TALON TC Modular is due to lack of validation of user-supplied input in upload code in the web service. An unauthenticated remote attacker can cause a denial of service.

A vulnerability in the web service of APOGEE and TALON products. Improper validation of user input in multipart handling could allow an unauthenticated remote attacker to cause a denial of service.

A vulnerability in the FTP service of APOGEE and TALON products. Improper validation of input length could allow an unauthenticated remote attacker to cause a denial of service.

A vulnerability in the web service of APOGEE and TALON products. Improper validation of input length could allow an unauthenticated remote attacker to read portions of device memory or cause a denial-of-service condition.