Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,932

CVE-2021-33014

KUKA KR C4 - Use of Hard-Coded Credentials

An attacker can gain VxWorks Shell after login due to hard-coded credentials on a KUKA KR C4 control software for versions prior to 8.7 or any product running KSS.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Kuka
Products
Kr C4 Kr C4 Firmware Kss
CVE-2022-27184

Horner Automation Cscape Csfont

The affected product is vulnerable to an out-of-bounds write, which may allow an attacker to execute arbitrary code.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Hornerautomation
Products
Cscape
CVE-2022-28690

Horner Automation Cscape Csfont

The affected product is vulnerable to an out-of-bounds write via uninitialized pointer, which may allow an attacker to execute arbitrary code.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Hornerautomation
Products
Cscape
CVE-2022-29488

Horner Automation Cscape Csfont

The affected product is vulnerable to an out-of-bounds read via uninitialized pointer, which may allow an attacker to execute arbitrary code.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Hornerautomation
Products
Cscape
CVE-2022-30540

Horner Automation Cscape Csfont

The affected product is vulnerable to a heap-based buffer overflow via uninitialized pointer, which may allow an attacker to execute arbitrary code

CVSS 3.1 · 7.8 High EPSS 1.0% KEV · Not listed
Vendors
Hornerautomation
Products
Cscape
CVE-2020-36549

GE Voluson S8 Windows Operating System Patches privileges management

A vulnerability classified as critical was found in GE Voluson S8. Affected is the underlying Windows XP operating system. Missing patches might introduce an excessive attack surface. Access to the local network is required for this attack to succeed.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Ge
Products
Voluson S8 Voluson S8 Firmware
CVE-2022-1524

3.2.5 CLEARTEXT TRANSMISSION OF SENSITIVE INFORMATION CWE-319

LRM version 2.4 and lower does not implement TLS encryption. A malicious actor can MITM attack sensitive data in-transit, including credentials.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Illumina
Products
Iseq 100 Local Run Manager Miniseq and 5 more
CVE-2022-2140

Elcomplus SmartICS Cross-site Scripting

Elcomplus SmartICS v2.3.4.0 does not neutralize user-controllable input, which allows an authenticated user to inject arbitrary code into specific parameters.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Smartics
Products
Smartics
CVE-2022-2253

Distributed Data Systems WebHMI OS Command Injection

A user with administrative privileges in Distributed Data Systems WebHMI 4.1.1.7662 may send OS commands to execute on the host server.

CVSS 3.1 · 9.1 Critical EPSS 1.3% KEV · Not listed
Vendors
Webhmi
Products
Webhmi Webhmi Firmware
CVE-2022-2199

ICSA-22-200-01 MiCODUS MV720 GPS tracker Cross-site Scripting

The main MiCODUS MV720 GPS tracker web server has a reflected cross-site scripting vulnerability that could allow an attacker to gain control by tricking a user into making a request.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Micodus
Products
Mv720 Mv720 Firmware
CVE-2022-2136

Advantech iView

The affected product is vulnerable to multiple SQL injections that require low privileges for exploitation and may allow an unauthorized attacker to disclose information.

CVSS 3.1 · 8.8 High EPSS 9.4% KEV · Not listed
Vendors
Advantech
Products
Iview
CVE-2022-2142

Advantech iView

The affected product is vulnerable to a SQL injection with high attack complexity, which may allow an unauthorized attacker to disclose information.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Advantech
Products
Iview
CVE-2022-2661

Sequi PortBloque S Improper Authorization

Sequi PortBloque S has an improper authorization vulnerability, which may allow a low-privileged user to perform administrative functions using specifically crafted requests.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Sequi
Products
Portbloque S Portbloque S Firmware
CVE-2022-2662

Sequi PortBloque S Improper Authentication

Sequi PortBloque S has a improper authentication issues which may allow an attacker to bypass the authentication process and gain user-level access to the device.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Sequi
Products
Portbloque S Portbloque S Firmware
CVE-2022-1373

Softing Secure Integration Server Relative Path Traversal

The “restore configuration” feature of Softing Secure Integration Server V1.22 is vulnerable to a directory traversal vulnerability when processing zip files. An attacker can craft a zip file to load an arbitrary dll and execute code. Using the "restore configuration" feature to upload a zip file containing a path traversal file may cause a file to be created and executed upon touching the disk.

CVSS 3.1 · 7.2 High EPSS 13.2% KEV · Not listed
Vendors
Softing
Products
Edgeaggregator Edgeconnector Opc and 3 more
CVE-2022-2334

Softing Secure Integration Server Uncontrolled Search Path Element

The application searches for a library dll that is not found. If an attacker can place a dll with this name, then the attacker can leverage it to execute arbitrary code on the targeted Softing Secure Integration Server V1.22.

CVSS 3.1 · 7.2 High EPSS 12.1% KEV · Not listed
Vendors
Softing
Products
Edgeaggregator Edgeconnector Opc and 3 more
CVE-2022-2464

ISaGRAF Workbench Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-22

Rockwell Automation ISaGRAF Workbench software versions 6.0 through 6.6.9 are affected by a Path Traversal vulnerability. Crafted malicious files can allow an attacker to traverse the file system when opened by ISaGRAF Workbench. If successfully exploited, an attacker could overwrite existing files and create additional files with the same permissions of the ISaGRAF Workbench software. User interaction is required for this exploit to be successful.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Rockwellautomation
Products
Isagraf Workbench
CVE-2022-2465

ISaGRAF Workbench Deserialization of Untrusted Data CWE-502

Rockwell Automation ISaGRAF Workbench software versions 6.0 through 6.6.9 are affected by a Deserialization of Untrusted Data vulnerability. ISaGRAF Workbench does not limit the objects that can be deserialized. This vulnerability allows attackers to craft a malicious serialized object that, if opened by a local user in ISaGRAF Workbench, may result in remote code execution. This vulnerability requires user interaction to be successfully exploited.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Rockwellautomation
Products
Isagraf Workbench
CVE-2022-1888

Fuji Electric Alpha7 PC Loader Fuji Electric Alpha7 PC Loader

Alpha7 PC Loader (All versions) is vulnerable to a stack-based buffer overflow while processing a specifically crafted project file, which may allow an attacker to execute arbitrary code.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Fujielectric
Products
Alpha7 Pc Loader Alpha7 Pc Loader Firmware