Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,863

CVE-2021-32961

MDT AutoSave Unrestricted Upload of File with Dangerous Type

A getfile function in MDT AutoSave versions prior to v6.02.06 enables a user to supply an optional parameter, resulting in the processing of a request in a special manner. This can result in the execution of an unzip command and place a malicious .exe file in one of the locations the function looks for and get execution capabilities.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed
Vendors
Auvesy-mdt
Products
Autosave Autosave For System Platform
CVE-2021-32953

MDT AutoSave SQL Injection

An attacker could utilize SQL commands to create a new user MDT AutoSave versions prior to v6.02.06 and update the user’s permissions, granting the attacker the ability to login.

CVSS 3.1 · 9.8 Critical EPSS 1.2% KEV · Not listed
Vendors
Auvesy-mdt
Products
Autosave Autosave For System Platform
CVE-2021-32933

MDT AutoSave Command Injection

An attacker could leverage an API to pass along a malicious file that could then manipulate the process creation command line in MDT AutoSave versions prior to v6.02.06 and run a command line argument. This could then be leveraged to run a malicious process.

CVSS 3.1 · 10 Critical EPSS 1.2% KEV · Not listed
Vendors
Auvesy-mdt
Products
Autosave Autosave For System Platform
CVE-2021-32937

MDT AutoSave Generation of Error Message Containing Sensitive Information

An attacker can gain knowledge of a session temporary working folder where the getfile and putfile commands are used in MDT AutoSave versions prior to v6.02.06. An attacker can leverage this knowledge to provide a malicious command to the working directory where the read and write activity can be initiated.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Auvesy-mdt
Products
Autosave Autosave For System Platform
CVE-2021-32957

MDT AutoSave Uncontrolled Search Path Element

A function in MDT AutoSave versions prior to v6.02.06 is used to retrieve system information for a specific process, and this information collection executes multiple commands and summarizes the information into an XML. This function and subsequent process gives full path to the executable and is therefore vulnerable to binary hijacking.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Auvesy-mdt
Products
Autosave Autosave For System Platform
CVE-2021-32949

MDT AutoSave Relative Path Traversal

An attacker could utilize a function in MDT AutoSave versions prior to v6.02.06 that permits changing a designated path to another path and traversing the directory, allowing the replacement of an existing file with a malicious file.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Auvesy-mdt
Products
Autosave Autosave For System Platform
CVE-2021-32976

Moxa NPort IAW5000A-I/O Series Serial Device Server Stack-based Buffer Overflow

Five buffer overflows in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote attacker to initiate a denial-of-service attack and execute arbitrary code.

CVSS 3.1 · 9.8 Critical EPSS 2.8% KEV · Not listed
Vendors
Moxa
Products
Nport Iaw5150a-12i\/o Nport Iaw5150a-12i\/o Firmware Nport Iaw5150a-6i\/o and 5 more
CVE-2021-33020

Philips Vue PACS Use of a Key Past its Expiration Date

Philips Vue PACS versions 12.2.x.x and prior uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Philips
Products
Myvue Speech Vue Motion and 1 more
CVE-2021-33024

Philips Vue PACS Insufficiently Protected Credentials

Philips Vue PACS versions 12.2.x.x and prior transmits or stores authentication credentials, but it uses an insecure method susceptible to unauthorized interception and/or retrieval.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Philips
Products
Myvue Speech Vue Motion and 1 more
CVE-2021-33022

Philips Vue PACS Cleartext Transmission of Sensitive Information

Philips Vue PACS versions 12.2.x.x and prior transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Philips
Products
Myvue Speech Vue Motion and 1 more
CVE-2022-1018

ICSA-22-088-01 Rockwell Automation ISaGRAF

When opening a malicious solution file provided by an attacker, the application suffers from an XML external entity vulnerability due to an unsafe call within a dynamic link library file. An attacker could exploit this to pass data from local files to a remote web server, leading to a loss of confidentiality.

CVSS 3.1 · 5.5 Medium EPSS 2.2% KEV · Not listed
Vendors
Rockwellautomation
Products
Connected Components Workbench Isagraf Safety Instrumented Systems Workstation
CVE-2020-14479

ICSA-20-147-01 Inductive Automation Ignition (Update B)

Sensitive information can be obtained through the handling of serialized data. The issue results from the lack of proper authentication required to query the server

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Inductiveautomation
Products
Ignition
CVE-2022-1068

Modbus Tools Modbus Slave Stack-Based Buffer Overflow

Modbus Tools Modbus Slave (versions 7.4.2 and prior) is vulnerable to a stack-based buffer overflow in the registration field. This may cause the program to crash when a long character string is used.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Modbustools
Products
Modbus Slave
CVE-2021-33010

AVEVA System Platform Uncaught Exception

An exception is thrown from a function in AVEVA System Platform versions 2017 through 2020 R2 P01, but it is not caught, which may cause a denial-of-service condition.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Aveva
Products
System Platform
CVE-2021-32980

Automation Direct CLICK PLC CPU Modules Authentication Bypass Using an Alternate Path or Channel

Automation Direct CLICK PLC CPU Modules: C0-1x CPUs with firmware prior to v3.00 does not protect against additional software programming connections. An attacker can connect to the PLC while an existing connection is already active.

CVSS 3.1 · 9.8 Critical EPSS 1.1% KEV · Not listed
Vendors
Automationdirect
Products
C0-10are-d C0-10are-d Firmware C0-10dd1e-d and 37 more