Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,910

CVE-2021-27464

Rockwell Automation FactoryTalk AssetCentre SQL Injection

The ArchiveService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier exposes functions lacking proper authentication. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary SQL statements.

CVSS 3.1 · 10 Critical EPSS 3.5% KEV · Not listed
Vendors
Rockwellautomation
Products
Factorytalk Assetcentre
CVE-2021-27472

Rockwell Automation FactoryTalk AssetCentre SQL Injection

A vulnerability exists in the RunSearch function of SearchService service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier, which may allow for the execution of remote unauthenticated arbitrary SQL statements.

CVSS 3.1 · 10 Critical EPSS 5.7% KEV · Not listed
Vendors
Rockwellautomation
Products
Factorytalk Assetcentre
CVE-2021-27468

Rockwell Automation FactoryTalk AssetCentre SQL Injection

The AosService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier exposes functions lacking proper authentication. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary SQL statements.

CVSS 3.1 · 10 Critical EPSS 3.5% KEV · Not listed
Vendors
Rockwellautomation
Products
Factorytalk Assetcentre
CVE-2021-27474

Rockwell Automation FactoryTalk AssetCentre Use of Potentially Dangerous Function

Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier does not properly restrict all functions relating to IIS remoting services. This vulnerability may allow a remote, unauthenticated attacker to modify sensitive data in FactoryTalk AssetCentre.

CVSS 3.1 · 10 Critical EPSS 1.6% KEV · Not listed
Vendors
Rockwellautomation
Products
Factorytalk Assetcentre
CVE-2021-27466

Rockwell Automation FactoryTalk AssetCentre Deserialization of Untrusted Data

A deserialization vulnerability exists in how the ArchiveService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier verifies serialized data. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary commands in FactoryTalk AssetCentre.

CVSS 3.1 · 10 Critical EPSS 3.9% KEV · Not listed
Vendors
Rockwellautomation
Products
Factorytalk Assetcentre
CVE-2021-27470

Rockwell Automation FactoryTalk AssetCentre Deserialization of Untrusted Data

A deserialization vulnerability exists in how the LogService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier verifies serialized data. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary commands in FactoryTalk AssetCentre.

CVSS 3.1 · 10 Critical EPSS 3.8% KEV · Not listed
Vendors
Rockwellautomation
Products
Factorytalk Assetcentre
CVE-2021-27473

Rockwell Automation Connected Components Workbench Improper Input Validation

Rockwell Automation Connected Components Workbench v12.00.00 and prior does not sanitize paths specified within the .ccwarc archive file during extraction. This type of vulnerability is also commonly referred to as a Zip Slip. A local, authenticated attacker can create a malicious .ccwarc archive file that, when opened by Connected Components Workbench, will allow the attacker to gain the privileges of the software. If the software is running at SYSTEM level, the attacker will gain admin level privileges. User interaction is required for this exploit to be successful.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Rockwellautomation
Products
Connected Components Workbench
CVE-2021-27476

Rockwell Automation FactoryTalk AssetCentre OS Command Injection

A vulnerability exists in the SaveConfigFile function of the RACompare Service, which may allow for OS command injection. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary commands in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier.

CVSS 3.1 · 10 Critical EPSS 4.1% KEV · Not listed
Vendors
Rockwellautomation
Products
Factorytalk Assetcentre
CVE-2021-44477

GE Gas Power ToolBoxST Improper Restriction of XML External Entity Reference

GE Gas Power ToolBoxST Version v04.07.05C suffers from an XML external entity (XXE) vulnerability using the DTD parameter entities technique that could result in disclosure and retrieval of arbitrary data on the affected node via an out-of-band (OOB) attack. The vulnerability is triggered when input passed to the XML parser is not sanitized while parsing the XML project/template file.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Ge
Products
Toolboxst
CVE-2022-0988

Delta Electronics DIAEnergie CLEARTEXT Transmission of Sensitive Information

Delta Electronics DIAEnergie (Version 1.7.5 and prior) is vulnerable to cleartext transmission as the web application runs by default on HTTP. This could allow an attacker to remotely read transmitted information between the client and product.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Deltaww
Products
Diaenergie
CVE-2021-44768

Delta Electronics CNCSoft Out-of-bounds Read

Delta Electronics CNCSoft (Version 1.01.30) and prior) is vulnerable to an out-of-bounds read while processing a specific project file, which may allow an attacker to disclose information.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Deltaww
Products
Cncsoft Screeneditor
CVE-2022-26059

Delta Electronics DIAEnergie SQL Injection in GetQueryData

Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in GetQueryData. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.

CVSS 3.1 · 9.8 Critical EPSS 1.2% KEV · Not listed
Vendors
Deltaww
Products
Diaenergie
CVE-2022-25980

Delta Electronics DIAEnergie SQL Injection in HandlerCommon.ashx

Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in HandlerCommon.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.

CVSS 3.1 · 9.8 Critical EPSS 1.2% KEV · Not listed
Vendors
Deltaww
Products
Diaenergie
CVE-2022-25347

Delta Electronics DIAEnergie Path Traversal

Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) is vulnerable to path traversal attacks, which may allow an attacker to write arbitrary files to locations on the file system.

CVSS 3.1 · 9.8 Critical EPSS 11.4% KEV · Not listed
Vendors
Deltaww
Products
Diaenergie
CVE-2022-26069

Delta Electronics DIAEnergie SQL Injection in HandlerPage_KID.ashx

Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in HandlerPage_KID.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.

CVSS 3.1 · 9.8 Critical EPSS 1.2% KEV · Not listed
Vendors
Deltaww
Products
Diaenergie
CVE-2022-0923

Delta Electronics DIAEnergie SQL Injection in HandlerDialog_KID.ashx

Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in HandlerDialog_KID.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.

CVSS 3.1 · 9.8 Critical EPSS 1.0% KEV · Not listed
Vendors
Deltaww
Products
Diaenergie
CVE-2022-25880

Delta Electronics DIAEnergie SQL Injection in DIAE_hierarchyHandler.ashx

Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in HandlerTag_KID.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.

CVSS 3.1 · 9.8 Critical EPSS 1.2% KEV · Not listed
Vendors
Deltaww
Products
Diaenergie
CVE-2022-26013

Delta Electronics DIAEnergie SQL Injection in DIAE_dmdsetHandler.ashx

Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in DIAE_dmdsetHandler.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.

CVSS 3.1 · 9.8 Critical EPSS 9.1% KEV · Not listed
Vendors
Deltaww
Products
Diaenergie
CVE-2022-26065

Delta Electronics DIAEnergie SQL Injection in GetLatestDemandNode and GetDemandAnalysisData

Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in GetLatestDemandNode. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.

CVSS 3.1 · 9.8 Critical EPSS 1.2% KEV · Not listed
Vendors
Deltaww
Products
Diaenergie
CVE-2022-26349

Delta Electronics DIAEnergie SQL Injection in DIAE_eccoefficientHandler.ashx

Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in DIAE_eccoefficientHandler.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.

CVSS 3.1 · 9.8 Critical EPSS 1.2% KEV · Not listed
Vendors
Deltaww
Products
Diaenergie