VARIoT IoT vulnerabilities database

Out-of-bounds read vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file. Provided by Omron Corporation CX-Programmer contains multiple vulnerabilities. * Out-of-bounds writing (CWE-787) - CVE-2022-21124 It was * Use of freed memory (Use-after-free) (CWE-416) - CVE-2022-25230 It was * Use of freed memory (Use-after-free) (CWE-416) - CVE-2022-25325 It was * Out-of-bounds read (CWE-125) - CVE-2022-21219 It was * Out-of-bounds writing (CWE-787) - CVE-2022-25234 This vulnerability information is JPCERT/CC Report to JPCERT/CC Coordinated with the developer

KingView (KingView) is the flagship brand in the field of equipment monitoring in China. It has the characteristics of complete functions, simple, easy to learn, and easy to use. Its products are widely used in dozens of industries such as electric power, machinery, municipal administration, energy, environmental protection, and medicine. Hundreds of equipment supporting monitoring such as low-voltage power distribution, hoisting machinery, vacuum furnace, heat exchange station, fan power generation, dust blowing and dust removal, air separation equipment, pharmaceutical freeze dryer and so on. There is a logic flaw vulnerability in KingView, an attacker can use this vulnerability to overwrite and delete any file.

In spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable HTTP2 and no key store or trusted certificates are set will be configured to use an insecure TrustManager. This makes the gateway able to connect to remote services with invalid or custom certificates. spring cloud gateway Exists in a certificate validation vulnerability.Information may be tampered with

The absence of filters when loading some sections in the web application of the vulnerable device allows attackers to inject malicious code that will be interpreted when a legitimate user accesses the web section where the information is displayed. Injection can be done on specific parameters. The injected code is executed when a legitimate user attempts to upload, copy, download, or delete an existing configuration (Administrative Services). IPCOMM ipDIO is a remote control communication device of German IPCOMM company. Used to record digital and analog inputs and control digital outputs. Attackers can use the vulnerability to inject malicious code. When legitimate users visit the web part of the displayed information, These codes will be explained

In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host. (DoS) It may be in a state

Persistent cross-site scripting in the web interface of ipDIO allows an unauthenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS payload into a specific parameter. The XSS payload will be executed when a legitimate user attempts to review history. ipDIO Exists in a cross-site scripting vulnerability.Information may be obtained and information may be tampered with. IPCOMM ipDIO is a remote control communication device of German IPCOMM company. Used to record digital and analog inputs and control digital outputs

The absence of filters when loading some sections in the web application of the vulnerable device allows attackers to inject malicious code that will be interpreted when a legitimate user accesses the specific web section where the information is displayed. Injection can be done on specific parameters. The injected code is executed when a legitimate user attempts to review history. IPCOMM of ipDIO There are unspecified vulnerabilities in the firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. IPCOMM ipDIO is a remote control communication device of German IPCOMM company. Used to record digital and analog inputs and control digital outputs. A code injection vulnerability exists in IPCOMM ipDIO

Persistent cross-site scripting (XSS) in the web interface of ipDIO allows an authenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS payload into specific fields. The XSS payload will be executed when a legitimate user attempts to upload, copy, download, or delete an existing configuration (Administrative Services). ipDIO Exists in a cross-site scripting vulnerability.Information may be obtained and information may be tampered with. IPCOMM ipDIO is a remote control communication device of German IPCOMM company. Used to record digital and analog inputs and control digital outputs

The NETGEAR SRX5308 is a firewall appliance. A SQL injection vulnerability in NETGEAR ProSafe Gigabit Quad WAN SSL VPN Firewall SRX5308 could allow attackers to obtain sensitive information.

TOTOLink is a brand of mid-to-high-end wireless routers in the Asia-Pacific region. Multiple router authentication bypass vulnerabilities in TOTOLink can be exploited by attackers to execute arbitrary commands on the target device with root privileges.

In certain situations it is possible for an unmanaged rule to exist on the target system that has the same comment as the rule specified in the manifest. This could allow for unmanaged rules to exist on the target system and leave the system in an unsafe state. Puppet firewall There is an input validation vulnerability in.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat OpenStack Platform 16.2 (puppet-firewall) security update Advisory ID: RHSA-2022:5116-01 Product: Red Hat OpenStack Platform Advisory URL: https://access.redhat.com/errata/RHSA-2022:5116 Issue date: 2022-06-22 CVE Names: CVE-2022-0675 ==================================================================== 1. Summary: An update for puppet-firewall is now available for Red Hat OpenStack Platform 16.2.3 (Train). Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat OpenStack Platform 16.2 - noarch 3. Description: Manages Firewalls such as iptables Security Fix(es): * unmanaged rules could leave system in an unsafe state via duplicate comment (CVE-2022-0675) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Package List: Red Hat OpenStack Platform 16.2: Source: puppet-firewall-3.4.0-1.94f707cgit.el8ost.src.rpm noarch: puppet-firewall-3.4.0-1.94f707cgit.el8ost.noarch.rpm Red Hat OpenStack Platform 16.2: Source: puppet-firewall-3.4.0-1.94f707cgit.el8ost.src.rpm noarch: puppet-firewall-3.4.0-1.94f707cgit.el8ost.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2022-0675 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYrNY+9zjgjWX9erEAQjp3g//dr6StKxO2eItYO72aTw0lhuSlnbuVBi4 XjyoK/MmgMD7mmIOivMH8x0SQez3i8bbVuNBxY0vzKaBCt2F0A0rvAjU6CfHfQ9X /W0vgYVU25JqCkLa1LKA/uAS4wU3q2RsmRQQkozh93oKGvrxyv1Oavopct34sDUL RaQmvWNpGDM7N4fwsZjZlAaF+zs/LcjnFavBnRM/2V7J49C/SfINpwDWj80rek+j OY234ef9l1QnbKybUX6HVCiQv7aGifcJSqK/Eg+DrZ5U0CaDGYM4zPECIg/HbW44 Z59ezU0gOMOZKbFDd/JsP7F6r0CGEZn+7buL2pDplXJiXQU+/KCb9GGW1kavIJ8B PjuXMG38UwTJTDFJ88sPJlU2nHvGADAUPciymUBCJ/uRYemN5g2qpUw3XNUGPXrD zDsP6SY0CTjWDTcdq8fY6m3H1sqe+cICxww/gWhRf+uLaCHtAN/Blt9rKAkdXxNn +BPlNcSUtCStt7B1WWA0kiU+uE84t9if4jSQ9E30qusYYkAOhoJG2mIMBnCuaRoX MOE8X87XJMSFptq+y0rHQnPeG++W/qnsZ1Ck++9rNQwrP0Qme7PbcyLn9Yozkd00 4QqyaBWq+CwKGAkO6CCkloq8HImfelXPr1lq2GdartSiZoLnbOITLL+cqmmBV61W c2vGSnm9MKo=lq7X -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce

Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker with read/write privileges to the application to write files or execute arbitrary code on the underlying operating system of an affected device as the root user. For more information about these vulnerabilities, see the Details section of this advisory. (DoS) It may be in a state

Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker with read/write privileges to the application to write files or execute arbitrary code on the underlying operating system of an affected device as the root user. For more information about these vulnerabilities, see the Details section of this advisory. (DoS) It may be in a state

An improper neutralization of special elements used in an OS Command vulnerability [CWE-78] in FortiAP-C console 5.4.0 through 5.4.3, 5.2.0 through 5.2.1 may allow an authenticated attacker to execute unauthorized commands by running CLI commands with specifically crafted arguments. FortiAP-C In the console, OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

An improper access control vulnerability [CWE-284 ] in FortiToken Mobile (Android) external push notification 5.1.0 and below may allow a remote attacker having already obtained a user's password to access the protected system during the 2FA procedure, even though the deny button is clicked by the legitimate user. FortiToken Mobile (Android) external push notification Exists in unspecified vulnerabilities.Information may be tampered with. Fortinet FortiToken Mobile is an Oath-compliant, event-based, and time-based one-time password (Otp) generator application from Fortinet, Inc., USA. There is an access control error vulnerability in Fortinet FortiToken Mobile 5.1.0 and below. This vulnerability stems from the network system or product not properly restricting resource access from unauthorized roles. Attackers can use this vulnerability to obtain user passwords in 2FA

A vulnerability in the Common Execution Environment (CEE) ConfD CLI of Cisco Ultra Cloud Core - Subscriber Microservices Infrastructure (SMI) software could allow an authenticated, local attacker to escalate privileges on an affected device. This vulnerability is due to insufficient access control in the affected CLI. An attacker could exploit this vulnerability by authenticating as a CEE ConfD CLI user and executing a specific CLI command. A successful exploit could allow an attacker to access privileged containers with root privileges. (DoS) It may be in a state

Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service. HP PC is a computer product of Hewlett-Packard (HP) in the United States. No detailed vulnerability details are currently provided

Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service. HP PC is a computer product of Hewlett-Packard (HP) in the United States. No detailed vulnerability details are currently provided

Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service. HP PC is a computer product of Hewlett-Packard (HP) in the United States. No detailed vulnerability details are currently provided

A vulnerability in the RADIUS feature of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause the affected system to stop processing RADIUS packets. This vulnerability is due to improper handling of certain RADIUS requests. An attacker could exploit this vulnerability by attempting to authenticate to a network or a service where the access server is using Cisco ISE as the RADIUS server. A successful exploit could allow the attacker to cause Cisco ISE to stop processing RADIUS requests, causing authentication/authorization timeouts, which would then result in legitimate requests being denied access. Note: To recover the ability to process RADIUS packets, a manual restart of the affected Policy Service Node (PSN) is required. See the Details section for more information. Cisco Identity Services Engine (ISE) Exists in unspecified vulnerabilities.Service operation interruption (DoS) It may be in a state