VARIoT IoT vulnerabilities database

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules (see security notification for affected versions), that could cause denial of HTTP and FTP services when a series of specially crafted requests is sent to the controller over HTTP. plural Schneider Electric The product contains a vulnerability related to checking for exceptional conditions.Denial of service (DoS) It may be put into a state. Schneider Electric Modicon M340 is a medium-range PLC (Programmable Logic Controller) of French Schneider Electric (Schneider Electric) for industrial processes and infrastructure. Schneider Electric Modicon M340 has a code issue vulnerability. Attackers can use the vulnerability to make HTTP and FTP services deny when a request for preparation is sent to the controller via HTTP

A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in Modicon M258 Firmware (All versions prior to V5.0.4.11) and SoMachine/SoMachine Motion software (All versions), that could cause a buffer overflow when the length of a file transferred to the webserver is not verified. Modicon M258 firmware, SoMachine , SoMachine Motion The software contains a buffer error vulnerability.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. Schneider Electric Modicon M258 is a programmable automation controller produced by Schneider Electric in France

A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules (see security notification for affected versions), that could cause unauthenticated command execution in the controller when sending special HTTP requests. plural Schneider Electric The product is vulnerable to a lack of authentication for critical features.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state

An issue was discovered on Western Digital My Cloud OS 5 devices before 5.07.118. A NAS Admin authentication bypass vulnerability could allow an unauthenticated user to gain access to the device. This vulnerability allows remote attackers to bypass authentication on affected installations of Western Digital MyCloud PR4100. Authentication is not required to exploit this vulnerability.The specific flaw exists within the mod_rewrite module. The issue results from the way the software parses URLs to make authorization decisions. An attacker can leverage this vulnerability to bypass authentication on the system

The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service (ReDoS) in multiple regexes (see linked commit for more info). ua-parser-js Exists in a resource exhaustion vulnerability.Service operation interruption (DoS) It may be in a state

A CWE-522: Insufficiently Protected Credentials vulnerability exists in EcoStruxure Geo SCADA Expert 2019 (Original release and Monthly Updates to September 2020, from 81.7268.1 to 81.7578.1) and EcoStruxure Geo SCADA Expert 2020 (Original release and Monthly Updates to September 2020, from 83.7551.1 to 83.7578.1), that could cause exposure of credentials to server-side users when web users are logged in to Virtual ViewX. EcoStruxure Geo SCADA Expert 2019 and 2020 Exists in an inadequate protection of credentials.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state

Multiple vulnerabilities in Cisco Jabber for Windows, Jabber for MacOS, and Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the underlying operating system (OS) with elevated privileges or gain access to sensitive information. For more information about these vulnerabilities, see the Details section of this advisory. Cisco Jabber is a set of unified communication client solutions of Cisco (Cisco). The program provides online status display, instant messaging, voice and other functions

Multiple vulnerabilities in Cisco Jabber for Windows, Jabber for MacOS, and Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the underlying operating system (OS) with elevated privileges or gain access to sensitive information. For more information about these vulnerabilities, see the Details section of this advisory. Microsoft Windows is a desktop operating system of Microsoft Corporation. Cisco Jabber has an input validation error vulnerability, which is caused by the software's incorrect validation of email content. An attacker could exploit this vulnerability by sending a specially crafted message to the targeted system. A successful exploit could allow an attacker to cause the application to return sensitive authentication information to another system, possibly for further attacks

Multiple vulnerabilities in Cisco Jabber for Windows, Jabber for MacOS, and Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the underlying operating system (OS) with elevated privileges or gain access to sensitive information. For more information about these vulnerabilities, see the Details section of this advisory. Cisco Jabber is a set of unified communication client solutions of Cisco (Cisco). The program provides online status display, instant messaging, voice and other functions. An input validation error vulnerability exists in Cisco Jabber due to improper validation of email content. An attacker can exploit the security vulnerability by sending a specially crafted XMPP message to the affected software. By interacting with the target user's message, the attacker can inject arbitrary script code in the Jabber message window interface

A privilege escalation flaw allows a malicious, authenticated, privileged CLI user to escalate their privileges on the system and gain full control over the SMG appliance. This affects SMG prior to 10.7.4. SMG Contains an unspecified vulnerability.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. Symantec Messaging Gateway is a set of spam filters of Symantec Corporation of the United States. The product includes features such as antispam, antivirus, advanced content filtering, and data loss prevention. Symantec Messaging Gateway before version 10.7.4 has an authorization problem vulnerability. This vulnerability is caused by improper privilege control required for system upgrades. Attackers can complete the control of the device by upgrading the privileges of the SMG device

An information disclosure flaw allows a malicious, authenticated, privileged web UI user to obtain a password for a remote SCP backup server that they might not otherwise be authorized to access. This affects SMG prior to 10.7.4. SMG Contains an unspecified vulnerability.Information may be obtained. Symantec Messaging Gateway is a set of spam filters of Symantec Corporation of the United States. The product includes features such as antispam, antivirus, advanced content filtering, and data loss prevention. Symantec Messaging Gateway before version 10.7.4 has a security vulnerability, which can be exploited by attackers to obtain sensitive information

Beijing Wanwei Yingchuang Technology Development Co., Ltd. is committed to the R&D and application of products and technologies in the field of environmental protection Internet of Things. It is an enterprise integrating R&D, production and sales. Beijing Wanwei Yingchuang Technology Development Co., Ltd. pollution source online monitoring system has a storage-type cross-site scripting vulnerability. Attackers can use vulnerabilities to obtain sensitive information such as user cookies.

Omron Group is a manufacturer of automation control and electronic equipment. Omron Automation (China) Co., Ltd. CJ2M-CPU11 has industrial control equipment vulnerabilities. Attackers can use vulnerabilities to stop control functions and cause production interruptions.

Chengdu Feiyuxing Technology Co., Ltd. is a company dedicated to providing intelligent and easy-to-use network communication products and services, continuously improving the quality of network use through innovative technologies, and cooperating with users to create an intelligent and humanized network management platform. An unauthorized access vulnerability exists in the enterprise-level intelligent online behavior management system of Feiyuxing. Attackers can use vulnerabilities to obtain sensitive information and perform unauthorized operations.

Improper check or handling of exceptional conditions in MELSEC iQ-F series FX5U(C) CPU unit firmware version 1.060 and earlier allows an attacker to cause a denial-of-service (DoS) condition on program execution and communication by sending a specially crafted ARP packet. This vulnerability information is provided by the developer for the purpose of disseminating it to product users. For recovery CPU The unit needs to be reset

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Legacy Controllers Modicon Quantum & Modicon Premium (see security notifications for affected versions), that could cause denial of service when a specially crafted Read Physical Memory request over Modbus is sent to the controller. plural Schneider Electric The product contains a vulnerability related to checking for exceptional conditions.Denial of service (DoS) It may be put into a state

A CWE-123: Write-what-where Condition vulnerability exists in EcoStruxure™ Control Expert (all versions) and Unity Pro (former name of EcoStruxure™ Control Expert) (all versions), that could cause a crash of the software or unexpected code execution when opening a malicious file in EcoStruxure™ Control Expert software. Schneider Electric EcoStruxure Control Expert (formerly known as Unity Pro) is a set of programming software for Schneider Electric logic controller products from French Schneider Electric (Schneider Electric). There is a security vulnerability in Schneider Electric EcoStruxure Control Expert. The vulnerability stems from the failure to perform security checks on open files

Multiple vulnerabilities in Cisco Jabber for Windows, Jabber for MacOS, and Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the underlying operating system (OS) with elevated privileges or gain access to sensitive information. For more information about these vulnerabilities, see the Details section of this advisory. Cisco Jabber is a set of unified communication client solutions of Cisco (Cisco). The program provides online status display, instant messaging, voice and other functions

Multiple vulnerabilities in Cisco Jabber for Windows, Jabber for MacOS, and Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the underlying operating system (OS) with elevated privileges or gain access to sensitive information. For more information about these vulnerabilities, see the Details section of this advisory. Cisco Jabber is a set of unified communication client solutions of Cisco (Cisco). The program provides online status display, instant messaging, voice and other functions. An authorization issue vulnerability exists in Cisco Jabber. The vulnerability is caused by the software allowing unauthenticated users to execute commands and improper handling of input to the application protocol handler. Execute arbitrary commands on the target system without the privileges of the client software's user account

IBM Resilient SOAR V38.0 could allow a remote attacker to execute arbitrary code on the system, caused by formula injection due to improper input validation. IBM Resilient SOAR Has CSV There is a vulnerability related to neutralization of mathematical elements in the file and a vulnerability related to input verification.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state