| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| A security issue exists within ControlFLASH™, where the installer grants write permissions to the "Everyone" group on a product installation directory. This could allow arbitrary code execution, resulting in an attacker being given the ability to run any commands or code of the attacker's choice on a target machine at the logged-in user's permission level. |
| A vulnerability exists in the affected products that allows a threat actor to create a project and become the administrator for it. If exploited, a threat actor could create, modify, and delete their own project. |
| A data exposure vulnerability exists in the affected product. There are hardcoded links in the source code that lead to JSON files that can be reached without authentication. If exploited, a threat actor could view customer data. |
| A denial-of-service security issue exists within ArmorStart® LT. The security issue stems from improper handling of a crafted HTTP PUT request sent to the embedded web server. This can result in a loss of web server availability |
| A denial-of-service security issue exists within RSLinx® Classic. A crafted CIP packet targeting the Forward Close service can cause the RSLinx® Classic service to crash, requiring a restart of the service to recover. |
| A denial-of-service security issue exists within RSLinx® Classic. A crafted CIP packet can cause the RSLinx® Classic service to crash due to insufficient data length validation, requiring a restart of the service to recover. |
| A denial-of-service security issue exists within RSLinx® Classic. A crafted CIP packet with an oversized embedded message request can cause the RSLinx® Classic service to crash, requiring a restart of the service to recover. |
| A denial-of-service security issue exists in the affected Logix platforms listed in the table above. The security issue stems from improper validation of input length during CIP message processing. This can result in a major nonrecoverable fault (MNRF), requiring a power cycle to recover |
| A security issue exists within FactoryTalk® Historian Machine Edition. An attacker with low-level authentication could exploit this vulnerability to achieve remote code execution on the affected device. |
| A denial-of-service security issue exists within FactoryTalk® Historian Machine Edition. A network adjacent attacker who is authenticated could send crafted requests to the web interface, resulting in buffer overflow conditions that may cause the device to crash and become unresponsive. |
| Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack <= 6.2.12 versions. |
| Subscriber SQL Injection in Charitable <= 1.8.12.1 versions. |
| Unauthenticated SQL Injection in Throws SPAM Away <= 3.8.2 versions. |
| Unauthenticated Arbitrary File Upload in Hash Form <= 1.4.2 versions. |
| Unauthenticated Bypass Vulnerability in SiteGround Security <= 1.6.6 versions. |
| Subscriber Broken Access Control in OwnerRez API <= 1.2.6 versions. |
| Unauthenticated Cross Site Scripting (XSS) in Super Store Finder <= 7.10 versions. |
| Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects Post SMTP: from 4.0.0 through beta.1. |
| Subscriber Sensitive Data Exposure in Print Barcode Labels for your WooCommerce products/orders <= 4.0.0 versions. |
| Unauthenticated SQL Injection in WP Data Access <= 5.5.81 versions. |
