CVE
Vendors
Products
Updated
CVSS v2
CVSS v3
Modicon_m221_firmware, Modicon_m221, Modicon_premium_firmware, Modicon_premium, Modicon_quantum_firmware, Modicon_quantum, Modicon_m340_firmware, Modicon_m340, Modicon_m580_firmware, Modicon_m580
2022-02-03
N/A
9.8 CRITICAL
A CWE-284: Improper Access Control vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a remote code execution by overwriting configuration settings of the controller over Modbus.
Modicon_m221_firmware, Modicon_m221, Modicon_premium_firmware, Modicon_premium, Modicon_quantum_firmware, Modicon_quantum, Modicon_m340_firmware, Modicon_m340, Modicon_m580_firmware, Modicon_m580
2022-02-03
N/A
7.5 HIGH
A CWE-248: Uncaught Exception vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a possible denial of service when writing sensitive application variables to the controller over Modbus.
Modicon_m221_firmware, Modicon_m221, Modicon_premium_firmware, Modicon_premium, Modicon_quantum_firmware, Modicon_quantum, Modicon_m340_firmware, Modicon_m340, Modicon_m580_firmware, Modicon_m580
2022-02-03
N/A
7.5 HIGH
A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause the disclosure of SNMP information when reading variables in the controller using Modbus.
SQL Injection was found in S-CMS version V3.0 via the alipay/alipayapi.php O_id parameter.
An XSS issue was discovered on the Job Edit page in Rundeck Community Edition before 3.0.13, related to assets/javascripts/workflowStepEditorKO.js and views/execution/_wfitemEdit.gsp.
typora through 0.9.9.20.3 beta has XSS, with resultant remote command execution, via the left outline bar.
CRLF Injection in pypiserver 1.2.5 and below allows attackers to set arbitrary HTTP headers and possibly conduct XSS attacks via a %0d%0a in a URI.
In TitanHQ SpamTitan through 7.03, a vulnerability exists in the spam rule update function. Updates are downloaded over HTTP, including scripts which are subsequently executed with root permissions. An attacker with a privileged network position is trivially able to inject arbitrary commands.
An issue was discovered in phpMyAdmin before 4.8.5. When the AllowArbitraryServer configuration setting is set to true, with the use of a rogue MySQL server, an attacker can read any file on the server that the web server's user can access. This is related to the mysql.allow_local_infile PHP configuration, and the inadvertent ignoring of "options(MYSQLI_OPT_LOCAL_INFILE" calls.
An issue was discovered in phpMyAdmin before 4.8.5. A vulnerability was reported where a specially crafted username can be used to trigger a SQL injection attack through the designer feature.