2023

Affected devices improperly handle specially crafted packets sent to port 102/tcp. This could allow an attacker to crea

A vulnerability has been identified in SIMATIC CP 1242-7 V2 (incl. SIPLUS variants) (All versions < V3.4.29), SIMATIC CP

A vulnerability has been identified in SIMATIC PC-Station Plus (All versions), SIMATIC S7-400 CPU 412-2 PN V7 (All versi

A vulnerability has been identified in SIMATIC PC-Station Plus (All versions), SIMATIC S7-400 CPU 412-2 PN V7 (All versi

A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) (All versions < V19). An information disclosure vulne

Mattermost fails to perform correct authorization checks when creating a playbook action, allowing users without access

In Red Hat Advanced Cluster Security (RHACS), it was found that some security related HTTP headers were missing, allowin

SAS application is vulnerable to Reflected Cross-Site Scripting (XSS). Improper input validation in the `_program` param

Denial-of-service (DoS) vulnerability exists in NetBIOS service of HMI GC-A2 series. If a remote unauthenticated attacke

Denial-of-service (DoS) vulnerability exists in rfe service of HMI GC-A2 series. If a remote unauthenticated attacker se

Denial-of-service (DoS) vulnerability exists in commplex-link service of HMI GC-A2 series. If a remote unauthenticated a

Denial-of-service (DoS) vulnerability exists in FTP service of HMI GC-A2 series. If a remote unauthenticated attacker se

A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA1) (All versions >= V8.3), LOGO! 12/24RCEo (6ED1

Mattermost fails to validate team membership when a user attempts to access a playbook, allowing a user with permissions

Mattermost fails to check whether a user is a guest when updating the tasks of a private playbook run allowing a guest t

Mattermost fails to handle a null request body in the /add endpoint, allowing a simple member to send a request with nul

OS command injection vulnerability in WRC-X3000GSN v1.0.2, WRC-X3000GS v1.0.24 and earlier, and WRC-X3000GSA v1.0.24 and

Mattermost fails to validate the type of the "reminder" body request parameter allowing an attacker to crash the Playboo

Cross Site Scripting (XSS) in Voltronic Power SNMP Web Pro v.1.1 allows an attacker to execute arbitrary code via a craf

Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protec

Mattermost fails to perform authorization checks in the /plugins/playbooks/api/v0/runs/add-to-timeline-dialog endpoint

Mattermost fails to to check the length when setting the title in a run checklist in Playbooks, allowing an attacker to

Mattermost fails to validate if a relative path is passed in /plugins/playbooks/api/v0/telemetry/run/<telem_run_id> as a

Emlog version pro2.1.14 was discovered to contain a SQL injection vulnerability via the uid parameter at /admin/media.ph

Archer Platform 6.x before 6.13 P2 (6.13.0.2) contains an authenticated HTML content injection vulnerability. A remote a

Archer Platform 6.x before 6.14 P1 HF2 (6.14.0.1.2) contains an insecure direct object reference vulnerability. An authe

A Huawei data communication product has a command injection vulnerability. Successful exploitation of this vulnerability

An improper access control vulnerability exists in a Huawei datacom product. Attackers can exploit this vulnerability to

An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x befo

An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x befo

An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x befo

An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x befo

An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x befo

An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x befo

An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x befo

An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x befo

Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2.

SAP BTP Security Services Integration Library ([Golang] github.com/sap/cloud-security-client-go) - versions < 0.17.0, al

Due to lack of proper authorization checks in Emarsys SDK for Android, an attacker can call a particular activity and ca

A feature in LXD (LP#1829071), affects the default configuration of Ubuntu Server which allows privileged users in the l

SAP BTP Security Services Integration Library ([Python] sap-xssec) - versions < 4.1.0, allow under certain conditions an

SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library) - versions below 2.17

SAP Solution Manager - version 720, allows an authorized attacker to execute certain deprecated function modules which c

SAP Fiori launchpad - versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, UI_700 200, SAP_B

SAP BTP Security Services Integration Library ([Node.js] @sap/xssec - versions < 3.6.0, allow under certain conditions a

SAP GUI for Windows and SAP GUI for Java allow an unauthenticated attacker to access information which would otherwise b

SAP GUI for Windows and SAP GUI for Java - versions SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, allow an

SAP Cloud Connector - version 2.0, allows an authenticated user with low privilege to perform Denial of service attack f

The SAP HCM (SMART PAYE solution) - versions S4HCMCIE 100, SAP_HRCIE 600, SAP_HRCIE 604, SAP_HRCIE 608, does not suffici

When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent reque