Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2012-6356 State: PUBLISHED Published: 2013-02-20T11:00:00 Last Updated: 2024-08-06T21:28:39.917Z Vendors: n/a Products: n/a Problem Types: n/a Description: IBM Maximo Asset Management 7.5, Maximo Asset Management Essentials 7.5, and SmartCloud Control Desk 7.5 allow remote authenticated users to gain privileges via vectors related to an import operation. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg21625624 - http://www-01.ibm.com/support/docview.wss?uid=swg1IV27329 - https://exchange.xforce.ibmcloud.com/vulnerabilities/80748
CVE ID: CVE-2012-6357 State: PUBLISHED Published: 2013-02-20T11:00:00 Last Updated: 2024-08-06T21:28:39.783Z Vendors: n/a Products: n/a Problem Types: n/a Description: IBM Maximo Asset Management 7.5, Maximo Asset Management Essentials 7.5, and SmartCloud Control Desk 7.5 allow remote authenticated users to gain privileges and bypass intended restrictions on asset-lookup operations via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg1IV23511 - https://exchange.xforce.ibmcloud.com/vulnerabilities/80749 - http://www-01.ibm.com/support/docview.wss?uid=swg21625624
CVE ID: CVE-2012-6359 State: PUBLISHED Published: 2013-01-18T21:00:00 Last Updated: 2024-08-06T21:28:39.756Z Vendors: n/a Products: n/a Problem Types: n/a Description: IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.11, 6.2.1 before 6.2.1.3, and 6.2.2 before 6.2.2.2 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.2.0 before 6.2.0.11, 6.2.1 before 6.2.1.3, and 6.2.2 before 6.2.2.2 do not check whether an OpenID attribute is signed in the (1) SREG (aka simple registration extension) and (2) AX (aka attribute exchange extension) cases, which allows man-in-the-middle attackers to spoof OpenID provider data by inserting unsigned attributes. Additional Analyst Not
llows man-in-the-middle attackers to spoof OpenID provider data by inserting unsigned attributes. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/77790 - http://secunia.com/advisories/51212 - http://www-01.ibm.com/support/docview.wss?uid=swg1IV23452 - http://www-01.ibm.com/support/docview.wss?uid=swg1IV23453 - http://www.securityfocus.com/bid/56390 - http://www-01.ibm.com/support/docview.wss?uid=swg21615748 - http://www-01.ibm.com/support/docview.wss?uid=swg1IV23451 - http://www-01.ibm.com/support/docview.wss?uid=swg21615744
CVE ID: CVE-2012-6360 State: PUBLISHED Published: 2013-01-18T21:00:00 Last Updated: 2024-08-06T21:28:39.901Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in IBM Intelligent Operations Center 1.5.0 allows remote attackers to inject arbitrary web script or HTML via event data fields. Additional Analyst Notes: - CVE Program Container: References: - http://www-01.ibm.com/support/docview.wss?uid=swg1PO00211 - https://exchange.xforce.ibmcloud.com/vulnerabilities/80942 - http://www-01.ibm.com/support/docview.wss?uid=swg21622222
CVE ID: CVE-2012-6362 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2012-6363 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2012-6364 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2012-6365 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2012-6366 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2012-6367 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2012-6368 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2012-6369 State: PUBLISHED Published: 2012-12-28T11:00:00Z Last Updated: 2024-09-17T00:26:17.128Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Troubleshooting Reporting System feature in AgileBits 1Password 3.9.9 might allow remote attackers to inject arbitrary web script or HTML via a crafted User-Agent HTTP header that is not properly handled in a View Troubleshooting Report action. Additional Analyst Notes: - CVE Program Container: References: - http://www.youtube.com/watch?v=A1kPL9ggRi4 - http://packetstormsecurity.org/files/118467/Agilebits-1Password-3.9.9-Cross-Site-Scripting.html
CVE ID: CVE-2012-6371 State: PUBLISHED Published: 2012-12-31T20:00:00Z Last Updated: 2024-09-17T04:25:34.727Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WPA2 implementation on the Belkin N900 F9K1104v1 router establishes a WPS PIN based on 6 digits of the LAN/WLAN MAC address, which makes it easier for remote attackers to obtain access to a Wi-Fi network by reading broadcast packets, a different vulnerability than CVE-2012-4366. Additional Analyst Notes: - CVE Program Container: References: - http://ednolo.alumnos.upv.es/?p=1295
CVE ID: CVE-2012-6392 State: PUBLISHED Published: 2013-01-17T15:00:00Z Last Updated: 2024-09-16T19:46:00.464Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cisco Prime LAN Management Solution (LMS) 4.1 through 4.2.2 on Linux does not properly validate authentication and authorization requests in TCP sessions, which allows remote attackers to execute arbitrary commands via a crafted session, aka Bug ID CSCuc79779. Additional Analyst Notes: - CVE Program Container: References: - http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130109-lms
CVE ID: CVE-2012-6395 State: PUBLISHED Published: 2013-01-18T21:00:00 Last Updated: 2024-08-06T21:28:39.810Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cisco Adaptive Security Appliances (ASA) devices with firmware 8.4 do not properly validate unspecified input related to UNC share pathnames, which allows remote authenticated users to cause a denial of service (device crash) via unknown vectors, aka Bug ID CSCuc65775. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/51955 - http://www.securitytracker.com/id/1028009 - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-6395
CVE ID: CVE-2012-6396 State: PUBLISHED Published: 2013-01-19T20:00:00 Last Updated: 2024-08-06T21:28:39.784Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cisco NX-OS on Nexus 7000 series switches does not properly handle certain line-card replacements, which might allow remote authenticated users to cause a denial of service (memory consumption) via a crafted configuration that references interfaces that do not exist on the new card, aka Bug ID CSCud44300. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1028018 - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-6396
CVE ID: CVE-2012-6397 State: PUBLISHED Published: 2013-01-17T15:00:00Z Last Updated: 2024-09-17T02:47:58.005Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Cisco WebEx Social (formerly Cisco Quad) allows remote attackers to inject arbitrary web script or HTML via a crafted RSS service link, aka Bug ID CSCub61977. Additional Analyst Notes: - CVE Program Container: References: - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-6397
CVE ID: CVE-2012-6399 State: PUBLISHED Published: 2013-05-27T14:00:00Z Last Updated: 2024-09-16T22:25:14.412Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cisco WebEx 4.1 on iOS does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, aka Bug ID CSCud94176. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/51412
CVE ID: CVE-2012-6401 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2012-6402 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2012-6403 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2012-6404 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2012-6405 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2012-6406 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2012-6407 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2012-6408 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2012-6409 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2012-6410 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2012-6411 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2012-6412 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2012-6413 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2012-6414 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2012-6415 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2012-6416 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2012-6417 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2012-6418 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2012-6419 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2012-6420 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2012-6421 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2012-6422 State: PUBLISHED Published: 2012-12-18T00:00:00Z Last Updated: 2024-09-16T19:15:58.524Z Vendors: n/a Products: n/a Problem Types: n/a Description: The kernel in Samsung Galaxy S2, Galaxy Note 2, MEIZU MX, and possibly other Android devices, when running an Exynos 4210 or 4412 processor, uses weak permissions (0666) for /dev/exynos-mem, which allows attackers to read or write arbitrary physical memory and gain privileges via a crafted application, as demonstrated by ExynosAbuse. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityweek.com/new-vulnerability-exposed-samsungs-android-devices - http://project-voodoo.org/articles/instant-fix-ap
.securityweek.com/new-vulnerability-exposed-samsungs-android-devices - http://project-voodoo.org/articles/instant-fix-app-for-exynos-mem-abuse-vulnerability-no-root-required-reversible - http://forum.xda-developers.com/showthread.php?p=35469999 - http://arstechnica.com/security/2012/12/developer-warns-of-critical-vulnerability-in-many-samsung-smartphones/ - http://forum.xda-developers.com/showthread.php?t=2051290 - http://www.sammobile.com/2012/12/16/major-vulnerability-found-on-exynos-4-devices/ - http://osvdb.org/88467
CVE ID: CVE-2012-6426 State: PUBLISHED Published: 2013-01-01T15:00:00Z Last Updated: 2024-09-16T19:41:54.777Z Vendors: n/a Products: n/a Problem Types: n/a Description: LemonLDAP::NG before 1.2.3 does not use the signature-verification capability of the Lasso library, which allows remote attackers to bypass intended access-control restrictions via crafted SAML data. Additional Analyst Notes: - CVE Program Container: References: - http://jira.ow2.org/browse/LEMONLDAP-570 - http://openwall.com/lists/oss-security/2012/12/19/6 - http://openwall.com/lists/oss-security/2012/12/20/6
CVE ID: CVE-2012-6427 State: PUBLISHED Published: 2012-12-23T21:00:00Z Last Updated: 2025-07-01T20:01:06.026Z Severity: N/A (CVSS 7.8 AV:N/AC:L/Au:N/C:C/I:N/A:N) Vendors: Carlo Gavazzi Automation Products: EOS-Box Problem Types: CWE-89 Description: The Carlo Gavazzi EOS-Box does not check the validity of the data before executing queries. By accessing the SQL table of certain pages that do not require authentication, attackers can leak information from the device. This could allow the attacker to compromise confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-12-354-02
CVE ID: CVE-2012-6428 State: PUBLISHED Published: 2012-12-23T21:00:00Z Last Updated: 2025-07-01T19:59:06.114Z Severity: N/A (CVSS 10 AV:N/AC:L/Au:N/C:C/I:C/A:C) Vendors: Carlo Gavazzi Automation Products: EOS-Box Problem Types: CWE-798 Description: The Carlo Gavazzi EOS-Box stores hard-coded passwords in the PHP file of the device. By using the hard-coded passwords, attackers can log into the device with administrative privileges. This could allow the attacker to have unauthorized access. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-12-354-02
CVE ID: CVE-2012-6429 State: PUBLISHED Published: 2014-04-04T14:00:00 Last Updated: 2024-08-06T21:28:39.934Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the PrepareSync method in the SyncService.dll ActiveX control in Samsung Kies before 2.5.1.12123_2_7 allows remote attackers to execute arbitrary code via a long string to the password argument. Additional Analyst Notes: - CVE Program Container: References: - https://www.htbridge.com/advisory/HTB23136 - https://exchange.xforce.ibmcloud.com/vulnerabilities/81160 - http://archives.neohapsis.com/archives/bugtraq/2013-01/0036.html - http://www.securityfocus.com/bid/57249 - http://packetstormsecurity.com/files/11
om/archives/bugtraq/2013-01/0036.html - http://www.securityfocus.com/bid/57249 - http://packetstormsecurity.com/files/119423/Samsung-Kies-2.5.0.12114_1-Buffer-Overflow.html - http://osvdb.org/89118
CVE ID: CVE-2012-6430 State: PUBLISHED Published: 2014-03-24T14:00:00 Last Updated: 2024-08-06T21:28:39.936Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Open Solution Quick.Cms 5.0 and Quick.Cart 6.0, possibly as downloaded before December 19, 2012, allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to admin.php. NOTE: this might be a duplicate of CVE-2008-4140. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/89120 - http://osvdb.org/89119 - http://secunia.com/advisories/51813 - http://secunia.com/advisories/51769 - http://packetstormsecurity.com/files/119422/Quick.Cms-5
nia.com/advisories/51813 - http://secunia.com/advisories/51769 - http://packetstormsecurity.com/files/119422/Quick.Cms-5.0-Quick.Cart-6.0-Cross-Site-Scripting.html - https://www.htbridge.com/advisory/HTB23135 - http://archives.neohapsis.com/archives/bugtraq/2013-01/0035.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/81169
CVE ID: CVE-2012-6431 State: PUBLISHED Published: 2012-12-27T11:00:00Z Last Updated: 2024-09-17T00:46:20.194Z Vendors: n/a Products: n/a Problem Types: n/a Description: Symfony 2.0.x before 2.0.20 does not process URL encoded data consistently within the Routing and Security components, which allows remote attackers to bypass intended URI restrictions via a doubly encoded string. Additional Analyst Notes: - CVE Program Container: References: - http://symfony.com/blog/security-release-symfony-2-0-20-and-2-1-5-released
CVE ID: CVE-2012-6432 State: PUBLISHED Published: 2012-12-27T11:00:00Z Last Updated: 2024-09-16T20:06:59.052Z Vendors: n/a Products: n/a Problem Types: n/a Description: Symfony 2.0.x before 2.0.20, 2.1.x before 2.1.5, and 2.2-dev, when the internal routes configuration is enabled, allows remote attackers to access arbitrary services via vectors involving a URI beginning with a /_internal substring. Additional Analyst Notes: - CVE Program Container: References: - http://symfony.com/blog/security-release-symfony-2-0-20-and-2-1-5-released
CVE ID: CVE-2012-6433 State: PUBLISHED Published: 2013-01-03T11:00:00Z Last Updated: 2024-09-16T20:26:18.204Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in e107_admin/newspost.php in e107 1.0.1 allows remote attackers to hijack the authentication of administrators for requests that conduct XSS attacks via the news_title parameter in a create action. Additional Analyst Notes: - CVE Program Container: References: - http://e107.org/changelog - http://e107.svn.sourceforge.net/viewvc/e107/trunk/e107_0.7/e107_admin/newspost.php?sortdir=down&r1=12622&r2=12992&sortby=rev - http://www.exploit-db.com/exploits/23828/
CVE ID: CVE-2012-6434 State: PUBLISHED Published: 2013-01-03T11:00:00Z Last Updated: 2024-09-16T16:28:43.566Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in e107_admin/download.php in e107 1.0.2 allow remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the (1) download_url, (2) download_url_extended, (3) download_author_email, (4) download_author_website, (5) download_image, (6) download_thumb, (7) download_visible, or (8) download_class parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/23829/ -
parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/23829/ - http://e107.org/changelog - http://e107.svn.sourceforge.net/viewvc/e107/trunk/e107_0.7/e107_admin/download.php?sortdir=down&r1=13037&r2=13058&sortby=rev
CVE ID: CVE-2012-6435 State: PUBLISHED Published: 2013-01-24T21:00:00Z Last Updated: 2025-06-30T21:37:15.940Z Severity: N/A (CVSS 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C) Vendors: Rockwell Automation Products: 1756-ENBT, 1756-EWEB, 1768-ENBT, 1768-EWEB communication modules, CompactLogix L32E and L35E controllers, 1788-ENBT FLEXLogix adapter, 1794-AENTR FLEX I/O EtherNet/IP adapter, ControlLogix, CompactLogix, GuardLogix, and SoftLogix, CompactLogix and SoftLogix controllers, ControlLogix and GuardLogix controllers, MicroLogix Problem Types: CWE-284 Description: When an affected product receives a valid CIP message from an unauthorized or unintended source to Port 2222/TCP, Port 2222/UDP, Port 44818/
duct receives a valid CIP message from an unauthorized or unintended source to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP that instructs the CPU to stop logic execution and enter a fault state, a DoS can occur. This situation could cause loss of availability and a disruption of communication with other connected devices. Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controller
8 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400 Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-13-011-03 - https://rockwellautomation.custhelp.com/app/answers/detail/a_id/470154 - https://rockwellautomation.custhelp.com/app/answers/detail/aid/470155 - https://rockwellautomation.custhelp.com/app/answers/detail/aid/470156 - http://rockwellautomation.custhelp.com/app/answers/detail/a_id/54102
CVE ID: CVE-2012-6436 State: PUBLISHED Published: 2013-01-24T21:00:00Z Last Updated: 2025-06-30T21:59:03.474Z Severity: N/A (CVSS 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C) Vendors: Rockwell Automation Products: 1756-ENBT, 1756-EWEB, 1768-ENBT, 1768-EWEB communication modules, CompactLogix L32E and L35E controllers, 1788-ENBT FLEXLogix adapter, 1794-AENTR FLEX I/O EtherNet/IP adapter, ControlLogix, CompactLogix, GuardLogix, and SoftLogix, CompactLogix and SoftLogix controllers, ControlLogix and GuardLogix controllers, MicroLogix Problem Types: CWE-119 Description: The device does not properly validate the data being sent to the buffer. An attacker can send a malformed CIP packet to Port 2222/TCP, Port
properly validate the data being sent to the buffer. An attacker can send a malformed CIP packet to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP, which creates a buffer overflow and causes the CPU to crash. Successful exploitation of this vulnerability could cause loss of availability and a disruption in communications with other connected devices. Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlie
IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400 Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-13-011-03 - https://rockwellautomation.custhelp.com/app/answers/detail/a_id/470154 - https://rockwellautomation.custhelp.com/app/answers/detail/aid/470155 - https://rockwellautomation.custhelp.com/app/answers/detail/aid/470156 - http://rockwellautomation.custhelp.com/app
155 - https://rockwellautomation.custhelp.com/app/answers/detail/aid/470156 - http://rockwellautomation.custhelp.com/app/answers/detail/a_id/54102
CVE ID: CVE-2012-6437 State: PUBLISHED Published: 2013-01-24T21:00:00Z Last Updated: 2025-06-30T22:05:18.667Z Severity: N/A (CVSS 10 AV:N/AC:L/Au:N/C:C/I:C/A:C) Vendors: Rockwell Automation Products: 1756-ENBT, 1756-EWEB, 1768-ENBT, 1768-EWEB communication modules, CompactLogix L32E and L35E controllers, 1788-ENBT FLEXLogix adapter, 1794-AENTR FLEX I/O EtherNet/IP adapter, ControlLogix, CompactLogix, GuardLogix, and SoftLogix, CompactLogix and SoftLogix controllers, ControlLogix and GuardLogix controllers, MicroLogix Problem Types: CWE-287 Description: The device does not properly authenticate users and the potential exists for a remote user to upload a new firmware image to the Ethernet car