deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-2568
Published: 2017-02-13
Description: pkexec, when used with --user nonpriv, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.
CVSS Score: 7.8 (HIGH)
CWE: CWE-116
References: http://www.openwall.com/lists/oss-security/2016/02/26/3; https://access.redhat.com/security/cve/cve-2016-2568; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=816062
CVE: CVE-2016-2787
Published: 2017-02-13
Description: The Puppet Communications Protocol in Puppet Enterprise 2015.3.x before 2015.3.3 does not properly validate certificates for the broker node, which allows remote non-whitelisted hosts to prevent runs from triggering via unspecified vectors.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://puppet.com/security/cve/CVE-2016-2787; https://puppet.com/security/cve/CVE-2016-2787
CVE: CVE-2016-2788
Published: 2017-02-13
Description: MCollective 2.7.0 and 2.8.x before 2.8.9, as used in Puppet Enterprise, allows remote attackers to execute arbitrary code via vectors related to the mco ping command.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://puppet.com/security/cve/cve-2016-2788; https://puppet.com/security/cve/cve-2016-2788
CVE: CVE-2016-3616
Published: 2017-02-13
Description: The cjpeg utility in libjpeg allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or execute arbitrary code via a crafted file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-476
References: https://access.redhat.com/errata/RHSA-2019:2052; https://bugzilla.redhat.com/show_bug.cgi?id=1318509; https://bugzilla.redhat.com/show_bug.cgi?id=1319661
CVE: CVE-2016-3995
Published: 2017-02-13
Description: The timing attack protection in Rijndael::Enc::ProcessAndXorBlock and Rijndael::Dec::ProcessAndXorBlock in Crypto++ (aka cryptopp) before 5.6.4 may be optimized out by the compiler, which allows attackers to conduct timing attacks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2016/04/11/2; http://www.securityfocus.com/bid/85975; https://github.com/weidai11/cryptopp/issues/146
CVE: CVE-2016-4546
Published: 2017-02-13
Description: Samsung devices with Android KK(4.4) or L(5.0/5.1) allow local users to cause a denial of service (IAndroidShm service crash) via crafted data in a service call.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://security.samsungmobile.com/smrupdate.html#SMR-JAN-2016; http://www.openwall.com/lists/oss-security/2016/05/06/1; http://security.samsungmobile.com/smrupdate.html#SMR-JAN-2016
CVE: CVE-2016-4547
Published: 2017-02-13
Description: Samsung devices with Android KK(4.4), L(5.0/5.1), or M(6.0) allow attackers to cause a denial of service (system crash) via a crafted system call to TvoutService_C.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://security.samsungmobile.com/smrupdate.html#SMR-FEB-2016; http://www.openwall.com/lists/oss-security/2016/05/06/2; http://security.samsungmobile.com/smrupdate.html#SMR-FEB-2016
CVE: CVE-2016-5100
Published: 2017-02-13
Description: Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by predicting a value.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-330
References: https://github.com/Froxlor/Froxlor/commit/da4ec3e1b591de96675817a009e26e05e848a6ba; https://github.com/Froxlor/Froxlor/commit/da4ec3e1b591de96675817a009e26e05e848a6ba
CVE: CVE-2016-6129
Published: 2017-02-13
Description: The rsa_verify_hash_ex function in rsa_verify_hash.c in LibTomCrypt, as used in OP-TEE before 2.2.0, does not validate that the message length is equal to the ASN.1 encoded data length, which makes it easier for remote attackers to forge RSA signatures or public certificates by leveraging a Bleichenbacher signature forgery attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://bugzilla.redhat.com/show_bug.cgi?id=1370955; https://github.com/libtom/libtomcrypt/commit/5eb9743410ce4657e9d54fef26a2ee31a1b5dd0; https://www.op-tee.org/advisories/
CVE: CVE-2016-7565
Published: 2017-02-13
Description: install/index.php in Exponent CMS 2.3.9 allows remote attackers to execute arbitrary commands via shell metacharacters in the sc array parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: http://www.openwall.com/lists/oss-security/2016/09/22/6; https://exponentcms.lighthouseapp.com/projects/61783/changesets/4ae457ff1bf80e8b61286cd125ca794b25564e86; https://github.com/exponentcms/exponent-cms/commit/4ae457ff1bf80e8b61286cd125ca794b25564e86
CVE: CVE-2016-8659
Published: 2017-02-13
Description: Bubblewrap before 0.1.3 sets the PR_SET_DUMPABLE flag, which might allow local users to gain privileges by attaching to the process, as demonstrated by sending commands to a PrivSep socket.
CVSS Score: 7.0 (HIGH)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2016/10/12/5; http://www.openwall.com/lists/oss-security/2016/10/13/4; http://www.securityfocus.com/bid/93542
CVE: CVE-2016-8859
Published: 2017-02-13
Description: Multiple integer overflows in the TRE library and musl libc allow attackers to cause memory corruption via a large number of (1) states or (2) tags, which triggers an out-of-bounds write.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.html; http://www.openwall.com/lists/oss-security/2016/10/19/1; http://www.openwall.com/lists/oss-security/2016/10/19/10
CVE: CVE-2016-10224
Published: 2017-02-13
Description: An issue was discovered in Sauter NovaWeb web HMI. The application uses a protection mechanism that relies on the existence or values of a cookie, but it does not properly ensure that the cookie is valid for the associated user.
CVSS Score: 7.2 (HIGH)
CWE: CWE-254
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-343-02; https://ics-cert.us-cert.gov/advisories/ICSA-16-343-02
CVE: CVE-2016-2274
Published: 2017-02-13
Description: An issue was discovered in Adcon Telemetry A850 Telemetry Gateway Base Station. The Web Interface does not neutralize or incorrectly neutralizes user-controllable input before it is placed in the output; this could allow for cross-site scripting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/94781; https://ics-cert.us-cert.gov/advisories/ICSA-16-343-03; http://www.securityfocus.com/bid/94781
CVE: CVE-2016-5782
Published: 2017-02-13
Description: An issue was discovered in Locus Energy LGate prior to 1.05H, LGate 50, LGate 100, LGate 101, LGate 120, and LGate 320. Locus Energy meters use a PHP script to manage the energy meter parameters for voltage monitoring and network configuration. The PHP code does not properly validate information that is sent in the POST request.
CVSS Score: 8.6 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/94698; http://www.securityfocus.com/bid/94782; https://ics-cert.us-cert.gov/advisories/ICSA-16-231-01-0
CVE: CVE-2016-5786
Published: 2017-02-13
Description: An issue was discovered in OmniMetrix OmniView, Version 1.2. The OmniView web application transmits credentials with the HTTP protocol, which could be sniffed by an attacker that may result in the compromise of account credentials.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/94937; https://ics-cert.us-cert.gov/advisories/ICSA-16-350-02; http://www.securityfocus.com/bid/94937
CVE: CVE-2016-5796
Published: 2017-02-13
Description: An issue was discovered in Fatek Automation PM Designer V3 Version 2.1.2.2, and Automation FV Designer Version 1.2.8.0. Sending additional valid packets could allow the attacker to cause a crash or to execute arbitrary code, because of Improper Restriction of Operations within the Bounds of a Memory Buffer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/93105; https://ics-cert.us-cert.gov/advisories/ICSA-16-287-06; http://www.securityfocus.com/bid/93105
CVE: CVE-2016-5798
Published: 2017-02-13
Description: An issue was discovered in Fatek Automation PM Designer V3 Version 2.1.2.2, and Automation FV Designer Version 1.2.8.0. By sending additional valid packets, an attacker could trigger a stack-based buffer overflow and cause a crash. Also, a malicious attacker can trigger a remote buffer overflow on the Fatek Communication Server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/93105; https://ics-cert.us-cert.gov/advisories/ICSA-16-287-06; http://www.securityfocus.com/bid/93105
CVE: CVE-2016-5801
Published: 2017-02-13
Description: An issue was discovered in OmniMetrix OmniView, Version 1.2. Insufficient password requirements for the OmniView web application may allow an attacker to gain access by brute forcing account passwords.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://www.securityfocus.com/bid/94937; https://ics-cert.us-cert.gov/advisories/ICSA-16-350-02; http://www.securityfocus.com/bid/94937
CVE: CVE-2016-5802
Published: 2017-02-13
Description: An issue was discovered in Delta Electronics WPLSoft, Versions prior to V2.42.11, ISPSoft, Versions prior to 3.02.11, and PMSoft, Versions prior to 2.10.10. Multiple instances of out-of-bounds write conditions may allow malicious files to be read and executed by the affected software.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/94887; https://ics-cert.us-cert.gov/advisories/ICSA-16-348-03; http://www.securityfocus.com/bid/94887
CVE: CVE-2016-5803
Published: 2017-02-13
Description: An issue was discovered in CA Unified Infrastructure Management Version 8.47 and earlier. The Unified Infrastructure Management software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.
CVSS Score: 8.6 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/94243; https://ics-cert.us-cert.gov/advisories/ICSA-16-315-01; https://www.ca.com/us/services-support/ca-support/ca-support-online/product-content/recommended-reading/security-notices/ca20161109-01-security-notice-for-ca-unified-infrastructure-mgmt.html
CVE: CVE-2016-5805
Published: 2017-02-13
Description: An issue was discovered in Delta Electronics WPLSoft, Versions prior to V2.42.11, ISPSoft, Versions prior to 3.02.11, and PMSoft, Versions prior to2.10.10. There are multiple instances of heap-based buffer overflows that may allow malicious files to cause the execution of arbitrary code or a denial of service.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/94887; https://ics-cert.us-cert.gov/advisories/ICSA-16-348-03; http://www.securityfocus.com/bid/94887
CVE: CVE-2016-5809
Published: 2017-02-13
Description: An issue was discovered on Schneider Electric IONXXXX series power meters ION73XX series, ION75XX series, ION76XX series, ION8650 series, ION8800 series, and PM5XXX series. There is no CSRF Token generated to authenticate the user during a session. Successful exploitation of this vulnerability can allow unauthorized configuration changes to be made and saved.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.securityfocus.com/bid/92916; https://ics-cert.us-cert.gov/advisories/ICSA-16-308-03; https://www.exploit-db.com/exploits/44640/
CVE: CVE-2016-5811
Published: 2017-02-13
Description: An issue was discovered in Visonic PowerLink2, all versions prior to October 2016 firmware release. User controlled input is not neutralized prior to being placed in web page output (CROSS-SITE SCRIPTING).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/94894; https://ics-cert.us-cert.gov/advisories/ICSA-16-348-01; http://www.securityfocus.com/bid/94894
CVE: CVE-2016-5813
Published: 2017-02-13
Description: An issue was discovered in Visonic PowerLink2, all versions prior to October 2016 firmware release. When a specific URL to an image is accessed, the downloaded image carries with it source code used in the web server (INFORMATION EXPOSURE).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/94894; https://ics-cert.us-cert.gov/advisories/ICSA-16-348-01; http://www.securityfocus.com/bid/94894
CVE: CVE-2016-5815
Published: 2017-02-13
Description: An issue was discovered on Schneider Electric IONXXXX series power meters ION73XX series, ION75XX series, ION76XX series, ION8650 series, ION8800 series, and PM5XXX series. No authentication is configured by default. An unauthorized user can access the device management portal and make configuration changes.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: http://www.securityfocus.com/bid/94091; https://ics-cert.us-cert.gov/advisories/ICSA-16-308-03; http://www.securityfocus.com/bid/94091
CVE: CVE-2016-5818
Published: 2017-02-13
Description: An issue was discovered in Schneider Electric PowerLogic PM8ECC device 2.651 and older. Undocumented hard-coded credentials allow access to the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://www.securityfocus.com/bid/93602; https://ics-cert.us-cert.gov/advisories/ICSA-16-292-01; http://www.securityfocus.com/bid/93602
CVE: CVE-2016-7987
Published: 2017-02-13
Description: An issue was discovered in Siemens ETA4 firmware (all versions prior to Revision 08) of the SM-2558 extension module for: SICAM AK, SICAM TM 1703, SICAM BC 1703, and SICAM AK 3. Specially crafted packets sent to Port 2404/TCP could cause the affected device to go into defect mode. A cold start might be required to recover the system, a Denial-of-Service Vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-19
References: http://www.securityfocus.com/bid/93832; https://ics-cert.us-cert.gov/advisories/ICSA-16-299-01; http://www.securityfocus.com/bid/93832
CVE: CVE-2016-8341
Published: 2017-02-13
Description: An issue was discovered in Ecava IntegraXor Version 5.0.413.0. The Ecava IntegraXor web server has parameters that are vulnerable to SQL injection. If the queries are not sanitized, the host's database could be subject to read, write, and delete commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.securityfocus.com/bid/95907; https://ics-cert.us-cert.gov/advisories/ICSA-17-031-02; http://www.securityfocus.com/bid/95907
CVE: CVE-2016-8344
Published: 2017-02-13
Description: An issue was discovered in Honeywell Experion Process Knowledge System (PKS) platform: Experion PKS, Release 3xx and prior, Experion PKS, Release 400, Experion PKS, Release 410, Experion PKS, Release 430, and Experion PKS, Release 431. Experion PKS does not properly validate input. By sending a specially crafted packet, an attacker could cause the process to terminate. A successful exploit would prevent firmware uploads to the Series-C devices.
CVSS Score: 3.7 (LOW)
CWE: CWE-20
References: http://www.securityfocus.com/bid/93950; https://ics-cert.us-cert.gov/advisories/ICSA-16-301-01; http://www.securityfocus.com/bid/93950
CVE: CVE-2016-8346
Published: 2017-02-13
Description: An issue was discovered in Moxa EDR-810 Industrial Secure Router. By accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to access configuration and log files (PRIVILEGE ESCALATION).
CVSS Score: 7.5 (HIGH)
CWE: CWE-532
References: http://www.securityfocus.com/bid/93800; https://ics-cert.us-cert.gov/advisories/ICSA-16-294-01; http://www.securityfocus.com/bid/93800
CVE: CVE-2016-8347
Published: 2017-02-13
Description: An issue was discovered in Kabona AB WebDatorCentral (WDC) application prior to Version 3.4.0. WDC does not limit authentication attempts that may allow a brute force attack method.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://www.securityfocus.com/bid/93547; https://ics-cert.us-cert.gov/advisories/ICSA-16-287-07; http://www.securityfocus.com/bid/93547
CVE: CVE-2016-8348
Published: 2017-02-13
Description: An XML External Entity (XXE) issue was discovered in Emerson Liebert SiteScan Web Version 6.5, and prior. An attacker may enter malicious input to Liebert SiteScan through a weakly configured XML parser causing the application to execute arbitrary code or disclose file contents from a server or connected network.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: http://www.securityfocus.com/bid/94587; https://ics-cert.us-cert.gov/advisories/ICSA-16-334-01; http://www.securityfocus.com/bid/94587
CVE: CVE-2016-8350
Published: 2017-02-13
Description: An issue was discovered in Moxa ioLogik E1210, firmware Version V2.4 and prior, ioLogik E1211, firmware Version V2.3 and prior, ioLogik E1212, firmware Version V2.4 and prior, ioLogik E1213, firmware Version V2.5 and prior, ioLogik E1214, firmware Version V2.4 and prior, ioLogik E1240, firmware Version V2.3 and prior, ioLogik E1241, firmware Version V2.4 and prior, ioLogik E1242, firmware Version V2.4 and prior, ioLogik E1260, firmware Version V2.4 and prior, ioLogik E1262, firmware Version V2.4 and prior, ioLogik E2210, firmware versions prior to V3.13, ioLogik E2212, firmware versions prior to V3.14, ioLogik E2214, firmware versions prior to V3.12, ioLogik E2240, firmware versions prior to V3.12, ioLogik E2242, firmware versions prior to V3.12, ioLogik E2260, firmware versions prior to V3.13, and ioLogik E2262, firmware versions prior to V3.12. The web application may not sufficiently verify whether a request was provided by a valid user (CROSS-SITE REQUEST FORGERY).
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-352
References: http://www.securityfocus.com/bid/93550; https://ics-cert.us-cert.gov/advisories/ICSA-16-287-05; http://www.securityfocus.com/bid/93550
CVE: CVE-2016-8352
Published: 2017-02-13
Description: An issue was discovered in Schneider Electric ConneXium firewalls TCSEFEC23F3F20 all versions, TCSEFEC23F3F21 all versions, TCSEFEC23FCF20 all versions, TCSEFEC23FCF21 all versions, and TCSEFEC2CF3F20 all versions. A stack-based buffer overflow can be triggered during the SNMP login authentication process that may allow an attacker to remotely execute code.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/94062; https://ics-cert.us-cert.gov/advisories/ICSA-16-306-01; http://www.securityfocus.com/bid/94062
CVE: CVE-2016-8353
Published: 2017-02-13
Description: An issue was discovered in OSIsoft PI Web API 2015 R2 (Version 1.5.1). There is a weakness in this product that may allow an attacker to access the PI system without the proper permissions.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/bid/93552; https://ics-cert.us-cert.gov/advisories/ICSA-16-287-01; http://www.securityfocus.com/bid/93552
CVE: CVE-2016-8354
Published: 2017-02-13
Description: An issue was discovered in Schneider Electric Unity PRO prior to V11.1. Unity projects can be compiled as x86 instructions and loaded onto the PLC Simulator delivered with Unity PRO. These x86 instructions are subsequently executed directly by the simulator. A specially crafted patched Unity project file can make the simulator execute malicious code by redirecting the control flow of these instructions.
CVSS Score: 7.0 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/93830; https://ics-cert.us-cert.gov/advisories/ICSA-16-306-03; http://www.securityfocus.com/bid/93830
CVE: CVE-2016-8356
Published: 2017-02-13
Description: An issue was discovered in Kabona AB WebDatorCentral (WDC) application prior to Version 3.4.0. The web server URL inputs are not sanitized correctly, which may allow cross-site scripting vulnerabilities.
CVSS Score: 8.2 (HIGH)
CWE: CWE-79
References: http://www.securityfocus.com/bid/93547; https://ics-cert.us-cert.gov/advisories/ICSA-16-287-07; http://www.securityfocus.com/bid/93547
CVE: CVE-2016-8357
Published: 2017-02-13
Description: An issue was discovered in Lynxspring JENEsys BAS Bridge versions 1.1.8 and older. A user with read-only access can send commands to the software and the application will accept those commands. This would allow an attacker with read-only access to make changes within the application.
CVSS Score: 7.1 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/94344; https://ics-cert.us-cert.gov/advisories/ICSA-16-320-01; http://www.securityfocus.com/bid/94344
CVE: CVE-2016-8359
Published: 2017-02-13
Description: An issue was discovered in Moxa ioLogik E1210, firmware Version V2.4 and prior, ioLogik E1211, firmware Version V2.3 and prior, ioLogik E1212, firmware Version V2.4 and prior, ioLogik E1213, firmware Version V2.5 and prior, ioLogik E1214, firmware Version V2.4 and prior, ioLogik E1240, firmware Version V2.3 and prior, ioLogik E1241, firmware Version V2.4 and prior, ioLogik E1242, firmware Version V2.4 and prior, ioLogik E1260, firmware Version V2.4 and prior, ioLogik E1262, firmware Version V2.4 and prior, ioLogik E2210, firmware versions prior to V3.13, ioLogik E2212, firmware versions prior to V3.14, ioLogik E2214, firmware versions prior to V3.12, ioLogik E2240, firmware versions prior to V3.12, ioLogik E2242, firmware versions prior to V3.12, ioLogik E2260, firmware versions prior to V3.13, and ioLogik E2262, firmware versions prior to V3.12. The web application fails to sanitize user input, which may allow an attacker to inject script or execute arbitrary code (CROSS-SITE SCRIPTING).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/93550; https://ics-cert.us-cert.gov/advisories/ICSA-16-287-05; http://www.securityfocus.com/bid/93550
CVE: CVE-2016-8360
Published: 2017-02-13
Description: An issue was discovered in Moxa SoftCMS versions prior to Version 1.6. A specially crafted URL request sent to the SoftCMS ASP Webserver can cause a double free condition on the server allowing an attacker to modify memory locations and possibly cause a denial of service or the execution of arbitrary code.
CVSS Score: 8.1 (HIGH)
CWE: CWE-415
References: http://www.securityfocus.com/bid/94394; https://ics-cert.us-cert.gov/advisories/ICSA-16-322-02; http://www.securityfocus.com/bid/94394
CVE: CVE-2016-8361
Published: 2017-02-13
Description: An issue was discovered in Lynxspring JENEsys BAS Bridge versions 1.1.8 and older. The application uses a hard-coded username with no password allowing an attacker into the system without authentication.
CVSS Score: 8.6 (HIGH)
CWE: CWE-798
References: http://www.securityfocus.com/bid/94344; https://ics-cert.us-cert.gov/advisories/ICSA-16-320-01; http://www.securityfocus.com/bid/94344
CVE: CVE-2016-8362
Published: 2017-02-13
Description: An issue was discovered in Moxa OnCell OnCellG3470A-LTE, AWK-1131A/3131A/4131A Series, AWK-3191 Series, AWK-5232/6232 Series, AWK-1121/1127 Series, WAC-1001 V2 Series, WAC-2004 Series, AWK-3121-M12-RTG Series, AWK-3131-M12-RCC Series, AWK-5232-M12-RCC Series, TAP-6226 Series, AWK-3121/4121 Series, AWK-3131/4131 Series, and AWK-5222/6222 Series. Any user is able to download log files by accessing a specific URL.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: http://www.securityfocus.com/bid/94092; https://ics-cert.us-cert.gov/advisories/ICSA-16-308-01; http://www.securityfocus.com/bid/94092
CVE: CVE-2016-8363
Published: 2017-02-13
Description: An issue was discovered in Moxa OnCell OnCellG3470A-LTE, AWK-1131A/3131A/4131A Series, AWK-3191 Series, AWK-5232/6232 Series, AWK-1121/1127 Series, WAC-1001 V2 Series, WAC-2004 Series, AWK-3121-M12-RTG Series, AWK-3131-M12-RCC Series, AWK-5232-M12-RCC Series, TAP-6226 Series, AWK-3121/4121 Series, AWK-3131/4131 Series, and AWK-5222/6222 Series. User is able to execute arbitrary OS commands on the server.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-264
References: http://www.securityfocus.com/bid/94092; https://ics-cert.us-cert.gov/advisories/ICSA-16-308-01; http://www.securityfocus.com/bid/94092
CVE: CVE-2016-8364
Published: 2017-02-13
Description: An issue was discovered in IBHsoftec S7-SoftPLC prior to 4.12b. Object memory can read a network packet that is larger than the space that is available, a Heap-based Buffer Overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/94054; https://ics-cert.us-cert.gov/advisories/ICSA-16-306-02; http://www.securityfocus.com/bid/94054