CERT-Bund
organizationDE01
references
Other names and identifiers for this entity.
cert_bundDE csaf@cert-bund.de
02
assessed vulnerabilities (17)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-50981US | —OT elevated | — | ||
An unauthenticated remote attacker can gain full access on the affected devices as they are shipped without a password by default and setting one is not enforced. | ||||
| CVE-2022-50980US | —OT elevated | — | ||
A unauthenticated adjacent attacker could potentially disrupt operations by switching between multiple configuration presets via CAN. | ||||
| CVE-2022-50979US | —OT elevated | — | ||
An unauthenticated adjacent attacker could potentially disrupt operations by switching between multiple configuration presets via Modbus (RS485). | ||||
| CVE-2022-50978US | —OT elevated | — | ||
An unauthenticated remote attacker could potentially disrupt operations by switching between multiple configuration presets via Modbus (TCP). | ||||
| CVE-2022-50977US | —OT elevated | — | ||
An unauthenticated remote attacker could potentially disrupt operations by switching between multiple configuration presets via HTTP. | ||||
| CVE-2022-50976US | — | — | ||
A local attacker could cause a full device reset by resetting the device passwords using an invalid reset file via USB. | ||||
| CVE-2022-50975US | — | — | ||
An unauthenticated remote attacker is able to use an existing session id of a logged in user and gain full access to the device if configuration via ethernet is enabled. | ||||
| CVE-2023-34873US | — | — | ||
On MOBOTIX P3 cameras before MX-V4.7.2.18 and Mx6 cameras before MX-V5.2.0.61, the tcpdump feature does not properly validate input, which allows authenticated users to execute cod… | ||||
| CVE-2024-31497US | medium5.9 | Exploit | ||
In PuTTY 0.68 through 0.80 before 0.81, biased ECDSA nonce generation allows an attacker to recover a user's NIST P-521 secret key via a quick attack in approximately 60 signatures… | ||||
| CVE-2022-47925US | — | — | ||
The validate JSON endpoint of the Secvisogram csaf-validator-service in versions < 0.1.0 processes tests with unexpected names. This insufficient input validation of requests by an… | ||||
| CVE-2022-47924US | medium6.5 | — | ||
An high privileged attacker may pass crafted arguments to the validate function of csaf-validator-lib of a locally installed Secvisogram in versions < 0.1.0 wich can result in arbi… | ||||
| CVE-2022-43977US | critical9.8 | — | ||
An issue was discovered on GE Grid Solutions MS3000 devices before 3.7.6.25p0_3.2.2.17p0_4.7p0. The debug port accessible via TCP (a qconn service) lacks access control. | ||||
| CVE-2022-43976US | critical9.8OT elevated | — | ||
An issue was discovered in FC46-WebBridge on GE Grid Solutions MS3000 devices before 3.7.6.25p0_3.2.2.17p0_4.7p0. Direct access to the API is possible on TCP port 8888 via programs… | ||||
| CVE-2022-43975US | high7.5 | — | ||
An issue was discovered in FC46-WebBridge on GE Grid Solutions MS3000 devices before 3.7.6.25p0_3.2.2.17p0_4.7p0. A vulnerability in the web server allows arbitrary files and confi… | ||||
| CVE-2022-43996US | medium5.4 | — | ||
The csaf_provider package before 0.8.2 allows XSS via a crafted CSAF document uploaded as text/html. The endpoint upload allows valid CSAF advisories (JSON format) to be uploaded w… | ||||
| CVE-2022-36947US | critical9.8 | — | ||
Unsafe Parsing of a PNG tRNS chunk in FastStone Image Viewer through 7.5 results in a stack buffer overflow. | ||||
| CVE-2022-27193US | medium5.5 | — | ||
CVRF-CSAF-Converter before 1.0.0-rc2 resolves XML External Entities (XXE). This leads to the inclusion of arbitrary (local) file content into the generated output document. An atta… | ||||