Vyacheslav Moskvin

A CWE-665: Improper Initialization issue exists, potentially causing information exposure when an attacker sends a specially crafted message.

A Missing Authorization issue exists that could cause information exposure when an attacker sends a specific message.

A vulnerability exists that could cause modification of an existing file by adding to the end of the file or create a new file in the context of the Data Server, potentially leading to remote code execution when an attacker sends a specially crafted message. This issue is due to improper limitation of a pathname to a restricted directory.

The issue is caused by a stack-based buffer overflow due to a buffer copy without checking the size of the input. This could potentially lead to remote code execution when an attacker sends a specially crafted message.

A denial of service issue exists due to an out-of-bounds read. This could be triggered by an attacker sending a specially crafted message, potentially causing a denial of service. The issue is related to reading data outside a specified buffer, which can be exploited by a remote attacker to cause a denial of service using a specially crafted message.

A vulnerability exists that could cause modification of an existing file by inserting at the beginning of the file or create a new file in the context of the Data Server, potentially leading to remote code execution when an attacker sends a specially crafted message. This issue is due to improper limitation of a pathname to a restricted directory.

The issue is related to improper access control in the CODESYS V2 Web-Server, which can be exploited by a remote attacker to impact the confidentiality, integrity, and availability of protected information. This is due to errors in security settings.

The issue is caused by a buffer overflow in the dynamic memory of the CODESYS V2.3 web server, which is part of the CODESYS industrial automation software complex. This can allow a remote attacker to impact the confidentiality, integrity, and availability of protected information. The vulnerability is described as a stack-based buffer overflow.

The issue is caused by a buffer copy without checking the size of the input, which can lead to a buffer overflow on the stack. This can allow a remote attacker to cause a denial of service.

The issue is related to an improperly implemented security check in the CODESYS V2 Web-Server, which is associated with inadequate access control. This can allow a remote attacker to impact the confidentiality, integrity, and availability of protected information.

The issue is caused by an out-of-bounds write, which can be exploited by a remote attacker to impact the confidentiality, integrity, and availability of protected information. This is due to a buffer overflow in the dynamic memory of the CODESYS V2 web server component.

The issue is related to an out-of-bounds read in the CODESYS V2 Web-Server component of the CODESYS industrial automation software suite. This can be exploited by a remote attacker to disclose protected information and cause a denial of service.

A SQL Injection issue exists, which could allow a remote attacker to gain access to the web interface with full privileges. The vulnerability is related to a lack of protection measures for the SQL query structure, enabling potential exploitation.

A Hard-coded Credentials issue exists, which could enable an attacker to gain access to the device. The vulnerability is related to the use of pre-installed credentials, allowing a remote attacker to exploit it and obtain device access.

The issue is related to a code injection possibility, which could allow a remote attacker to gain access with maximum privileges.

A Server-Side Request Forgery (SSRF) issue was discovered in the NmAPI.exe executable. This allows malicious actors to submit specially crafted requests to gain unauthorized access to the system, obtain information about the system, or execute remote commands. The issue is related to insufficient validation of incoming requests.

A Code Injection issue was discovered in DlgSelectMibFile.asp, related to errors in code generation management. This issue allows malicious actors to inject a specially crafted SNMP MIB file, potentially enabling them to execute arbitrary commands and code on the WhatsUp Gold server.

The issue is caused by a buffer overflow in the device's memory, allowing a remote attacker to gain unauthorized access to the device's OS files and execute arbitrary code. The estimated number of potentially affected devices worldwide is not specified.

The issue is caused by a buffer overflow in the memory of the menu pxc.cgi and index.cgi components of the managed switch firmware. This can be exploited by a remote attacker by sending a GET request with a specially crafted cookie, potentially allowing the execution of arbitrary code or causing a denial of service.

The issue is related to OS command injection due to the lack of neutralization of special elements in OS command inputs. This can allow a remote attacker to execute arbitrary commands. The vulnerability is associated with the config transfer.cgi and software update.cgi components of the firmware.