Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
67 results · page 1 of 2
Oct 15, 2026Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attachments as other usersCVE-2026-111353 · Other software · Peppermint-Lab · reported by VulnCheckMedium 5.3
Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attachments as other users by supplying a user id in the request body. Attackers can send POST requests to /api/v1/time/new or /api/v1/storage/ticket/:id/upload/single to attach files and time records to any ticket under another user's identity.
- Product
- peppermint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2026An unauthenticated remote attacker can upload a malicious IODD file that places and executes a shell script with root privileges.CVE-2026-27565 · Other software · Pepperl+Fuchs · reported by info@cert.vde.comCritical 9.8
An unauthenticated remote attacker can upload a malicious IODD file that places and executes a shell script with root privileges. The shell script remains active even after a reboot.
- Product
- ICE2-8IOL1-G65L-V1D
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcertvde.comcertvde.com
Sep 16, 2026A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a PUT request with admin credenCVE-2026-27564 · Other software · Pepperl+Fuchs · reported by info@cert.vde.comHigh 7.2
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a PUT request with admin credentials allowing execution of commands with root privileges on the device.
- Product
- ICE2-8IOL1-G65L-V1D
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcertvde.comcertvde.com
Sep 16, 2026A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a crafted GET request with admiCVE-2026-27563 · Other software · Pepperl+Fuchs · reported by info@cert.vde.comHigh 7.2
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device.
- Product
- ICE2-8IOL1-G65L-V1D
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcertvde.comcertvde.com
Sep 16, 2026A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted PUT request with admin creCVE-2026-27562 · Other software · Pepperl+Fuchs · reported by info@cert.vde.comHigh 7.2
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted PUT request with admin credentials allowing execution of commands with root privileges on the device.
- Product
- ICE2-8IOL1-G65L-V1D
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcertvde.comcertvde.com
Sep 16, 2026A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin creCVE-2026-27561 · Other software · Pepperl+Fuchs · reported by info@cert.vde.comHigh 7.2
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device.
- Product
- ICE2-8IOL1-G65L-V1D
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcertvde.comcertvde.com
Sep 16, 2026A high-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted DELETE request with admin CVE-2026-27560 · Other software · Pepperl+Fuchs · reported by info@cert.vde.comHigh 7.2
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted DELETE request with admin credentials allowing execution of commands with root privileges on the device.
- Product
- ICE2-8IOL1-G65L-V1D
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcertvde.comcertvde.com
Sep 16, 2026A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET request with user credeCVE-2026-27559 · Other software · Pepperl+Fuchs · reported by info@cert.vde.comHigh 8.8
A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET request with user credentials allowing execution of commands with root privileges on the device.
- Product
- ICE2-8IOL1-G65L-V1D
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcertvde.comcertvde.com
Sep 16, 2026A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files endpoint uCVE-2026-27558 · Other software · Pepperl+Fuchs · reported by info@cert.vde.comHigh 8.8
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files endpoint using operator credentials allowing execution of commands with root privileges on the device.
- Product
- ICE2-8IOL1-G65L-V1D
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcertvde.comcertvde.com
Sep 16, 2026An unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/view_uploaded_iodd_file endpoint allowing the SSH server's privaCVE-2026-27557 · Other software · Pepperl+Fuchs · reported by info@cert.vde.comHigh 7.5
An unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/view_uploaded_iodd_file endpoint allowing the SSH server's private keys to be read.
- Product
- ICE2-8IOL1-G65L-V1D
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcertvde.comcertvde.com
Sep 16, 2026A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using a valid operator coCVE-2026-27556 · Other software · Pepperl+Fuchs · reported by info@cert.vde.comHigh 8.8
A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using a valid operator cookie allowing execution of arbitrary PHP code on the device.
- Product
- ICE2-8IOL1-G65L-V1D
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcertvde.comcertvde.com
Sep 16, 2026A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using a valid user cookie aCVE-2026-27555 · Other software · Pepperl+Fuchs · reported by info@cert.vde.comHigh 8.8
A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using a valid user cookie allowing execution of arbitrary PHP code on the device.
- Product
- ICE2-8IOL1-G65L-V1D
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcertvde.comcertvde.com
Sep 16, 2026A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using operator credentials aCVE-2026-27554 · Other software · Pepperl+Fuchs · reported by info@cert.vde.comHigh 8.8
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using operator credentials allowing execution of commands with root privileges on the device.
- Product
- ICE2-8IOL1-G65L-V1D
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcertvde.comcertvde.com
Sep 16, 2026A low-privileged remote attacker can manipulate the schema path parameter in the /index.php/diagnostics_tab/ajax_diag_table_rows endpoint using a valid user cooCVE-2026-27553 · Other software · Pepperl+Fuchs · reported by info@cert.vde.comMedium 6.5
A low-privileged remote attacker can manipulate the schema path parameter in the /index.php/diagnostics_tab/ajax_diag_table_rows endpoint using a valid user cookie allowing disclosure of all user password hashes.
- Product
- ICE2-8IOL1-G65L-V1D
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcertvde.comcertvde.com
Sep 16, 2026A low-privileged remote attacker can exploit improper authorization in the /index.php/attached_devices_tab/do_upload endpoint to upload IODD files to the deviceCVE-2026-27552 · Other software · Pepperl+Fuchs · reported by info@cert.vde.comHigh 8.1
A low-privileged remote attacker can exploit improper authorization in the /index.php/attached_devices_tab/do_upload endpoint to upload IODD files to the device, potentially altering device behavior or causing system crashes.
- Product
- ICE2-8IOL1-G65L-V1D
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcertvde.comcertvde.com
Sep 16, 2026A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/parameterManage endpoint using user credentials allowing eCVE-2026-27551 · Other software · Pepperl+Fuchs · reported by info@cert.vde.comHigh 8.8
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/parameterManage endpoint using user credentials allowing execution of commands with root privileges on the device.
- Product
- ICE2-8IOL1-G65L-V1D
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcertvde.comcertvde.com
Sep 16, 2026A low-privileged remote attacker can exploit a command injection vulnerability in the Field_Shadow_Password class using operator credentials allowing execution CVE-2026-27550 · Other software · Pepperl+Fuchs · reported by info@cert.vde.comHigh 8.8
A low-privileged remote attacker can exploit a command injection vulnerability in the Field_Shadow_Password class using operator credentials allowing execution of commands with root privileges on the device.
- Product
- ICE2-8IOL1-G65L-V1D
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcertvde.comcertvde.com
Sep 16, 2026A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/do_upload endpoint using operator credentiCVE-2026-27549 · Other software · Pepperl+Fuchs · reported by info@cert.vde.comHigh 8.8
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/do_upload endpoint using operator credentials allowing execution of commands with root privileges on the device.
- Product
- ICE2-8IOL1-G65L-V1D
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcertvde.comcertvde.com
Sep 16, 2026A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using user or operator credentCVE-2026-27548 · Other software · Pepperl+Fuchs · reported by info@cert.vde.comHigh 8.8
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using user or operator credentials allowing execution of commands with root privileges on the device.
- Product
- ICE2-8IOL1-G65L-V1D
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcertvde.comcertvde.com
Sep 16, 2026A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_menu_info endpoint using valid user or operator cCVE-2026-27547 · Other software · Pepperl+Fuchs · reported by info@cert.vde.comHigh 8.8
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_menu_info endpoint using valid user or operator credentials allowing execution of commands with root privileges on the device.
- Product
- ICE2-8IOL1-G65L-V1D
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcertvde.comcertvde.com
Sep 16, 2026An unauthenticated remote attacker can exploit an authentication bypass in the _account_log function to log in as an admin, even when accounts are properly confCVE-2026-27546 · Other software · Pepperl+Fuchs · reported by info@cert.vde.comCritical 9.8
An unauthenticated remote attacker can exploit an authentication bypass in the _account_log function to log in as an admin, even when accounts are properly configured.
- Product
- ICE2-8IOL1-G65L-V1D
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcertvde.comcertvde.com
Sep 3, 2026Peppermint through 0.5.5 contains an authorization bypass vulnerability in the GET /api/v1/auth/user/:id/logout endpoint that allows authenticated attackers to CVE-2026-85392 · Other software · Peppermint-Lab · reported by VulnCheckMedium 5.3
Peppermint through 0.5.5 contains an authorization bypass vulnerability in the GET /api/v1/auth/user/:id/logout endpoint that allows authenticated attackers to delete sessions for any user by supplying arbitrary user IDs. Attackers can forcibly log out any user including administrators by calling the logout handler with another user's ID, since the endpoint performs no authorization checks to verify the caller owns the target account.
- Product
- peppermint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any accCVE-2026-85391 · Other software · Peppermint-Lab · reported by VulnCheckCritical 9.3
Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Attackers can use the published secret to mint valid tokens for arbitrary user IDs and access protected endpoints without credentials.
- Product
- peppermint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026openssl_encrypt versions before 1.4.9 derive the remote-pepper wrap key using unsalted HKDF-SHA256 or bare SHA-256 of the password, allowing identical keys acroCVE-2026-81689 · Other software · jahlives · reported by VulnCheckHigh 8.7
openssl_encrypt versions before 1.4.9 derive the remote-pepper wrap key using unsalted HKDF-SHA256 or bare SHA-256 of the password, allowing identical keys across all users and files. Attackers with access to wrapped pepper blobs can precompute a single dictionary table and perform fleet-wide offline password guessing at hardware speed to recover user passwords.
- Product
- openssl_encrypt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 11, 2026A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 allows any authenticated non-administrative user to reconfigure the plCVE-2026-72561 · Other software · Peppermint Lab · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 8.8
A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 allows any authenticated non-administrative user to reconfigure the platform global OIDC/SSO settings via an unprotected configuration endpoint. The endpoint performs no administrative role check before applying new OIDC issuer settings. An attacker can redirect all SSO logins to an attacker-controlled identity provider, enabling credential harvesting for all platform users.
- Product
- Peppermint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 exists because the Config.roles_active flag defaults to false, causingCVE-2026-72555 · Other software · Peppermint Lab · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 8.1
A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 exists because the Config.roles_active flag defaults to false, causing all permission checks on ticket, client, and user handlers to behave as no-ops on default installations. All authenticated users bypass ownership and administrative access controls. An attacker with any user account can read, modify, or delete tickets, clients, and users belonging to any other account.
- Product
- Peppermint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 3, 2025A heap buffer overflow in compiler.c and compiler.h in Pepper language 0.1.1commit 961a5d9988c5986d563310275adad3fd181b2bb7.CVE-2025-50360 · Other software · Dannyvankooten · reported by MITREHigh 8.4
A heap buffer overflow in compiler.c and compiler.h in Pepper language 0.1.1commit 961a5d9988c5986d563310275adad3fd181b2bb7. Malicious execution of a pepper source file(.pr) could lead to arbitrary code execution or Denial of Service.
- Product
- Pepper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025An unauthenticated remote attacker can access a URL which causes the device to reboot.CVE-2025-41655 · Other software · Pepperl+Fuchs · reported by info@cert.vde.comHigh 7.5
An unauthenticated remote attacker can access a URL which causes the device to reboot.
- Product
- Profinet Gateway FB8122A.1.EL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025An unauthenticated remote attacker can access information about running processes via the SNMP protocol.CVE-2025-41654 · Other software · Pepperl+Fuchs · reported by info@cert.vde.comHigh 8.2
An unauthenticated remote attacker can access information about running processes via the SNMP protocol. The amount of returned data can trigger a reboot by the watchdog.
- Product
- Profinet Gateway FB8122A.1.EL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2025Due to improper neutralization of input during web page generation (XSS) an unauthenticated remote attacker can inject HTML code into the Web-UI in the affectedCVE-2025-1985 · Other software · Pepperl+Fuchs · reported by info@cert.vde.comMedium 6.1
Due to improper neutralization of input during web page generation (XSS) an unauthenticated remote attacker can inject HTML code into the Web-UI in the affected device.
- Product
- Profinet Gateway FB8122A.1.EL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2025Peppermint Ticket Management 0.4.6 is vulnerable to Incorrect Access Control.CVE-2024-31525 · Other software · reported by MITREHigh 7.2
Peppermint Ticket Management 0.4.6 is vulnerable to Incorrect Access Control. A regular registered user is able to elevate his privileges to admin and gain complete access to the system as the authorization mechanism is not validated on the server side and only on the client side. This can result, for example, in creating a new admin user in the system which enables persistent access for the attacker as an administrator.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orggithub.com
Aug 13, 2024An unauthenticated remote attacker may use a reflected XSS vulnerability to obtain information from a user or reboot the affected device once.CVE-2024-5849 · Other software · Pepperl+Fuchs · reported by info@cert.vde.comHigh 7.1
An unauthenticated remote attacker may use a reflected XSS vulnerability to obtain information from a user or reboot the affected device once.
- Product
- ICDM-RX/TCP-DB9/RJ45-DIN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2024An unauthenticated remote attacker may use stored XSS vulnerability to obtain information from a user or reboot the affected device once.CVE-2024-38502 · Other software · Pepperl+Fuchs · reported by info@cert.vde.comHigh 7.1
An unauthenticated remote attacker may use stored XSS vulnerability to obtain information from a user or reboot the affected device once.
- Product
- ICDM-RX/TCP-DB9/RJ45-DIN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2024An unauthenticated remote attacker may use a HTML injection vulnerability with limited length to inject malicious HTML code and gain low-privileged access on thCVE-2024-38501 · Other software · Pepperl+Fuchs · reported by info@cert.vde.comMedium 6.1
An unauthenticated remote attacker may use a HTML injection vulnerability with limited length to inject malicious HTML code and gain low-privileged access on the affected device.
- Product
- ICDM-RX/TCP-DB9/RJ45-DIN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2024An unauthenticated remote attacker can manipulate the device via Telnet, stop processes, read, delete and change data.CVE-2024-6422 · Other software · Pepperl+Fuchs · reported by info@cert.vde.comCritical 9.8
An unauthenticated remote attacker can manipulate the device via Telnet, stop processes, read, delete and change data.
- Product
- OIT1500-F113-B12-CB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Jul 10, 2024An unauthenticated remote attacker can read out sensitive device information through a incorrectly configured FTP service.CVE-2024-6421 · Other software · Pepperl+Fuchs · reported by info@cert.vde.comHigh 7.5
An unauthenticated remote attacker can read out sensitive device information through a incorrectly configured FTP service.
- Product
- OIT1500-F113-B12-CB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Oct 29, 2023Peppermint Ticket Management through 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/ticket/1/file/download?filepath=../ POST request.CVE-2023-46864 · Other software · Peppermint · reported by MITREMedium 5.3
Peppermint Ticket Management through 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/ticket/1/file/download?filepath=../ POST request.
- Product
- Peppermint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2023Peppermint Ticket Management before 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/users/file/download?filepath=./../ POST request.CVE-2023-46863 · Other software · Peppermint · reported by MITREHigh 7.5
Peppermint Ticket Management before 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/users/file/download?filepath=./../ POST request.
- Product
- Peppermint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2023An issue in PeppermintLabs Peppermint v.0.2.4 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the hardcoded sCVE-2023-42328 · Other software · Peppermint · reported by MITREHigh 8.8
An issue in PeppermintLabs Peppermint v.0.2.4 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the hardcoded session cookie.
- Product
- Peppermint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblockomat2100.github.iogithub.com
Mar 29, 2023An issue in the password reset function of Peppermint v0.2.4 allows attackers to access the emails and passwords of the Tickets page via a crafted request.CVE-2023-26984 · Other software · Peppermint · reported by MITREHigh 8.1
An issue in the password reset function of Peppermint v0.2.4 allows attackers to access the emails and passwords of the Tickets page via a crafted request.
- Product
- Peppermint
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2021In PEPPERL+FUCHS WirelessHART-Gateway 3.0.7 to 3.0.9 the SSH and telnet services are active with hard-coded credentials.CVE-2021-34565 · Other software · Phoenix Contact · reported by info@cert.vde.comCritical 9.8
In PEPPERL+FUCHS WirelessHART-Gateway 3.0.7 to 3.0.9 the SSH and telnet services are active with hard-coded credentials.
- Product
- WHA-GW-F2D2-0-AS- Z2-ETH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Aug 31, 2021Any cookie-stealing vulnerabilities within the application or browser would enable an attacker to steal the user's credentials to the PEPPERL+FUCHS WirelessHARTCVE-2021-34564 · Other software · Phoenix Contact · reported by info@cert.vde.comMedium 5.5
Any cookie-stealing vulnerabilities within the application or browser would enable an attacker to steal the user's credentials to the PEPPERL+FUCHS WirelessHART-Gateway 3.0.9.
- Product
- WHA-GW-F2D2-0-AS- Z2-ETH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Aug 31, 2021In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 and 3.0.9 the HttpOnly attribute is not set on a cookie.CVE-2021-34563 · Other software · Phoenix Contact · reported by info@cert.vde.comLow 3.3
In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 and 3.0.9 the HttpOnly attribute is not set on a cookie. This allows the cookie's value to be read or set by client-side JavaScript.
- Product
- WHA-GW-F2D2-0-AS- Z2-ETH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Aug 31, 2021In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 it is possible to inject arbitrary JavaScript into the application's response.CVE-2021-34562 · Other software · Phoenix Contact · reported by info@cert.vde.comMedium 5.4
In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 it is possible to inject arbitrary JavaScript into the application's response.
- Product
- WHA-GW-F2D2-0-AS- Z2-ETH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Aug 31, 2021In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.8 serious issue exists, if the application is not externally accessible or uses IP-based access restrictions.CVE-2021-34561 · Other software · Phoenix Contact · reported by info@cert.vde.comHigh 7.5
In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.8 serious issue exists, if the application is not externally accessible or uses IP-based access restrictions. Attackers can use DNS Rebinding to bypass any IP or firewall based access restrictions that may be in place, by proxying through their target's browser.
- Product
- WHA-GW-F2D2-0-AS- Z2-ETH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Aug 31, 2021In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.9 a form contains a password field with autocomplete enabled.CVE-2021-34560 · Other software · Phoenix Contact · reported by info@cert.vde.comMedium 5.5
In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.9 a form contains a password field with autocomplete enabled. The stored credentials can be captured by an attacker who gains control over the user's computer. Therefore the user must have logged in at least once.
- Product
- WHA-GW-F2D2-0-AS- Z2-ETH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Aug 31, 2021In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.8 a vulnerability may allow remote attackers to rewrite links and URLs in cached pages to arbitrary strings.CVE-2021-34559 · Other software · Phoenix Contact · reported by info@cert.vde.comMedium 5.4
In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.8 a vulnerability may allow remote attackers to rewrite links and URLs in cached pages to arbitrary strings.
- Product
- WHA-GW-F2D2-0-AS- Z2-ETH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Aug 31, 2021In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.7 the filename parameter is vulnerable to unauthenticated path traversal attacks, enabling read access to arbitraryCVE-2021-33555 · Other software · Phoenix Contact · reported by info@cert.vde.comHigh 7.5
In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.7 the filename parameter is vulnerable to unauthenticated path traversal attacks, enabling read access to arbitrary files on the server.
- Product
- WHA-GW-F2D2-0-AS- Z2-ETH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Apr 27, 2021Improper access control vulnerability in Hot Pepper Gourmet App for Android ver.4.111.0 and earlier, and for iOS ver.4.111.0 and earlier allows a remote attackeCVE-2021-20715 · Other software · Recruit Co., Ltd. · reported by vultures@jpcert.or.jpMedium 4.3
Improper access control vulnerability in Hot Pepper Gourmet App for Android ver.4.111.0 and earlier, and for iOS ver.4.111.0 and earlier allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App.
- Product
- Hot Pepper Gourmet App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2021Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to a NULL Pointer Dereference that leads to a DoS in discoverydCVE-2020-12514 · Other software · Pepper+Fuchs · reported by info@cert.vde.comMedium 6.6
Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to a NULL Pointer Dereference that leads to a DoS in discoveryd
- Product
- Comtrol IO-Link Master
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.vde.comcert.vde.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.