Mọi CVE đã công bố cùng các advisory mã nguồn mở (NVD, OSV, GitHub), kèm CVSS, EPSS và cho biết lỗ hổng có đang bị khai thác thực tế hay không (CISA KEV). Cập nhật mỗi vài giờ. Các bài quét đối chiếu dữ liệu này với công nghệ phát hiện được trên site.
| 11/04/2023 |
| CVE-2022-2848 | NGHIÊM TRỌNG9.1 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kepware KEPServerEX 6.11.718.0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of text encoding conversions. The issue results from the lack of proper validation | 29/03/2023 |
| CVE-2022-2825 | NGHIÊM TRỌNG9.8 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kepware KEPServerEX 6.11.718.0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of text encoding conversions. The issue results from the lack of proper validation | 29/03/2023 |
| CVE-2023-0598 | NGHIÊM TRỌNG9.8 |
GE Digital Proficy iFIX 2022, GE Digital Proficy iFIX v6.1, and GE Digital Proficy iFIX v6.5 are vulnerable to code injection, which may allow an attacker to insert malicious configuration files in the expected web server execution path and gain full control of the HMI software.
| 16/03/2023 |
| CVE-2023-0755 | NGHIÊM TRỌNG9.8 |
The affected products are vulnerable to an improper validation of array index, which could allow an attacker to crash the server and remotely execute arbitrary code.
| 23/02/2023 |
| CVE-2023-0754 | NGHIÊM TRỌNG9.8 |
The affected products are vulnerable to an integer
overflow or wraparound, which could allow an attacker to crash the server and remotely
execute arbitrary code.
| 23/02/2023 |
| CVE-2022-46732 | NGHIÊM TRỌNG9.8 | Even if the authentication fails for local service authentication, the requested command could still execute regardless of authentication status. | 18/01/2023 |
| CVE-2022-46660 | TRUNG BÌNH6.5 |
An unauthorized user could alter or write files with full control over the path and content of the file.
| 18/01/2023 |
| CVE-2022-46331 | CAO8.1 |
An unauthorized user could possibly delete any file on the system.
| 18/01/2023 |
| CVE-2022-43494 | TRUNG BÌNH6.5 |
An unauthorized user could be able to read any file on the system, potentially exposing sensitive information.
| 18/01/2023 |
| CVE-2022-38469 | CAO7.5 |
An unauthorized user with network access and the decryption key could decrypt sensitive data, such as usernames and passwords.
| 18/01/2023 |
| CVE-2022-3092 | CAO7.8 | GE CIMPICITY versions 2022 and prior is
vulnerable to an out-of-bounds write, which could allow an attacker to execute arbitrary code.
| 08/12/2022 |
| CVE-2022-3084 | CAO7.8 | GE CIMPICITY versions 2022 and prior is vulnerable when data from a faulting address controls code flow starting at gmmiObj!CGmmiRootOptionTable, which could allow an attacker to execute arbitrary code.
| 08/12/2022 |
| CVE-2022-2952 | CAO7.8 | GE CIMPICITY versions 2022 and prior is
vulnerable when data from a faulting address controls code flow starting at gmmiObj!CGmmiOptionContainer, which could allow an attacker to execute arbitrary code.
| 07/12/2022 |
| CVE-2022-2948 | CAO7.8 | GE CIMPICITY versions 2022 and prior is
vulnerable to a heap-based buffer overflow, which could allow an attacker to execute arbitrary code.
| 07/12/2022 |
| CVE-2022-2002 | CAO7.8 | GE CIMPICITY versions 2022 and prior is
vulnerable when data from faulting address controls code flow starting at gmmiObj!CGmmiOptionContainer, which could allow an attacker to execute arbitrary code.
| 07/12/2022 |
| CVE-2022-37953 | TRUNG BÌNH6.1 | An HTTP response splitting vulnerability exists in the AM Gateway Challenge-Response dialog of WorkstationST (<v07.09.15) and could allow an attacker to compromise a victim's browser/session. WorkstationST is only deployed in specific, controlled environments rendering attack complexity significantly higher than if the | 25/08/2022 |