| CVE ID | CVSS Score | Severity | Description |
|---|---|---|---|
| CVE-2023-51605 | 0.0 | unknown |
No description available.
|
| CVE-2026-4272 | 0.0 | unknown |
No description available.
|
| CVE-2019-13525 | 0.0 | unknown |
No description available.
|
| CVE-2022-31485 | 0.0 | unknown |
An unauthenticated attacker can send a specially crafted packet to update the notes section on the home page of the web interface.CVE-2022-31485 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
|
| CVE-2020-6978 | 0.0 | unknown |
The affected product is vulnerable due to the usage of old jQuery libraries.CVE-2020-6978 has been assigned to this vulnerability. A CVSS v3 base score of 7.2 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).
|
| CVE-2019-13523 | 0.0 | unknown |
No description available.
|
| CVE-2022-2332 | 0.0 | unknown |
A local unprivileged attacker may escalate to administrator privileges, due to insecure permission assignment. CVE-2022-2332 has been assigned to this vulnerability. A CVSS v3 base score of 6.2 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
|
| CVE-2023-3710 | 0.0 | unknown |
No description available.
|
| CVE-2019-18226 | 0.0 | unknown |
No description available.
|
| CVE-2022-31484 | 0.0 | unknown |
An unauthenticated attacker can send a specially crafted network packet to delete a user from the web interface.CVE-2022-31484 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
|
| CVE-2025-3944 | 0.0 | unknown |
No description available.
|
| CVE-2023-51604 | 0.0 | unknown |
No description available.
|
| CVE-2026-1670 | 0.0 | unknown |
The affected product is vulnerable to an unauthenticated API endpoint exposure that may allow an attacker to remotely change the "forgot password" recovery email address.
|
| CVE-2015-7908 | 0.0 | unknown |
Honeywell Midas gas detectors before 1.13b3 and Midas Black gas detectors before 2.13b3 allow remote attackers to discover cleartext passwords by sniffing the network.
|
| CVE-2020-6968 | 0.0 | unknown |
The affected product allows workstation users to escalate application user privileges through the modification of local configuration files.CVE-2020-6968 has been assigned to this vulnerability. A CVSS v3 base score of 6.6 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L).
|
| CVE-2022-30314 | 0.0 | unknown |
The affected product access to the boot configuration is controlled by credentials hard-coded in the Safety Manger firmware. This could allow an attacker with serial interface access to control the boot process and manipulate the firmware image.
|
| CVE-2023-3712 | 0.0 | unknown |
No description available.
|
| CVE-2021-44228 | 0.0 | unknown |
CVE-2021-44228. Apache Log4j V2, versions < 2.15.0 do not protect JNDI features (as used in configuration, log messages, and parameters) against attacker controlled LDAP and other JNDI related endpoints.
An attacker who can control log messages or log message parameters could execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled.
|
| CVE-2022-2333 | 0.0 | unknown |
If an attacker manages to trick a valid user into loading a malicious DLL, the attacker may be able to achieve code execution in the application 's context and permissions. CVE-2022-2333 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
|
| CVE-2025-2605 | 0.0 | unknown |
No description available.
|
| cve-2021-40438 | 0.0 | unknown |
No description available.
|
| CVE-2023-51599 | 0.0 | unknown |
No description available.
|
| CVE-2014-9187 | 0.0 | unknown |
Multiple heap-based buffer overflow vulnerabilities exist in Honeywell Experion PKS all versions prior to R400.6, all versions prior to R410.6, and all versions prior to R430.2 modules, which could lead to possible remote code execution or denial of service. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version.
|
| CVE-2022-31482 | 0.0 | unknown |
An unauthenticated attacker can send a specially crafted unauthenticated HTTP request to the device that can overflow a buffer.CVE-2022-31482 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
|
| CVE-2020-11207 | 0.0 | unknown |
No description available.
|
| CVE-2022-31483 | 0.0 | unknown |
An authenticated attacker can manipulate a filename to achieve the ability to upload the desired file anywhere on the filesystem.CVE-2022-31483 has been assigned to this vulnerability. A CVSS v3 base score of 9.1 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
|
| CVE-2022-31480 | 0.0 | unknown |
An unauthenticated attacker could arbitrarily upload firmware files to the target device, ultimately causing a denial-of-service condition.CVE-2022-31480 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
|
| CVE-2022-30316 | 0.0 | unknown |
The affected product firmware images are not signed and only rely on insecure checksums for regular integrity checks. This could allow an attacker with access to the serial interface to control the boot process or push malicious firmware.
|
| CVE-2017-5139 | 0.0 | unknown |
No description available.
|
| CVE-2020-11201 | 0.0 | unknown |
No description available.
|
| CVE-2022-4240 | 0.0 | unknown |
An unauthenticated API could allow an attacker to obtain the information about network resources. CVE-2022-4240 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
|
| CVE-2020-11209 | 0.0 | unknown |
No description available.
|
| CVE-2022-30317 | 0.0 | unknown |
The affected product uses the EpicMo protocol that does not have authentication features, which may allow an attacker with access to this protocol over a network to manipulate firmware or cause a denial-of-service condition.CVE-2022-30317 has been assigned to this vulnerability. A CVSS v3 base score of 9.1 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).
|
| CVE-2012-0254 | 0.0 | unknown |
Stack-based buffer overflow in the HMIWeb Browser HSCDSPRenderDLL ActiveX control in Honeywell Process Solutions (HPS) Experion R2xx, R30x, R31x, and R400.x; Honeywell Building Solutions (HBS) Enterprise Building Manager R400 and R410.1; and Honeywell Environmental Combustion and Controls (ECC) SymmetrE R410.1 allows remote attackers to execute arbitrary code via unspecified vectors.
|
| CVE-2025-3945 | 0.0 | unknown |
No description available.
|
| CVE-2015-0984 | 0.0 | unknown |
Directory traversal vulnerability in the FTP server on Honeywell Excel Web XL1000C50 52 I/O, XL1000C100 104 I/O, XL1000C500 300 I/O, XL1000C1000 600 I/O, XL1000C50U 52 I/O UUKL, XL1000C100U 104 I/O UUKL, XL1000C500U 300 I/O UUKL, and XL1000C1000U 600 I/O UUKL controllers before 2.04.01 allows remote attackers to read files under the web root, and consequently obtain administrative login access, via a crafted pathname.
|
| CVE-2023-4863 | 0.0 | unknown |
CVE-2023-4863. The affected products are vulnerable to an out of bounds write vulnerability in the integrated libwebp library, that could be triggered while parsing specially crafted image files.
This could allow an attacker to execute code in the context of a victim user's system. As a precondition, the user needs to add such image files, or Mendix Marketplace content that contains such image files, to their project. The exploitation happens in certain scenarios when the user opens the document that contains the image.
|
| CVE-2016-2280 | 0.0 | unknown |
Buffer overflow in RDISERVER in Honeywell Uniformance Process History Database (PHD) R310, R320, and R321 allows remote attackers to cause a denial of service (service outage) via unspecified vectors.
|
| CVE-2014-5435 | 0.0 | unknown |
An arbitrary memory write vulnerability exists in the dual_onsrv.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x before R430.2, that could lead to possible remote code execution or denial of service. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version.
|
| CVE-2023-51603 | 0.0 | unknown |
No description available.
|
| CVE-2022-22963 | 0.0 | unknown |
No description available.
|
| CVE-2022-30319 | 0.0 | unknown |
The affected product uses the S-Bus protocol with authentication functions that can be controlled by the client MAC and IP. Because UDP is stateless, an attacker that can observe traffic can also spoof the MAC and IP of an authenticated client and manipulate the controller configuration.CVE-2022-30319 has been assigned to this vulnerability. A CVSS v3 base score of 7.6 has been assigned; the CVSS vector string is (AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L).
|
| CVE-2020-6960 | 0.0 | unknown |
CVE-2020-6960. A SQL injection vulnerability exists that could give an attacker remote unauthenticated access to the web user interface with administrator-level privileges.CVE-2020-6960 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
|
| CVE-2024-2422 | 0.0 | unknown |
LenelS2 NetBox access control and event monitoring system was discovered to contain an authenticated remote code execution in versions prior to and including 5.6.1, which allows an attacker to execute malicious commands.
|
| CVE-2025-3938 | 0.0 | unknown |
No description available.
|
| CVE-2023-51600 | 0.0 | unknown |
No description available.
|
| CVE-2022-30320 | 0.0 | unknown |
The affected product uses the S-Bus write byte message to a specific address and supplies a hashed version of the password. The hashing algorithm is based on CRC-16 and, as such, is not cryptographically secure.CVE-2022-30320 has been assigned to this vulnerability. A CVSS v3 base score of 7.6 has been assigned; the CVSS vector string is (AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L).
|
| CVE-2025-3940 | 0.0 | unknown |
No description available.
|
| CVE-2020-6959 | 0.0 | unknown |
CVE-2020-6959. The affected products are vulnerable to an unsafe deserialization of untrusted data. An attacker may be able to remotely modify deserialized data without authentication using a specially crafted web request, resulting in remote code execution.CVE-2020-6959 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
|
| CVE-2024-2420 | 0.0 | unknown |
LenelS2 NetBox access control and event monitoring system was discovered to contain hard-coded credentials in versions prior to and including 5.6.1, which allows an attacker to bypass authentication requirements.
|
| CVE-2022-30318 | 0.0 | unknown |
The affected product root credentials are hard-coded and not changed automatically when first commissioned, which may allow an attacker with SSH access to the device to gain full control.CVE-2022-30318 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
|
| CVE-2013-0108 | 0.0 | unknown |
An ActiveX control in HscRemoteDeploy.dll in Honeywell Enterprise Buildings Integrator (EBI) R310, R400.2, R410.1, and R410.2; SymmetrE R310, R410.1, and R410.2; ComfortPoint Open Manager (aka CPO-M) Station R100; and HMIWeb Browser client packages allows remote attackers to execute arbitrary code via a crafted HTML document.
|
| CVE-2021-38395 | 0.0 | unknown |
The affected product is vulnerable to improper neutralization of special elements in output, which may allow an attacker to remotely execute arbitrary code and cause a denial-of-service condition.CVE-2021-38395 has been assigned to this vulnerability. A CVSS v3 base score of 9.1 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).
|
| CVE-2015-7907 | 0.0 | unknown |
Directory traversal vulnerability in the web server on Honeywell Midas gas detectors before 1.13b3 and Midas Black gas detectors before 2.13b3 allows remote attackers to bypass authentication, and write to a configuration file or trigger a calibration or test, via unspecified vectors.
|
| CVE-2020-27299 | 0.0 | unknown |
The affected product is vulnerable to an out-of-bounds read, which may allow an attacker to obtain and disclose sensitive data information or cause the device to crash.CVE-2020-27299 has been assigned to this vulnerability. A CVSS v3 base score of 8.2 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).
|
| CVE-2021-38399 | 0.0 | unknown |
The affected product is vulnerable to relative path traversal, which may allow an attacker access to unauthorized files and directories.CVE-2021-38399 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
|
| CVE-2022-43485 | 0.0 | unknown |
This vulnerability exists due to an insufficiently secure random number used for generating keys, which is used for signing tokens. CVE-2022-43485 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
|
| CVE-2022-31486 | 0.0 | unknown |
An authenticated attacker can send a specially crafted route to a specific binary causing it to execute shell commands.CVE-2022-31486 has been assigned to this vulnerability. A CVSS v3 base score 8.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
|
| CVE-2023-6590 | 0.0 | unknown |
No description available.
|
| CVE-2019-5786 | 0.0 | unknown |
No description available.
|
| CVE-2023-3711 | 0.0 | unknown |
No description available.
|
| CVE-2025-3942 | 0.0 | unknown |
No description available.
|
| CVE-2025-3937 | 0.0 | unknown |
No description available.
|
| CVE-2022-30315 | 0.0 | unknown |
The affected product uses the unauthenticated Safety Builder protocol, which does not validate or authenticate the download logic. This could allow an attacker to preform remote code execution on the CPU module.
|
| CVE-2023-28388 | 0.0 | unknown |
Uncontrolled search path element in some Intel(R) Chipset Device Software before version 10.1.19444.8378 may allow an authenticated user to potentially enable escalation of privilege via local access.
|
| CVE-2017-5141 | 0.0 | unknown |
No description available.
|
| CVE-2023-36483 | 0.0 | unknown |
No description available.
|
| CVE-2024-23806 | 0.0 | unknown |
Sensitive data can be extracted from HID iCLASS SE reader configuration cards. This could include credential and device administrator keys.
|
| CVE-2022-46361 | 0.0 | unknown |
While a backup is in progress, malicious users could enter a system command along with a backup configuration, which could result in the execution of unwanted commands. CVE-2022-46361 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)).
|
| CVE-2021-39364 | 0.0 | unknown |
No description available.
|
| CVE-2020-27274 | 0.0 | unknown |
Some parsing functions in the affected product do not check the return value of malloc and the thread handling the message is forced to close, which may lead to a denial-of-service condition.CVE-2020-27274 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
|
| CVE-2020-14483 | 0.0 | unknown |
A timeout during a TLS handshake can result in the connection failing to terminate. This can result in a Niagara thread hanging and requires a manual restart to correct.CVE-2020-14483 has been assigned to this vulnerability. A CVSS v3 base score of 4.3 has been assigned; the CVSS vector string is (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
|
| CVE-2024-22338 | 0.0 | unknown |
No description available.
|
| CVE-2020-11208 | 0.0 | unknown |
No description available.
|
| CVE-2016-8344 | 0.0 | unknown |
An issue was discovered in Honeywell Experion Process Knowledge System (PKS) platform: Experion PKS, Release 3xx and prior, Experion PKS, Release 400, Experion PKS, Release 410, Experion PKS, Release 430, and Experion PKS, Release 431. Experion PKS does not properly validate input. By sending a specially crafted packet, an attacker could cause the process to terminate. A successful exploit would prevent firmware uploads to the Series-C devices.
|
| CVE-2022-30313 | 0.0 | unknown |
The affected product utilizes the Safety Builder protocol, which does not have native authentication. An attacker capable of invoking the protocols' functionalities could cause configuration and system changes.
|
| CVE-2020-6972 | 0.0 | unknown |
The Honeywell Fire Web Server 's authentication may be bypassed by a capture-replay attack from a web browser.CVE-2020-6972 has been assigned to this vulnerability. A CVSS v3 base score of 9.3 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).
|
| CVE-2007-6483 | 0.0 | unknown |
Directory traversal vulnerability in SafeNet Sentinel Protection Server 7.0.0 through 7.4.0 and possibly earlier versions, and Sentinel Keys Server 1.0.3 and possibly earlier versions, allows remote attackers to read arbitrary files via a .. (dot dot) in the query string.
|
| CVE-2014-3110 | 0.0 | unknown |
Multiple cross-site scripting (XSS) vulnerabilities on Honeywell FALCON XLWeb Linux controller devices 2.04.01 and earlier and FALCON XLWeb XLWebExe controller devices 2.02.11 and earlier allow remote attackers to inject arbitrary web script or HTML via invalid input.
|
| CVE-2019-18230 | 0.0 | unknown |
No description available.
|
| CVE-2019-15126 | 0.0 | unknown |
CVE-2019-15126. An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted traffic can cause internal errors (related to state transitions) in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic.
|
| CVE-2020-11206 | 0.0 | unknown |
No description available.
|
| CVE-2022-31481 | 0.0 | unknown |
An unauthenticated attacker can send a specially crafted update file to the device that can overflow a buffer.CVE-2022-31481 has been assigned to this vulnerability. A CVSS v3 base score of 10.0 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
|
| CVE-2014-3566 | 0.0 | unknown |
No description available.
|
| CVE-2023-1841 | 0.0 | unknown |
No description available.
|
| CVE-2018-14825 | 0.0 | unknown |
No description available.
|
| CVE-2014-9191 | 0.0 | unknown |
The CodeWrights HART Device Type Manager (DTM) library in Emerson HART DTM before 1.4.181 allows physically proximate attackers to cause a denial of service (DTM outage and FDT Frame application hang) by transmitting crafted response packets on the 4-20 mA current loop.
|
| CVE-2019-18228 | 0.0 | unknown |
No description available.
|
| CVE-2014-9189 | 0.0 | unknown |
Multiple stack-based buffer overflow vulnerabilities were found in Honeywell Experion PKS all versions prior to R400.6, all versions prior to R410.6, and all versions prior to R430.2 modules that could lead to possible remote code execution, dynamic memory corruption, or denial of service. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version.
|
| CVE-2017-5142 | 0.0 | unknown |
No description available.
|
| CVE-2014-2717 | 0.0 | unknown |
Honeywell FALCON XLWeb Linux controller devices 2.04.01 and earlier and FALCON XLWeb XLWebExe controller devices 2.02.11 and earlier allow remote attackers to bypass authentication and obtain administrative access by visiting the change-password page.
|
| cve-2017-5753 | 0.0 | unknown |
No description available.
|
| CVE-2025-3943 | 0.0 | unknown |
No description available.
|
| CVE-2023-51601 | 0.0 | unknown |
No description available.
|
| CVE-2020-7005 | 0.0 | unknown |
The affected product is vulnerable to a cross-site request forgery, which may allow an attacker to remotely execute arbitrary code.CVE-2020-7005 has been assigned to this vulnerability. A CVSS v3 base score of 8.1 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
|
| CVE-2021-45046 | 0.0 | unknown |
CVE-2021-45046. The fix to address CVE-2021-44228 was incomplete in certain non-default configurations, when the logging configuration uses a non-default Pattern Layout with a Context Lookup (for example, ${ctx:loginId}).
This could allow attackers with control over Thread Context Map (MDC) input data to craft malicious input data using a JNDI Lookup pattern, resulting in an information leak and remote code execution in some environments and local code execution in all environments.
|
| CVE-2022-37026 | 0.0 | unknown |
No description available.
|
| CVE-2014-5436 | 0.0 | unknown |
A directory traversal vulnerability exists in the confd.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x before R430.2, which could lead to possible information disclosure. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version.
|
| CVE-2017-5140 | 0.0 | unknown |
No description available.
|
| CVE-2025-3939 | 0.0 | unknown |
No description available.
|
| CVE-2021-39363 | 0.0 | unknown |
No description available.
|
| cve-2021-45105 | 0.0 | unknown |
No description available.
|
| CVE-2020-27297 | 0.0 | unknown |
The affected product is vulnerable to a heap-based buffer overflow, which may allow an attacker to manipulate memory with controlled values and remotely execute code.CVE-2020-27297 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
|
| CVE-2022-31479 | 0.0 | unknown |
An unauthenticated attacker can update the hostname with a specially crafted name, allowing shell command execution during the core collection process.CVE-2022-31479 has been assigned to this vulnerability. A CVSS v3 base score of 9.6 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).
|
| CVE-2020-10624 | 0.0 | unknown |
The affected product exposes a session token on the network.CVE-2020-10624 has been assigned to this vulnerability. A CVSS v3 base score of 5.9 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
|
| CVE-2017-5754 | 0.0 | unknown |
No description available.
|
| cve-2014-3566 | 0.0 | unknown |
No description available.
|
| CVE-2020-6982 | 0.0 | unknown |
The header injection vulnerability has been identified, which may allow remote code execution.CVE-2020-6982 has been assigned to this vulnerability. A CVSS v3 base score of 6.3 has been calculated; the CVSS vector string is (AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
|
| CVE-2017-5143 | 0.0 | unknown |
No description available.
|
| CVE-2020-6974 | 0.0 | unknown |
The affected product is vulnerable to a path traversal attack, which allows an attacker to bypass access to restricted directories.CVE-2020-6974 has been assigned to this vulnerability. A CVSS v3 base score of 9.4 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L).
|
| CVE-2021-45105 | 0.0 | unknown |
CVE-2021-45105. Apache Log4j2 versions 2.0-alpha1 through 2.16.0 did not protect from uncontrolled recursion from self-referential lookups, when the logging configuration uses a non-default Pattern Layout with a Context Lookup (for example, $${ctx:loginId}).
This could allow attackers with control over Thread Context Map (MDC) input data to craft malicious input data that contains a recursive lookup, resulting in a denial of service condition.
|
| CVE-2021-40438 | 0.0 | unknown |
CVE-2021-40438. A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
|
| CVE-2021-22156 | 0.0 | unknown |
No description available.
|
| CVE-2023-51602 | 0.0 | unknown |
No description available.
|
| CVE-2025-3936 | 0.0 | unknown |
No description available.
|
| CVE-2020-27295 | 0.0 | unknown |
The affected product has uncontrolled resource consumption issues, which may allow an attacker to cause a denial-of-service condition.CVE-2020-27295 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
|
| CVE-2017-5715 | 0.0 | unknown |
CVE-2017-5715. An attacker with local access to the system could potentially disclose information
from protected memory areas via a side-channel attack on the processor cache.
|
| cve-2017-5715 | 0.0 | unknown |
No description available.
|
| CVE-2017-5753 | 0.0 | unknown |
No description available.
|
| CVE-2025-3941 | 0.0 | unknown |
No description available.
|
| CVE-2020-10628 | 0.0 | unknown |
The affected device exposes unencrypted passwords on the network.CVE-2020-10628 has been assigned to this vulnerability. A CVSS v3 base score of 5.9 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
|
| CVE-2022-30312 | 0.0 | unknown |
Several Trend Controls IQ Series building automation controllers utilize an Inter-Controller (IC) protocol that uses a 4-digit authentication PIN transmitted in plaintext, allowing usernames and passwords to be transmitted in plaintext when utilizing unsupported legacy versions of the controller. This may allow an attacker with local OT network access to obtain these credentials.CVE-2022-30312 has been assigned to this vulnerability. A CVSS v3 base score of 7.1 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).
|
| CVE-2020-11202 | 0.0 | unknown |
No description available.
|
| CVE-2014-9186 | 0.0 | unknown |
A file inclusion vulnerability exists in the confd.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x before R430.2, which could lead to accepting an arbitrary file into the function, and potential information disclosure or remote code execution. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version.
|
| CVE-2021-38397 | 0.0 | unknown |
The affected product is vulnerable to unrestricted file uploads, which may allow an attacker to remotely execute arbitrary code and cause a denial-of-service condition.CVE-2021-38397 has been assigned to this vulnerability. A CVSS v3 base score of 10.0 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
|
| CVE-2024-2421 | 0.0 | unknown |
LenelS2 NetBox access control and event monitoring system was discovered to contain an unauthenticated remote code execution in versions prior to and including 5.6.1, which allows an attacker to execute malicious commands with elevated permissions.
|
| Vendor | Product | Asset Type | Purdue Level | Firmware |
|---|---|---|---|---|
| Honeywell | Unknown | dcs |
L2
|
-- |
| Honeywell | Unknown | dcs |
L2
|
-- |
| Honeywell | Unknown | dcs |
L2
|
-- |
| Honeywell | Unknown | dcs |
L2
|
vers:all/* |
| Honeywell | Unknown | dcs |
L2
|
-- |
| Honeywell | Unknown | dcs |
L2
|
-- |
| Honeywell | Unknown | dcs |
L2
|
-- |
| Honeywell | Unknown | rtu |
L1
|
R101 | R110 | R140 | R150 | R151 |
| Honeywell | Unknown | plc |
L1
|
R130.2 | R140 | R150 | R151 |