ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Ars Technica · Securitypublished ()ingested

Hackers can infect network

lowVulnerabilityimportance 35CVE-2023-48252CVE-2023-48253CVE-2023-48243CVE-2023-48250CVE-2023-48251CVE-2023-48262CVE-2023-48263CVE-2023-48264CVE-2023-48265CVE-2023-48266CVE-2023-48257CVE-2023-48242CVE-2023-48245CVE-2023-48246CVE-2023-48249CVE-2023-48255CVE-2023-48248CVE-2023-48258CVE-2023-48244CVE-2023-48247CVE-2023-48254CVE-2023-48256CVE-2023-48259CVE-2023-48260CVE-2023-48261
Read the original
Tagscve-2023-48252cve-2023-48253cve-2023-48243cve-2023-48250cve-2023-48251vulnerability

Vulnerabilities mentionedAll →

CVEVulnerabilityCVSSEPSSFlagsAffectedExposurePublished
CVE-2023-48262
+24 in the same advisory: …48263 …48264 …48265 …48266 …48245 …48250 +18
The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a c

The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Execution (RCE) via a crafted network request.

NVD description · AI analysis pending		9.8
group max
<1%
  • bosch nexo-os
—
Full article280 words · extracted from arstechnica.com · click to collapse
CVE-2023-48252 Improper Authorization (CWE-285) 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2023-48253 Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) (CWE-89) 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2023-48243 Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) (CWE-22) 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CVE-2023-48250 Use of Hard-coded Credentials (CWE-798) 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2023-48251 Use of Hard-coded Credentials (CWE-798) 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2023-48262 Stack-based Buffer Overflow (CWE-121) 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2023-48263 Heap-based Buffer Overflow (CWE-122) 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2023-48264 Stack-based Buffer Overflow (CWE-121) 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2023-48265 Stack-based Buffer Overflow (CWE-121) 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2023-48266 Stack-based Buffer Overflow (CWE-121) 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2023-48257 Use of Weak Credentials (CWE-1391) 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2023-48242 Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) (CWE-22) 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2023-48245 Missing Authorization (CWE-862) 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L CVE-2023-48246 Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) (CWE-22) 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2023-48249 Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) (CWE-22) 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2023-48255 Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) (CWE-79) 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L CVE-2023-48248 Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) (CWE-79) 5.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L CVE-2023-48258 Cross-Site Request Forgery (CSRF) (CWE-352) 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2023-48244 Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) (CWE-79) 5.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L CVE-2023-48247 Missing Authorization (CWE-862) 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2023-48254 Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) (CWE-79) 5.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L CVE-2023-48256 Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) (CWE-113) 5.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L CVE-2023-48259 Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) (CWE-89) 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2023-48260 Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) (CWE-89) 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2023-48261 Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) (CWE-89) 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Text extracted automatically; images, tables and formatting may be missing. Original: https://arstechnica.com/security/2024/01/network-connected-wrenches-used-in-factories-can-be-hacked-for-sabotage-or-ransomware/