CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Unitronics VisiLogic and Vision/Samba PLC Hardcoded Default Administrative Password Vulnerability (CVE-2023-6448) Security Advisory
[Affected Scope] Unitronics Vision and Samba PLCs and HMIs configured using VisiLogic versions prior to 9.9.00
[Impact] Unauthenticated remote attackers with network access can exploit default administrative credentials to gain full control of the target system
[Mitigation] Upgrade VisiLogic to version 9.9.00 or later, change default passwords immediately, and restrict external network exposure
Apache Superset Session Validation Bypass and Remote Code Execution via Default SECRET_KEY (CVE-2023-27524)
[Affected Scope] Apache Superset installations up to and including version 2.0.1 that have not altered the default configured SECRET_KEY.
[Impact] Unauthorized attackers can forge session cookies to authenticate as administrators, leading to unauthorized resource access, database compromise, and potential Remote Code Execution (RCE).
[Mitigation] Immediately configure a unique, cryptographically strong, randomly generated SECRET_KEY in 'superset_config.py' or via environment variables.
Apache CouchDB Remote Code Execution Vulnerability via Default Configuration (CVE-2022-24706)
[Affected Scope] Apache CouchDB installations prior to version 3.2.2
[Impact] Unauthenticated attackers can bypass authentication, gain administrative privileges, and execute arbitrary code via Erlang distribution ports
[Mitigation] Upgrade Apache CouchDB to version 3.2.2 or higher, and restrict access to Erlang ports (4369, 9100-9200) using a firewall
Apache Airflow Experimental API Authentication Bypass and Remote Code Execution (RCE) Vulnerability (CVE-2020-13927)
[Affected Scope] Apache Airflow versions prior to 1.10.11, and existing installations retaining default configurations
[Impact] Unauthenticated attackers can access the Experimental API to trigger arbitrary DAGs, leading to full remote code execution (RCE) and server compromise
[Mitigation] Upgrade Apache Airflow to version 1.10.11 or higher, or explicitly configure the API authentication backend to 'deny_all' in airflow.cfg