CWE-912.

MinMax CMS - Hidden Functionality

• MinMax Digital Technology MinMax CMS
• Hard-coded credentials
• CWE-912

Siemens SIMATIC RTLS Locating Manager: A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All…

• Siemens SIMATIC RTLS Locating Manager
• CWE-912

NEC Platforms DT900 and DT900S Series 5.0.0.0 – v5.3.4.4, v5.4.0.0 – v5.6.0.20 allows an attacker to access a non-documented the system settings to change settings via local network with unauthentica…

• NEC Platforms, Ltd ITK-6DGS-1(BK) TEL
• NEC Platforms, Ltd ITK-32LCGS-1(BK) TEL
• CWE-912

NEC Corporation WG1800HP4: Hidden Functionality vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3…

• NEC Corporation WG1800HP4
• NEC Corporation WG1200HS3
• CWE-912

Siemens SENTRON 3KC ATC6 Expansion Module Ethernet: A vulnerability has been identified in SENTRON 3KC ATC6 Expansion Module Ethernet…

• Siemens SENTRON 3KC ATC6 Expansion Module Ethernet
• CWE-912

PAX Android based POS devices with PayDroid_8.1.0_Sagittarius_V11.1.45_20230314 or earlier can allow the signed partition overwrite and subsequently local code execution via hidden command.

• PAX Technology POS terminals
• CWE-912

Poly Trio 8800 Test Automation Mode backdoor

• Poly Trio 8800
• CWE-912

Typecho Page manage-pages.php backdoor

• Typecho
• CWE-912

CBC Co.,Ltd. NR4H, NR8H, NR16H series: Hidden functionality vulnerability in the CBC products allows a remote authenticated…

• CBC Co.,Ltd. NR4H, NR8H, NR16H series
• CBC Co.,Ltd. DR-16F, DR-8F, DR-4F, DR-16H, DR-8H, DR-4H, DR-4M41 series
• CWE-912

In Snap One OvrC Pro versions prior to 7.2, when logged into the superuser account, a new functionality appears that could allow users to execute arbitrary commands on the hub device.

• Snap One OvrC Cloud
• CWE-912

Netgear Orbi Router RBR750: A command execution vulnerability exists in the hidden telnet service functionality of…

• Netgear Orbi Router RBR750
• CWE-912

Netgear Orbi Satellite RBS750: A command execution vulnerability exists in the ubus backend communications functionality…

• Netgear Orbi Satellite RBS750
• CWE-912

Moodle has a Hidden Functionality vulnerability

• CWE-912

<3.9.8 || >=3.10.0-beta, <3.10.5 || >=3.11.0-beta, <3.11.1 · fixed in 3.9.8, 3.10.5, 3.11.1

MvcTools 6d48cd6830fc1df1d8c9d61caa1805fd6a1b7737 was discovered to contain a code execution backdoor via the request package (requirements.txt).

• CWE-912

WAGO: Exposure of configuration interface in unmanaged switches

• WAGO Unmanaged Switch 852-111/000-001
• CWE-912

A backdoor in Solar-Log Gateway products allows remote access via web panel gaining super administration privileges to the attacker.

• CWE-912

PIXELA CORPORATION PIX-RT100: Hidden functionality vulnerability in PIX-RT100 versions RT100_TEQ_2.1.1_EQ101 and…

• PIXELA CORPORATION PIX-RT100
• CWE-912

Passhunt commit 54eb987d30ead2b8ebbf1f0b880aa14249323867 was discovered to contain a code execution backdoor via the request package.

• CWE-912

vSphere_selfuse commit 2a9fe074a64f6a0dd8ac02f21e2f10d66cac5749 was discovered to contain a code execution backdoor via the request package.

• CWE-912

sweetalert2 v8.19.1 and above contains hidden functionality

• CWE-912

>=8.19.1, <11.22.4 · fixed in 11.22.4

sweetalert2 v9.17.4 and above contains hidden functionality

• CWE-912

>=9.17.4, <11.22.4 · fixed in 11.22.4

sweetalert2 v10.16.10 and above contains hidden functionality

• CWE-912

>=10.16.10, <11.22.4 · fixed in 11.22.4

sweetalert2 v11.4.9 and above contains hidden functionality

• CWE-912

>=11.4.9, <11.22.4 · fixed in 11.22.4

ORing net IAP-420(+) Hidden Functionality

• ORing IAP-420(+)
• CWE-912

2.2.3 HIDDEN FUNCTIONALITY CWE-912

• Dominion Voting Systems ImageCast X application
• Dominion Voting Systems ImageCast X firmware
• CWE-912

JUNG Smart Visu Server KNX Group Address backdoor

• JUNG Smart Visu Server
• CWE-912

JUNG Smart Visu Server SSH Server backdoor

• JUNG Smart Visu Server
• CWE-912

JUNG Smart Visu Server backdoor

• JUNG Smart Visu Server
• CWE-912

Malware in ctx

• CWE-912

<=0.1.4 · no fixed version yet

Duplicate Advisory: Embedded malware in ua-parser-js

• CWE-829
• CWE-912

>=0.7.29, <0.7.30 || >=0.8.0, <0.8.1 || >=1.0.0, <1.0.1 · fixed in 0.7.30, 0.8.1, 1.0.1

Hidden functionality in node-ipc

• CWE-912

=9.2.2 · no fixed version yet

Backdoored Plugins & Themes from AccessPress Themes

• AccessPress Themes Frontend Post WordPress Plugin – AccessPress Anonymous Post
• AccessPress Themes AccessPress Custom CSS
• CWE-912

mySCADA myPRO

• mySCADA myPRO
• CWE-912

Embedded malware in ua-parser-js

• CWE-506
• CWE-912

>=0.7.29, <0.7.30 || >=0.8.0, <0.8.1 || >=1.0.0, <1.0.1 · fixed in 0.7.30, 0.8.1, 1.0.1

Cosori: A unauthenticated backdoor exists in the configuration server functionality of Cosori…

• Cosori
• CWE-912

A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP.

• Samsung Mobile Devices
• CWE-912

Cisco Firepower Threat Defense Software Hidden Commands Vulnerability

• Cisco Firepower Threat Defense Software
• CWE-912

Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products

• Pepperl+Fuchs P+F Comtrol RocketLinx
• Korenix JetNet
• CWE-912

N-Tron 702-W / 702M12-W: The affected product is vulnerable due to an undocumented interface found on the device…

• N-Tron 702-W / 702M12-W
• CWE-912

OpenClinic GA

• open source OpenClinic GA
• CWE-912

Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server: All versions of Hangzhou Xiongmai Technology Co…

• Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server
• CWE-912