Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

9 records

Advisory: SICK Field Analytics — sick.com/.well-known/csaf/white/2025/sca-2025-0007.json Clear all filters
TI-2025-31267 CVE-2025-49200 · GHSA-g656-699q-898f

Unencrypted backup contains sensitive information

Priority LOW 33

The created backup files are unencrypted, making the application vulnerable for gathering sensitive information by downloading and decompressing the backup files.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00492 Published 2025-06-12 No fix listed CWE-200
TI-2025-31266 CVE-2025-49199 · GHSA-4cwc-669q-r7hf

Backup files can be modified and uploaded

Priority MEDIUM 42

The backup ZIPs are not signed by the application, leading to the possibility that an attacker can download a backup ZIP, modify and re-upload it.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00341 Published 2025-06-12 No fix listed CWE-345
TI-2025-31263 CVE-2025-49196 · GHSA-fx6m-qmcx-9x4v

Deprecated TLS version supported

Priority LOW 39

A service supports the use of a deprecated and unsafe TLS version.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00269 Published 2025-06-12 No fix listed CWE-327
TI-2025-31259 CVE-2025-49192 · GHSA-h3v4-38wv-mgjx

Clickjacking in SICK Field Analytics

Priority LOW 27

The web application is vulnerable to clickjacking attacks.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00339 Published 2025-06-12 Fixed in 1.5 CWE-1021
TI-2025-31258 CVE-2025-49191 · GHSA-cxg4-v879-p568

Dashboards and iFrames can link malicious web content

Priority LOW 27

Linked URLs during the creation of iFrame widgets and dashboards are vulnerable to code execution.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00372 Published 2025-06-12 No fix listed CWE-1021
TI-2025-31255 CVE-2025-49188 · GHSA-339w-6r43-vjh2

Sensitive Data in URL

Priority LOW 33

The application sends user credentials as URL parameters instead of POST bodies, making it vulnerable to information gathering.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00455 Published 2025-06-12 No fix listed CWE-598
TI-2025-31254 CVE-2025-49187 · GHSA-26xj-r8r2-vvgx

User enumeration

Priority LOW 30

For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existing username.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00425 Published 2025-06-12 No fix listed CWE-204
TI-2025-31252 CVE-2025-49185 · GHSA-h5pq-x44c-mx4p

Stored Cross-Site-Script

Priority LOW 25

The web application is susceptible to cross-site-scripting attacks.

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.0031 Published 2025-06-12 No fix listed CWE-79