Overview 359 matches · 2 in Waratek scope · 0 protected · 14 exploited · 6 CISA KEV · 43 public PoC · 16 EPSS ≥ 0.5
359matches
2in Waratek scope0.6%
0protected0.0%
14exploited3.9%
6CISA KEV1.7%
43public PoC12.0%
16EPSS ≥ 0.54.5%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
1
0.3%
No exploit published
1
0.3%
Outside Waratek scope
1
0.3%
Not applicable
356
99.2%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
359
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 73 / year
20021
Not applicable1
High1
not blocked1
No public exploit1
20030
20042
Outside Waratek scope1
Not applicable1
High2
not blocked2
Working exploit published2
20051
Not applicable1
High1
not blocked1
Exploited1
20063
Not applicable3
High3
not blocked3
Working exploit published2
No public exploit1
200710
Not applicable10
High10
not blocked10
Working exploit published5
No public exploit5
200811
Not applicable11
High11
not blocked11
Exploited1
Working exploit published1
No public exploit9
200921
Not applicable21
High21
not blocked21
Exploited2
Working exploit published9
No public exploit10
20104
Not applicable4
High4
not blocked4
No public exploit4
20114
Not applicable4
High4
not blocked4
Working exploit published1
No public exploit3
201213
Not applicable13
High13
not blocked13
Working exploit published1
No public exploit12
201316
Not applicable16
High16
not blocked16
Exploited1
Forecast only1
No public exploit14
20146
Not applicable6
High6
not blocked6
Working exploit published2
No public exploit4
201515
Not applicable15
High15
not blocked15
Exploited1
Working exploit published6
No public exploit8
20166
Not applicable6
High6
not blocked6
Working exploit published1
No public exploit5
20179
Not applicable9
High9
not blocked9
Exploited1
Working exploit published1
No public exploit7
201822
Not applicable22
High22
not blocked22
Working exploit published1
No public exploit21
201920
Not applicable20
High20
not blocked20
Working exploit published1
No public exploit19
202015
No exploit published1
Not applicable14
High15
not blocked15
Exploited2
Proof of concept only1
No public exploit12
202114
Not applicable14
High14
not blocked14
Working exploit published1
No public exploit13
202221
Not applicable21
High21
not blocked21
Proof of concept only2
No public exploit19
202333
Mitigation candidate1
Not applicable32
High33
not blocked33
Exploited3
Proof of concept only3
Forecast only1
No public exploit26
202425
Not applicable25
High25
not blocked25
Exploited1
Proof of concept only3
No public exploit21
202514
Not applicable14
High14
not blocked14
No public exploit14
202673
Not applicable73
High73
not blocked73
Exploited1
Proof of concept only1
No public exploit71
2002200420062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-97788 | High | 2026-10-13 | Not applicable | No public exploit | Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-96960 | High | 2026-10-13 | Not applicable | No public exploit | Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network. |
| CVE-2026-96959 | High | 2026-10-13 | Not applicable | No public exploit | Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. |
| CVE-2026-96958 | High | 2026-10-13 | Not applicable | No public exploit | Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network. |
| CVE-2026-96957 | High | 2026-10-13 | Not applicable | No public exploit | Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network. |
| CVE-2026-96222 | High | 2026-10-13 | Not applicable | No public exploit | Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2026-71328 | High | 2026-09-08 | Not applicable | No public exploit | Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network. |
| CVE-2026-69806 | High | 2026-09-08 | Not applicable | No public exploit | Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate privileges locally. |
| CVE-2026-69439 | High | 2026-09-08 | Not applicable | No public exploit | Heap-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network. |
| CVE-2026-57099 | High | 2026-09-08 | Not applicable | No public exploit | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
| CVE-2026-70354 | High | 2026-08-11 | Not applicable | No public exploit | Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally. |
| CVE-2026-65810 | High | 2026-08-11 | Not applicable | No public exploit | Relative path traversal in .NET Framework allows an unauthorized attacker to elevate privileges locally. |
| CVE-2026-62909 | High | 2026-08-11 | Not applicable | No public exploit | Uncaught exception in .NET allows an authorized attacker to elevate privileges locally. |
| CVE-2026-62901 | High | 2026-08-11 | Not applicable | No public exploit | Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network. |
| CVE-2026-62898 | High | 2026-08-11 | Not applicable | No public exploit | Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-62897 | High | 2026-08-11 | Not applicable | No public exploit | Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to execute code locally. |
| CVE-2026-62886 | High | 2026-08-11 | Not applicable | No public exploit | Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally. |
| CVE-2026-62872 | High | 2026-08-11 | Not applicable | No public exploit | Incorrect authorization in .NET Framework allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-62871 | High | 2026-08-11 | Not applicable | No public exploit | Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally. |
| CVE-2026-58641 | High | 2026-08-11 | Not applicable | No public exploit | Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally. |
| CVE-2026-13190 | High | 2026-07-22 | Not applicable | No public exploit | In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the persistence utilities allows unsafe type instantiation from attacker-influenced persisted state, which can lead to remote code execution. |
| CVE-2026-13189 | High | 2026-07-22 | Not applicable | No public exploit | In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of the language parameter in the spell check handler may allow an attacker to influence server-side file path resolution and trigger unintended server-side requests. |
| CVE-2026-13187 | High | 2026-07-22 | Not applicable | No public exploit | In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler provider type input may be tampered with, potentially altering dialog processing and enabling chained exploitation. |
| CVE-2026-13186 | High | 2026-07-22 | Not applicable | No public exploit | In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnerability in the file-based persistence storage provider can be exploited when the storage key is derived from user-controlled input, enabling attacker-controlled deserialization and remote code execution. |
| CVE-2026-13185 | High | 2026-07-22 | Not applicable | No public exploit | In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceManager or RadDockLayout deserialize attacker-controlled cookie content, allowing unauthenticated remote code execution. |
| CVE-2026-13184 | High | 2026-07-22 | Not applicable | No public exploit | In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and machineKey is not explicitly configured, upload metadata integrity protection may fall back to a predictable default key, enabling attackers to forge protected upload metadata and unlock further exploit chains. |
| CVE-2026-13183 | High | 2026-07-22 | Not applicable | No public exploit | In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload upload metadata processing may leak cryptographic validity through measurable timing differences, enabling remote attackers to recover protected metadata values. |
| CVE-2026-13182 | High | 2026-07-22 | Not applicable | No public exploit | In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt failures from invalid-JSON parse failures, creating an oracle that reveals protected metadata values to remote attackers. |
| CVE-2026-13181 | High | 2026-07-22 | Not applicable | No public exploit | In Progress® Telerik® UI for AJAX prior to v2026.2.708, forged upload metadata can influence AsyncUploadTypeName processing and trigger unsafe attacker-controlled type resolution, enabling remote code execution in affected deployments. |
| CVE-2026-57108 | High | 2026-07-14 | Not applicable | No public exploit | Access of resource using incompatible type ('type confusion') in .NET Core allows an unauthorized attacker to deny service over a network. |
| CVE-2026-56170 | High | 2026-07-14 | Not applicable | No public exploit | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
| CVE-2026-50653 | High | 2026-07-14 | Not applicable | No public exploit | Loop with unreachable exit condition ('infinite loop') in Azure Active Directory allows an unauthorized attacker to deny service over a network. |
| CVE-2026-50652 | High | 2026-07-14 | Not applicable | No public exploit | Deserialization of untrusted data in Azure Active Directory allows an unauthorized attacker to deny service over a network. |
| CVE-2026-50651 | High | 2026-07-14 | Not applicable | No public exploit | Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. |
| CVE-2026-50650 | High | 2026-07-14 | Not applicable | No public exploit | Improper control of generation of code ('code injection') in .NET Framework allows an unauthorized attacker to elevate privileges locally. |
| CVE-2026-50649 | High | 2026-07-14 | Not applicable | No public exploit | Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally. |
| CVE-2026-50648 | High | 2026-07-14 | Not applicable | No public exploit | Allocation of resources without limits or throttling in .NET Framework allows an unauthorized attacker to deny service over a network. |
| CVE-2026-50647 | High | 2026-07-14 | Not applicable | No public exploit | Loop with unreachable exit condition ('infinite loop') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network. |
| CVE-2026-50646 | High | 2026-07-14 | Not applicable | No public exploit | Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally. |
| CVE-2026-50528 | High | 2026-07-14 | Not applicable | No public exploit | Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network. |
| CVE-2026-50527 | High | 2026-07-14 | Not applicable | No public exploit | Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to deny service over a network. |
| CVE-2026-50526 | High | 2026-07-14 | Not applicable | No public exploit | Improper link resolution before file access ('link following') in .NET allows an authorized attacker to perform tampering locally. |
| CVE-2026-50525 | High | 2026-07-14 | Not applicable | No public exploit | Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. |
| CVE-2026-50524 | High | 2026-07-14 | Not applicable | No public exploit | Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network. |
| CVE-2026-50506 | High | 2026-07-14 | Not applicable | No public exploit | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
| CVE-2026-50411 | High | 2026-07-14 | Not applicable | No public exploit | Stack-based buffer overflow in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network. |
| CVE-2026-50368 | High | 2026-07-14 | Not applicable | No public exploit | Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network. |
| CVE-2026-50355 | High | 2026-07-14 | Not applicable | No public exploit | Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network. |
| CVE-2026-47303 | High | 2026-07-14 | Not applicable | No public exploit | Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-47302 | High | 2026-07-14 | Not applicable | No public exploit | Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. |
| CVE-2026-47300 | High | 2026-07-14 | Not applicable | No public exploit | Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-45646 | High | 2026-07-14 | Not applicable | No public exploit | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
| CVE-2026-47897 | High | 2026-07-03 | Not applicable | No public exploit | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Lucene.Net (Lucene.Net.Replicator library). This issue affects Apache Lucene.Net.Replicator: from 4.8.0-beta00005 before 4.8.0-beta00018. Users are recommended to upgrade to version 4.8.0-beta00018, which fixes the issue. |
| CVE-2026-47896 | High | 2026-07-03 | Not applicable | No public exploit | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Lucene.Net (Lucene.Net.Replicator library). This issue affects Apache Lucene.Net.Replicator: from 4.8.0-beta00005 through 4.8.0-beta00017. Users are recommended to upgrade to version 4.8.0-beta00018, which fixes the issue. |
| CVE-2026-45591 | High | 2026-06-09 | Not applicable | No public exploit | Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
| CVE-2026-45490 | High | 2026-06-09 | Not applicable | No public exploit | Improper authorization in .NET allows an authorized attacker to elevate privileges locally. |
| CVE-2026-42899 | High | 2026-05-12 | Not applicable | No public exploit | Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
| CVE-2026-35433 | High | 2026-05-12 | Not applicable | No public exploit | Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally. |
| CVE-2026-32177 | High | 2026-05-12 | Not applicable | No public exploit | Heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally. |
| CVE-2026-6022 | High | 2026-04-22 | Not applicable | No public exploit | In Progress® Telerik® UI for AJAX prior to 2026.1.421, RadAsyncUpload contains an uncontrolled resource consumption vulnerability that allows file uploads to exceed the configured maximum size due to missing cumulative size enforcement during chunk reassembly, leading to disk space exhaustion. |
| CVE-2026-33116 | High | 2026-04-14 | Not applicable | No public exploit | Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio allows an unauthorized attacker to deny service over a network. |
| CVE-2026-32203 | High | 2026-04-14 | Not applicable | No public exploit | Stack-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to deny service over a network. |
| CVE-2026-32178 | High | 2026-04-14 | Not applicable | No public exploit | Improper neutralization of special elements in .NET allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2026-26171 | High | 2026-04-14 | Not applicable | No public exploit | Uncontrolled resource consumption in .NET allows an unauthorized attacker to deny service over a network. |
| CVE-2026-23666 | High | 2026-04-14 | Not applicable | No public exploit | Improper input validation in .NET Framework allows an unauthorized attacker to deny service over a network. |
| CVE-2026-25667 | High | 2026-03-19 | Not applicable | No public exploit | ASP.NET Core Kestrel in Microsoft .NET 8.0 before 8.0.22 and .NET 9.0 before 9.0.11 allows a remote attacker to cause excessive CPU consumption by sending a crafted QUIC packet, because of an incorrect exit condition for HTTP/3 Encoder/Decoder stream processing. |
| CVE-2026-26131 | High | 2026-03-10 | Not applicable | No public exploit | Incorrect default permissions in .NET allows an authorized attacker to elevate privileges locally. |
| CVE-2026-26130 | High | 2026-03-10 | Not applicable | No public exploit | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
| CVE-2026-26127 | High | 2026-03-10 | Not applicable | Exploited | Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network. |
| CVE-2026-27798 | High | 2026-02-26 | Not applicable | No public exploit | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a heap buffer over-read vulnerability occurs when processing an image with small dimension using the `-wavelet-denoise` operator. Versions 7.1.2-15 and 6.9.13-40 contain a patch. |
| CVE-2026-24485 | High | 2026-02-24 | Not applicable | No public exploit | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, when a PCD file does not contain a valid Sync marker, the DecodeImage() function becomes trapped in an infinite loop while searching for the Sync marker, causing the program to become unresponsive and continuously consume CPU resources, ultimately leading to system resource exhaustion and denial of service. Versions 7.1.2-15 and 6.9.13-40 contain a patch. |
| CVE-2026-21218 | High | 2026-02-10 | Not applicable | No public exploit | Improper handling of missing special element in .NET allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2026-23952 | High | 2026-01-22 | Not applicable | Proof of concept only | ImageMagick is free and open-source software used for editing and manipulating digital images. Versions 14.10.1 and below have a NULL pointer dereference vulnerability in the MSL (Magick Scripting Language) parser when processing <comment> tags before images are loaded. This can lead to DoS attack due to assertion failure (debug builds) or NULL pointer dereference (release builds). This issue is fixed in version 14.10.2. |
| CVE-2025-66631 | High | 2025-12-09 | Not applicable | No public exploit | CSLA .NET is a framework designed for the development of reusable, object-oriented business layers for applications. Versions 5.5.4 and below allow the use of WcfProxy. WcfProxy uses the now-obsolete NetDataContractSerializer (NDCS) and is vulnerable to remote code execution during deserialization. This vulnerability is fixed in version 6.0.0. To workaround this issue, remove the WcfProxy in data portal configurations. |
| CVE-2025-55247 | High | 2025-10-14 | Not applicable | No public exploit | Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally. |
| CVE-2025-30399 | High | 2025-06-13 | Not applicable | No public exploit | Untrusted search path in .NET and Visual Studio allows an unauthorized attacker to execute code over a network. |
| CVE-2025-27997 | High | 2025-05-21 | Not applicable | No public exploit | An issue in Blizzard Battle.net v2.40.0.15267 allows attackers to escalate privileges via placing a crafted shell script or executable into the C:\ProgramData directory. |
| CVE-2025-3600 | High | 2025-05-14 | Not applicable | No public exploit | In Progress® Telerik® UI for AJAX, versions 2011.2.712 to 2025.1.218, an unsafe reflection vulnerability exists that may lead to an unhandled exception resulting in a crash of the hosting process and denial of service. |
| CVE-2025-26646 | High | 2025-05-13 | Not applicable | No public exploit | External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a network. |
| CVE-2025-33072 | High | 2025-05-08 | Not applicable | No public exploit | Improper access control in Azure allows an unauthorized attacker to disclose information over a network. |
| CVE-2025-26682 | High | 2025-04-08 | Not applicable | No public exploit | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
| CVE-2025-24070 | High | 2025-03-11 | Not applicable | No public exploit | Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a network. |
| CVE-2024-42512 | High | 2025-02-10 | Not applicable | No public exploit | Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when the deprecated Basic128Rsa15 security policy is enabled. |
| CVE-2025-21176 | High | 2025-01-14 | Not applicable | No public exploit | .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability |
| CVE-2025-21173 | High | 2025-01-14 | Not applicable | No public exploit | .NET Elevation of Privilege Vulnerability |
| CVE-2025-21172 | High | 2025-01-14 | Not applicable | No public exploit | .NET and Visual Studio Remote Code Execution Vulnerability |
| CVE-2025-21171 | High | 2025-01-14 | Not applicable | No public exploit | .NET Remote Code Execution Vulnerability |
| CVE-2024-43499 | High | 2024-11-12 | Not applicable | No public exploit | .NET and Visual Studio Denial of Service Vulnerability |
| CVE-2024-43383 | High | 2024-10-31 | Not applicable | No public exploit | Deserialization of Untrusted Data vulnerability in Apache Lucene.Net.Replicator. This issue affects Apache Lucene.NET's Replicator library: from 4.8.0-beta00005 through 4.8.0-beta00016. An attacker that can intercept traffic between a replication client and server, or control the target replication node URL, can provide a specially-crafted JSON response that is deserialized as an attacker-provided exception type. This can result in remote code execution or other potential unauthorized access. Users are recommended to upgrade to version 4.8.0-beta00017, which fixes the issue. |
| CVE-2024-49620 | High | 2024-10-20 | Not applicable | No public exploit | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mrcheck116 FERMA.ru.net ferma-ru-net-checkout allows Blind SQL Injection.This issue affects FERMA.ru.net: from n/a through <= 1.3.3. |
| CVE-2024-43485 | High | 2024-10-08 | Not applicable | No public exploit | .NET and Visual Studio Denial of Service Vulnerability |
| CVE-2024-43484 | High | 2024-10-08 | Not applicable | No public exploit | .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability |
| CVE-2024-43483 | High | 2024-10-08 | Not applicable | No public exploit | .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability |
| CVE-2024-38229 | High | 2024-10-08 | Not applicable | No public exploit | .NET and Visual Studio Remote Code Execution Vulnerability |
| CVE-2024-38168 | High | 2024-08-13 | Not applicable | No public exploit | .NET and Visual Studio Denial of Service Vulnerability |
| CVE-2024-38095 | High | 2024-07-09 | Not applicable | No public exploit | .NET and Visual Studio Denial of Service Vulnerability |
| CVE-2024-38081 | High | 2024-07-09 | Not applicable | No public exploit | .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability |
| CVE-2024-35264 | High | 2024-07-09 | Not applicable | No public exploit | .NET and Visual Studio Remote Code Execution Vulnerability |
| CVE-2024-30105 | High | 2024-07-09 | Not applicable | No public exploit | .NET and Visual Studio Denial of Service Vulnerability |
| CVE-2023-27321 | High | 2024-05-07 | Not applicable | No public exploit | OPC Foundation UA .NET Standard ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of OPC Foundation UA .NET Standard. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of OPC UA ConditionRefresh requests. By sending a large number of requests, an attacker can consume all available resources on the server. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-20505. |