VIRY.CZRADAR
sektor
téma
typ textu
zrušit filtry

Výsledky hledání

sektor: výroba a průmysl× v celém archivu zrušit filtry

87 karet z 89 položek · strana 2 z 2 CZ · EN/orig

1

Johnson Controls C-CURE 9000 and Victor application server (Update A)

View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker with network access to achieve remote code execution. The following versions of Johnson Controls C-CURE 9000 and Victor application server (Update A) are affected: C-CURE 9000 <=v3.10.1 (CVE-2026-21655) victor Application Server <=v4.10 (CVE-2026-21655) victor <=v7.0 (CVE-2026-21655) victor Web victor Web <=v7.1 (CVE-2026-34496) CVSS Vendor Equipment Vulnerabilities v3 9.6 Johnson Controls Johnson…

EPSS 0.00 CVSS 9.6 CVE-2026-21653 CVE-2026-21655 CVE-2026-34496 Johnson Controls výroba a průmysl US

CISA Advisories ·

1

DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure

In this article Pre-encryptionEncryptionPost-encryptionDefending against DeadLock ransomwareIndicators of compromise Microsoft Threat Intelligence tracks DeadLock ransomware as an emerging financially motivated operation distinguished by its use of decentralized infrastructure to support victim communications and data leak operations. Its recovery ecosystem combines the Session messaging network with blockchain-backed services that store and deliver resources used throughout the extortion…

Microsoft doprava výroba a průmysl energetika US

Microsoft Security Blog ·

3

Johnson Controls Inc. TL280

View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to access sensitive information on the device. The following versions of Johnson Controls Inc. TL280 are affected: TL280 <5.63 (CVE-2026-27871) CVSS Vendor Equipment Vulnerabilities v3 4.1 Johnson Controls Inc. Johnson Controls Inc. TL280 Use of a Broken or Risky Cryptographic Algorithm Background Critical Infrastructure Sectors: Critical Manufacturing, Commercial Facilities, Government Services and…

EPSS 0.00 CVSS 4.1 CVE-2026-27871 Johnson Controls energetika výroba a průmysl veřejná správa doprava US

CISA Advisories ·

ABB Ability Zenon

View CSAF Summary Successful exploitation of these vulnerabilities could allow attackers to bypass security, crash systems, execute unauthorized actions, or compromise data. The following versions of ABB Ability Zenon are affected: IIoT services with MongoDB (4.2) installed on ABB Ability Zenon vers:all/* CVSS Vendor Equipment Vulnerabilities v3 7.8 ABB ABB Ability Zenon Improper Handling of Length Parameter Inconsistency, Improper Neutralization of Null Byte or NUL Character, Collapse of Data…

KEV ✓ EPSS 0.83 CVSS 7.8 CVE-2020-7921 CVE-2020-7928 CVE-2025-14847 ABB energetika zdravotnictví vodárenství výroba a průmysl US

CISA Advisories ·

1

ChainDrop supply chain compromise: Anatomy of a self-propagating worm

In this article Attack chain overviewMitigation and protection guidanceIndicators of compromise (IOC)Microsoft Defender XDR detectionsAdvanced hunting queriesLearn more Microsoft Threat Intelligence identified a large-scale npm supply chain attack affecting more than 400 packages across multiple unrelated publishers, including packages associated with major enterprise software ecosystems such as keyv, flat-cache, cache-manager, and others. The malicious releases contain a Mini Shai-Hulud…

Microsoft npm GitHub Amazon Web Services výroba a průmysl US

Microsoft Security Blog ·

4

Kritická zranitelnost v systému Siemens Desigo CC

Společnost Siemens vydala bezpečnostní aktualizace pro systém Desigo CC. Opravy řeší kritickou zranitelnost (CVSS 9.8), jejíž zneužití může umožnit vzdálené spuštění kódu nebo způsobit nedostupnost systému. Zranitelnost se týká organizací využívajících systém Siemens Desigo CC pro řízení budov (Building Management System - BMS). Provozovatelům se doporučuje co nejdříve nainstalovat dostupné bezpečnostní aktualizace a zajistit, aby systémy nebyly přímo dostupné z internetu, ale byly chráněny…

CVSS 9.8 Siemens energetika výroba a průmysl CZ

CSIRT.CZ (CZ.NIC) ·

ZDI-26-502: (Pwn2Own) Phoenix Contact CHARX SEC-3150 user-applications Link Following Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Phoenix Contact CHARX SEC-3150 devices. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-44106.

EPSS 0.00 CVSS 7.8 CVE-2026-44106 Phoenix Contact výroba a průmysl US

Zero Day Initiative ·

ZDI-26-516: (Pwn2Own) Phoenix Contact CHARX SEC-3150 ModBus Server Exposed Dangerous Function Denial-of-Service Vulnerability

This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of Phoenix Contact CHARX SEC-3150 devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.5. The following CVEs are assigned: CVE-2026-44090.

EPSS 0.00 CVSS 6.5 CVE-2026-44090 Phoenix Contact výroba a průmysl energetika US

Zero Day Initiative ·

ZDI-26-519: (Pwn2Own) Phoenix Contact CHARX SEC-3150 CharxSystemConfigManager Configuration Injection Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Phoenix Contact CHARX SEC-3150 devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2026-44099.

EPSS 0.00 CVSS 7.5 CVE-2026-44099 Phoenix Contact výroba a průmysl US

Zero Day Initiative ·

1

Inyección SQL en ERPNext de Frappe

SQL Injection in Frappe's ERPNext Wed, 07/29/2026 - 12:41 Aviso Affected Resources ERPNext: versions prior to 15.111.0 and 16.22.0. Description INCIBE has coordinated the disclosure of a high-severity vulnerability affecting Frappe's ERPNext, an enterprise resource planning system. The vulnerability was discovered by Alejandro Ramos.This vulnerability has been assigned the following code, CVSS v4.0 base score, CVSS vector, and CWE vulnerability type:CVE-2026-12895: CVSS v4.0: 7.1| CVSS AV:N/AC…

EPSS 0.00 CVSS 7.1 CVE-2026-12895 Frappe výroba a průmysl ES

INCIBE-CERT ·

3

ZDI-26-449: AzeoTech DAQFactory CTL File Parsing Type Confusion Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of AzeoTech DAQFactory. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-12390.

EPSS 0.00 CVSS 7.8 CVE-2026-12390 AzeoTech výroba a průmysl US

Zero Day Initiative ·

ZDI-26-450: AzeoTech DAQFactory CTL File Parsing Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of AzeoTech DAQFactory. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-12921.

EPSS 0.00 CVSS 7.8 CVE-2026-12921 AzeoTech výroba a průmysl US

Zero Day Initiative ·

1

20th July – Threat Intelligence Report

For the latest discoveries in cyber research for the week of 20th July, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Ernst & Young, a global accounting and professional services company, has disclosed a data breach involving a compromised third-party IT support platform. The exposed support tickets may have contained client documents, tax information, employee details, and other sensitive information submitted while requesting technical assistance. Jscrambler, a…

KEV ✓ EPSS 0.97 CVE-2026-15409 CVE-2026-15410 CVE-2026-56155 CVE-2026-56164 CVE-2026-60137 CVE-2026-63030 Microsoft WordPress SonicWall výroba a průmysl finance IL

Check Point Research ·

1

2

ZDI-26-438: Rockwell Automation Arena Simulation DOE File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Rockwell Automation Arena Simulation. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-6071.

CVSS 7.8 CVE-2026-6071 Rockwell Automation výroba a průmysl US

Zero Day Initiative ·

ZDI-26-439: Fuji Electric Tellus pcid64 Driver Exposed Dangerous Method Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Fuji Electric Tellus. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-8108.

EPSS 0.00 CVSS 7.8 CVE-2026-8108 Fuji Electric výroba a průmysl US

Zero Day Initiative ·

1

6th July – Threat Intelligence Report

For the latest discoveries in cyber research for the week of 6th July, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES River Bank & Trust, a US financial institution, has experienced a ransomware incident after an unauthorized actor accessed the network of parent company River Financial Corporation on June 16. The bank found ransomware on portions of its server environment and is assessing whether personal data was accessed or exfiltrated. Indra Group, a Spanish…

KEV ✓ EPSS 1.00 CVSS 9.6 CVE-2024-1212 CVE-2026-46242 CVE-2026-46817 CVE-2026-8037 CVE-2026-8451 Oracle Citrix Progress Check Point finance obrana výroba a průmysl energetika IL

Check Point Research ·

1

1

1

CVE-2026-25600 — Credential Exposure Vulnerability in Trac PDBM

Summary A vulnerability has been identified in Trac d.o.o. Process Database Manager (PDBM). The application contains a hard‑coded cryptographic secret embedded directly within the executable binary. This secret is used by the product’s internal encryption and decryption routines, including the mechanism responsible for decrypting credentials stored in the application’s configuration file. An attacker with local high privileges on the host system may extract the hard‑coded secret from the…

EPSS 0.00 CVSS 6.4 CVE-2026-25600 Trac energetika výroba a průmysl SI

SI-CERT ·

1

The German Cyber Criminal Überfall: Shifts in Europe's Data Leak Landscape

Written by: Jamie Collier, Robin Grunewald Germany has reclaimed its position as a primary focus for cyber extortion in Europe. While data leak site (DLS) posts rose almost 50% globally in 2025, Google Threat Intelligence (GTI) data shows that the surge is hitting German infrastructure harder and faster than its regional neighbors, marking a significant return to the high-pressure levels previously observed in the country during 2022 and 2023. Cyber Criminals Pivoting Back to Germany Germany…

Google výroba a průmysl US

Mandiant / Google TI ·

2

Riasztás ipari vezérlőrendszereket érintő kampányról

A Nemzetbiztonsági Szakszolgálat Nemzeti Kiberbiztonsági Intézet (NBSZ NKI) riasztást ad ki egy kritikus infrastruktúrákat célzó, jelenleg is aktív támadási kampány kapcsán. A rendelkezésre álló elemzés szerint a kampány során iráni kötődésű szereplők ipari vezérlőrendszerekhez, ezen belül Rockwell Automation / Allen-Bradley PLC-khez fértek hozzá, és azok manipulálásával működési zavarokat idéztek elő. A támadások sajátossága, hogy nem […]

Rockwell Automation energetika výroba a průmysl vodárenství HU

NKI Maďarsko ·

ICS Security Conference 2026

JPCERT/CC held the ICS Security Conference 2026 on February 10, 2026. This conference aims to share the current threat landscape surrounding Industrial Control System (ICS) in Japan and abroad, as well as initiatives undertaken by stakeholders in ICS security. It also seeks to help participants strengthen their security measures and establish best practices. Since its launch in 2009, the conference has been held annually, and this year marked the 18th conference. This year’s conference was held…

Claroty TXOne Networks výroba a průmysl energetika JP

JPCERT/CC – blog ·

1

1