CVE-2018-19615

Rockwell Automation Allen-Bradley PowerMonitor 1000 all versions. A remote attacker could inject arbitrary code into a targeted user’s web browser to gain access to the affected device...

CVE-2018-19616

An issue was discovered in Rockwell Automation Allen-Bradley PowerMonitor 1000. An unauthenticated user can add/edit/remove administrators because access control is implemented on the client side via a disabled attribute for a BUTTON element...

CVE-2018-19615

Rockwell Automation Allen-Bradley PowerMonitor 1000 all versions. A remote attacker could inject arbitrary code into a targeted user’s web browser to gain access to the affected device...

Design/Logic Flaw

An issue was discovered in Rockwell Automation Allen-Bradley PowerMonitor 1000. An unauthenticated user can add/edit/remove administrators because access control is implemented on the client side via a disabled attribute for a BUTTON element...

Code injection

Rockwell Automation Allen-Bradley PowerMonitor 1000 all versions. A remote attacker could inject arbitrary code into a targeted userâ??s web browser to gain access to the affected device...

CVE-2018-19615

Rockwell Automation Allen-Bradley PowerMonitor 1000 all versions. A remote attacker could inject arbitrary code into a targeted user’s web browser to gain access to the affected device...

CVE-2018-19615

CVE-2018-19615 affects Rockwell Automation Allen-Bradley PowerMonitor 1000 (all versions). The vulnerability is described as Cross-Site Scripting due to improper neutralization of input during web page generation, enabling a remote attacker to inject arbitrary code into a targeted user’s browser ...

CVE-2018-19616

CVE-2018-19616 affects Rockwell Automation Allen-Bradley PowerMonitor 1000. An unauthenticated attacker can bypass authentication and gain/modify administrator rights due to client-side access control implemented as a disabled button element in the web UI. The vulnerability enables remote manipul...

CVE-2018-19616

An issue was discovered in Rockwell Automation Allen-Bradley PowerMonitor 1000. An unauthenticated user can add/edit/remove administrators because access control is implemented on the client side via a disabled attribute for a BUTTON element...

Rockwell Automation Allen-Bradley PowerMonitor 1000 Access Control Error Vulnerability

Rockwell Automation Allen-Bradley PowerMonitor 1000 is a power monitoring device from Rockwell Automation. An access control error vulnerability exists in the Web pages of the Rockwell Automation Allen-Bradley PowerMonitor 1000, which can be exploited by an attacker to add a new user with...

Rockwell Automation Allen-Bradley PowerMonitor 1000 Authentication Bypass

Exploit Title: Rockwell Automation Allen-Bradley PowerMonitor 1000 - Incorrect Access Control Date: 2018-11-27 Exploit Author: Luca.Chiou Vendor Homepage: https://www.rockwellautomation.com/ Version: 1408-EM3A-ENT B Tested on: It is a proprietary devices:...

Rockwell Automation Allen-Bradley PowerMonitor 1000 XSS

Exploit Title: Rockwell Automation Allen-Bradley PowerMonitor 1000 - Cross-Site Scripting Date: 2018-11-27 Exploit Author: Luca.Chiou Vendor Homepage: https://www.rockwellautomation.com/ Version: 1408-EM3A-ENT B Tested on: It is a proprietary devices:...

Rockwell Automation Allen-Bradley PowerMonitor 1000 - Cross-Site Scripting

Exploit Title: Rockwell Automation Allen-Bradley PowerMonitor 1000 - Cross-Site Scripting Date: 2018-11-27 Exploit Author: Luca.Chiou Vendor Homepage: https://www.rockwellautomation.com/ Version: 1408-EM3A-ENT B Tested on: It is a proprietary devices:...

Rockwell Automation Allen-Bradley PowerMonitor 1000 - Cross-Site Scripting Vulnerability

Exploit for hardware platform in category web applications Exploit Title: Rockwell Automation Allen-Bradley PowerMonitor 1000 - Cross-Site Scripting Exploit Author: Luca.Chiou Vendor Homepage: https://www.rockwellautomation.com/ Version: 1408-EM3A-ENT B Tested on: It is a proprietary devices:...

Rockwell Automation Allen-Bradley PowerMonitor 1000 - Cross-Site Scripting

Rockwell Automation Allen-Bradley PowerMonitor 1000 - Cross-Site Scripting Exploit Title: Rockwell Automation Allen-Bradley PowerMonitor 1000 - Cross-Site Scripting Date: 2018-11-27 Exploit Author: Luca.Chiou Vendor Homepage: https://www.rockwellautomation.com/ Version: 1408-EM3A-ENT B Tested on:...

PT-2018-3085 · Rockwell Automation · Rockwell Automation Allen-Bradley Powermonitor 1000

Name of the Vulnerable Software and Affected Versions: Rockwell Automation Allen-Bradley PowerMonitor 1000 all versions Description: The issue is related to insufficient input validation, which could allow a remote attacker to inject arbitrary code into a targeted user's web browser, potentially...

Oracle VirtualBox Guest-to-Host Escape E1000 Privilege Escalation Vulnerability - Linux

Oracle VirtualBox is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Oracle VirtualBox Guest-to-Host Escape E1000 Privilege Escalation Vulnerability - Windows

Oracle VirtualBox is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Oracle VirtualBox Guest-to-Host Escape E1000 Privilege Escalation Vulnerability - Mac OS X

Oracle VirtualBox is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Unpatched VirtualBox Zero-Day Vulnerability and Exploit Released Online

An independent exploit developer and vulnerability researcher has publicly disclosed a zero-day vulnerability in VirtualBox —a popular open source virtualization software developed by Oracle—that could allow a malicious program to escape virtual machine guest OS and execute code on the operating...