71 matches found
Computrols CBAS-Web 19.0.0 Cross Site Request Forgery
Computrols CBAS-Web 19.0.0 CSRF Add Super Admin CVE: CVE-2019-10847 Advisory: https://applied-risk.com/resources/ar-2019-009 Paper: https://applied-risk.com/resources/i-own-your-building-management-system Discovered by Gjoko 'LiquidWorm' Krstic history.pushState'', 't00t', 'index.php'...
Computrols CBAS-Web 19.0.0 Blind SQL Injection
Computrols CBAS-Web Authenticated Boolean-based Blind SQL Injection Affected versions: 19.0.0 and below CVE: CVE-2019-10852 Advisory: https://applied-risk.com/resources/ar-2019-009 Paper: https://applied-risk.com/resources/i-own-your-building-management-system by Gjoko 'LiquidWorm' Krstic PoC id...
Computrols CBAS-Web 19.0.0 Information Disclosure
Computrols CBAS-Web Information Disclosure Affected versions: 19.0.0 and below CVE: CVE-2019-10849 Advisory: https://applied-risk.com/resources/ar-2019-009 Paper: https://applied-risk.com/resources/i-own-your-building-management-system by Gjoko 'LiquidWorm' Krstic $ curl -s...
CBAS-Web 19.0.0 - Remote Code Execution Exploit
Exploit for hardware platform in category web applications Exploit Title: CBAS-Web 19.0.0 - Remote Code Execution Exploit Author: LiquidWorm Vendor Homepage: https://www.computrols.com/capabilities-cbas-web/ Software Link: https://www.computrols.com/building-automation-software/ Version: 19.0.0...
Computrols CBAS-Web 19.0.0 Command Injection
!/usr/bin/env python ''' Computrols CBAS-Web Unauthenticated Remote Command Injection Exploit Affected versions: 19.0.0 and below by Sipke Mellema, 2019 Advisory: https://applied-risk.com/resources/ar-2019-009 Paper: https://applied-risk.com/resources/i-own-your-building-management-system Uses tw...
Computrols CBAS-Web 19.0.0 Cross Site Scripting
Computrols CBAS-Web Unauthenticated Reflected XSS Affected versions: 19.0.0 and below CVE: CVE-2019-10846 Advisory: https://applied-risk.com/resources/ar-2019-009 Paper: https://applied-risk.com/resources/i-own-your-building-management-system Discovered by Gjoko 'LiquidWorm' Krstic -- POST...
CVE-2019-10847
Computrols CBAS 18.0.0 allows Cross-Site Request Forgery...
CVE-2019-10848
Computrols CBAS 18.0.0 allows Username Enumeration...
CVE-2019-10848
Computrols CBAS 18.0.0 allows Username Enumeration...
CVE-2019-10847
Computrols CBAS 18.0.0 allows Cross-Site Request Forgery...
Cross site request forgery (csrf)
Computrols CBAS 18.0.0 allows Cross-Site Request Forgery...
Design/Logic Flaw
Computrols CBAS 18.0.0 allows Username Enumeration...
CVE-2019-10847
CVE-2019-10847 affects Computrols CBAS Web (CSRF). Documents show a CSRF vulnerability in CBAS Web, notably in version 18.0.0 (and affected earlier versions) that can allow unauthorized actions such as adding a Super Admin via forged requests. Public advisories indicate remote exploitation is pos...
CVE-2019-10848
Computrols CBAS 18.0.0 allows Username Enumeration...
CVE-2019-10848
CVE-2019-10848 affects Computrols CBAS Web (CBAS Web) versions around 18.x/19.x, where the Information Exposure Through Discrepancy (username enumeration) vulnerability exists in CBAS Web prior to certain fixes. Public sources (NVD, Red Hat advisories, Exploit-DB/PacketStorm) document that CBAS W...
Computrols CBAS Web Cross-Site Request Forgery Vulnerability (CNVD-2019-15903)
Computrols CBAS is a building automation system from Computrols USA. A cross-site request forgery vulnerability in Computrols CBAS version 18.0.0 can be exploited by an attacker to send an unintended request to a server via an affected client...
Computrols CBAS Web Cross-Site Request Forgery Vulnerability
Computrols CBAS is a building automation system from Computrols USA. A cross-site request forgery vulnerability exists in Computrols CBAS, which can be exploited by an attacker to send unintended requests to a server via an affected client...
Code injection
Computrols CBAS 18.0.0 allows unprotected Subversion SVN directory / source code disclosure...