CVE-2021-38393

A Blind SQL injection vulnerability exists in the /DataHandler/HandlerAlarmGroup.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter agid before using it as part of an SQL query....

CVE-2021-38391

A Blind SQL injection vulnerability exists in the /DataHandler/AM/AMHandler.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter type before using it as part of an SQL query. A...

CVE-2021-38391

The CVE-2021-38391 entry describes a Blind SQL injection in Delta Electronics DIAEnergie—specifically the /DataHandler/AM/AM_Handler.ashx endpoint. Affects DIAEnergie versions up to 1.7.5 (and earlier); root cause is improper validation of the type parameter before including it in an SQL query, a...

CVE-2021-32991

Delta Electronics DIAEnergie Version 1.7.5 and prior is vulnerable to cross-site request forgery, which may allow an attacker to cause a user to carry out an action unintentionally...

CVE-2021-32991

Delta Electronics DIAEnergie CSRF vulnerability (CVE-2021-32991) affects DIAEnergie versions prior to 1.9. An unauthenticated user-side cross-site request forgery could cause a logged-in user to perform unintended actions. Public references in NVD list CVSSv3 base score 4.3 (Medium) with UI: Requ...

CVE-2021-32955

Delta Electronics DIAEnergie Version 1.7.5 and prior allows unrestricted file uploads, which may allow an attacker to remotely execute code...

CVE-2021-32955

Delta Electronics DIAEnergie vulnerable in versions up to 1.7.5 (and prior) to unrestricted file uploads, enabling remote code execution. This is the CVE-2021-32955 issue; ICS advisory Update C fixes recommend upgrading to 1.9 or later and applying network isolation measures. The documented impac...

CVE-2021-32967

CVE-2021-32967 concerns Delta Electronics DIAEnergie before v1.9. The issue enables an attacker to add a new administrative user without authentication or authorization, potentially allowing remote login with administrative privileges. Public sources in the provided documents confirm a high-impac...

CVE-2021-33003

CVE-2021-33003 affects Delta Electronics DIAEnergie, affected in version 1.7.5 and earlier. The root cause is use of a weak password hashing algorithm, enabling an attacker to retrieve plaintext passwords. ICS advisories (CISA ICSA-21-238-03 Update C) confirm the vulnerability, list affected prod...

CVE-2021-33003

Delta Electronics DIAEnergie Version 1.7.5 and prior may allow an attacker to retrieve passwords in cleartext due to a weak hashing algorithm...

CVE-2021-33019

CVE-2021-33019 describes a stack-based buffer overflow in Delta Electronics DOPSoft (versions 4.00.11 and earlier) triggered by processing a specially crafted project file, potentially allowing arbitrary code execution. Affected product: DOPSoft, an HMI programming software. Root cause: inadequat...

CVE-2021-33019

A stack-based buffer overflow vulnerability in Delta Electronics DOPSoft Version 4.00.11 and prior may be exploited by processing a specially crafted project file, which may allow an attacker to execute arbitrary code...

CVE-2021-33007

A heap-based buffer overflow in Delta Electronics TPEditor: v1.98.06 and prior may be exploited by processing a specially crafted project file. Successful exploitation of this vulnerability may allow an attacker to execute arbitrary code...

CVE-2021-33007

Delta Electronics TPEditor (Windows) is affected by CVE-2021-33007: a heap-based buffer overflow in the TPEditor file parser affecting v1.98.06 and earlier. The vulnerability could allow arbitrary code execution when processing a specially crafted project file. Mitigation: update to Delta TPEdito...

CVE-2021-38393: Improper Neutralization of Special Elements used in an SQL Command

A Blind SQL injection vulnerability exists in the /DataHandler/HandlerAlarmGroup.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter agid before using it as part of an SQL query....

PT-2021-20001

Name of the Vulnerable Software and Affected Versions Delta Electronics DIAEnergie versions 1.7.5 and prior Description The issue allows an attacker to add a new administrative user without being authenticated or authorized, potentially enabling the attacker to log in and use the device with...

CVE-2021-32991: Cross-Site Request Forgery (CSRF)

Delta Electronics DIAEnergie Version 1.7.5 and prior is vulnerable to cross-site request forgery, which may allow an attacker to cause a user to carry out an action unintentionally...

CVE-2021-32955: Unrestricted Upload of File with Dangerous Type

Delta Electronics DIAEnergie Version 1.7.5 and prior allows unrestricted file uploads, which may allow an attacker to remotely execute code...

CVE-2021-33019: Stack-based Buffer Overflow

A stack-based buffer overflow vulnerability in Delta Electronics DOPSoft Version 4.00.11 and prior may be exploited by processing a specially crafted project file, which may allow an attacker to execute arbitrary code...

CVE-2021-32983: Improper Neutralization of Special Elements used in an SQL Command

A Blind SQL injection vulnerability exists in the /DataHandler/HandlerCFG.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter keyword before using it as part of an SQL query. A...