Cross site request forgery (csrf)

Delta Electronics DIAEnergie Version 1.7.5 and prior is vulnerable to cross-site request forgery, which may allow an attacker to cause a user to carry out an action unintentionally...

Sql injection

A Blind SQL injection vulnerability exists in the /DataHandler/HandlerEnergyType.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter egyid before using it as part of an SQL query...

CVE-2021-33003

Delta Electronics DIAEnergie Version 1.7.5 and prior may allow an attacker to retrieve passwords in cleartext due to a weak hashing algorithm...

Sql injection

A Blind SQL injection vulnerability exists in the /DataHandler/HandlerAlarmGroup.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter agid before using it as part of an SQL query....

CVE-2021-38390

CVE-2021-38390 affects Delta Electronics DIAEnergie (endpoint /DataHandler/HandlerEnergyType.ashx). The flaw is an improper validation of the egyid parameter, enabling Blind SQL Injection that can lead to arbitrary code execution in the MSSQLSERVER context. Public advisories note the vulnerabilit...

CVE-2021-38390

A Blind SQL injection vulnerability exists in the /DataHandler/HandlerEnergyType.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter egyid before using it as part of an SQL query...

CVE-2021-32983

Delta Electronics DIAEnergie vulnerability CVE-2021-32983 is a Blind SQL Injection in the /DataHandler/Handler_CFG.ashx endpoint (versions prior to 1.9). The flaw arises from improper validation of the keyword parameter before building an SQL query, allowing remote, unauthenticated attackers to e...

CVE-2021-32983

A Blind SQL injection vulnerability exists in the /DataHandler/HandlerCFG.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter keyword before using it as part of an SQL query. A...

CVE-2021-38393

Delta Electronics DIAEnergie (all versions before 1.9) contains a Blind SQL injection in /DataHandler/HandlerAlarmGroup.ashx via the agid parameter, enabling remote, unauthenticated code execution in NT SERVICES\MSSQLSERVER. This is tied to CVE-2021-38393. Impact is high (CVE has CVSS v3.1 base s...

CVE-2021-38393

A Blind SQL injection vulnerability exists in the /DataHandler/HandlerAlarmGroup.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter agid before using it as part of an SQL query....

CVE-2021-38391

The CVE-2021-38391 entry describes a Blind SQL injection in Delta Electronics DIAEnergie—specifically the /DataHandler/AM/AM_Handler.ashx endpoint. Affects DIAEnergie versions up to 1.7.5 (and earlier); root cause is improper validation of the type parameter before including it in an SQL query, a...

CVE-2021-38391

A Blind SQL injection vulnerability exists in the /DataHandler/AM/AMHandler.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter type before using it as part of an SQL query. A...

CVE-2021-32991

Delta Electronics DIAEnergie CSRF vulnerability (CVE-2021-32991) affects DIAEnergie versions prior to 1.9. An unauthenticated user-side cross-site request forgery could cause a logged-in user to perform unintended actions. Public references in NVD list CVSSv3 base score 4.3 (Medium) with UI: Requ...

CVE-2021-32991

Delta Electronics DIAEnergie Version 1.7.5 and prior is vulnerable to cross-site request forgery, which may allow an attacker to cause a user to carry out an action unintentionally...

CVE-2021-32955

Delta Electronics DIAEnergie vulnerable in versions up to 1.7.5 (and prior) to unrestricted file uploads, enabling remote code execution. This is the CVE-2021-32955 issue; ICS advisory Update C fixes recommend upgrading to 1.9 or later and applying network isolation measures. The documented impac...

CVE-2021-32955

Delta Electronics DIAEnergie Version 1.7.5 and prior allows unrestricted file uploads, which may allow an attacker to remotely execute code...

CVE-2021-32967

CVE-2021-32967 concerns Delta Electronics DIAEnergie before v1.9. The issue enables an attacker to add a new administrative user without authentication or authorization, potentially allowing remote login with administrative privileges. Public sources in the provided documents confirm a high-impac...

CVE-2021-33003

Delta Electronics DIAEnergie Version 1.7.5 and prior may allow an attacker to retrieve passwords in cleartext due to a weak hashing algorithm...

CVE-2021-33003

CVE-2021-33003 affects Delta Electronics DIAEnergie, affected in version 1.7.5 and earlier. The root cause is use of a weak password hashing algorithm, enabling an attacker to retrieve plaintext passwords. ICS advisories (CISA ICSA-21-238-03 Update C) confirm the vulnerability, list affected prod...

CVE-2021-33019

CVE-2021-33019 describes a stack-based buffer overflow in Delta Electronics DOPSoft (versions 4.00.11 and earlier) triggered by processing a specially crafted project file, potentially allowing arbitrary code execution. Affected product: DOPSoft, an HMI programming software. Root cause: inadequat...