CVE-2016-2300

CVE-2016-2300 affects Ecava IntegraXor prior to Version 5.0, build 4522. The vulnerability is an authentication bypass that allows remote attackers to access unspecified web pages via unknown vectors. The vulnerability is remote-exploitable and is among multiple issues identified for IntegraXor

CVE-2016-2301

CVE-2016-2301 affects Ecava IntegraXor web-based HMI software. The issue is SQL injection in IntegraXor prior to version 5.0, build 4522, allowing remote authenticated users to execute arbitrary SQL commands via unspecified vectors. Affected product: Ecava IntegraXor; root cause: improper handlin...

CVE-2016-2302

CVE-2016-2302 affects Ecava IntegraXor web-based HMI (IntegraXor) before version 5.0, build 4522. Root cause: cleartext transmission of sensitive information and related information disclosure via detailed error messages. Impact: remote attacker could obtain sensitive information from the affecte...

CVE-2016-2305

CVE-2016-2305 affects Ecava IntegraXor web UI: a DOM-based cross-site scripting vulnerability allows remote attackers to inject arbitrary script/HTML via a crafted URL in IntegraXor versions prior to 5.0, build 4522. Root cause: improper input handling in the web interface enables XSS through man...

CVE-2016-2306

CVE-2016-2306 affects Ecava IntegraXor HMI web server prior to version 5.0, build 4522. The root cause is cleartext transmission of sensitive information over the network, enabling remote attackers to sniff unencrypted data. The vulnerability has been confirmed in multiple sources and is associat...

CVE-2016-2305: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Ecava IntegraXor before 5.0 build 4522 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

PT-2016-5109

Name of the Vulnerable Software and Affected Versions Ecava IntegraXor versions prior to 5.0 build 4522 Description The issue allows remote attackers to obtain sensitive cleartext information by sniffing the network, due to a problem with the HMI web server. Recommendations For versions prior to...

PT-2016-5104

Name of the Vulnerable Software and Affected Versions Ecava IntegraXor versions prior to 5.0 build 4522 Description The issue allows remote authenticated users to execute arbitrary SQL commands. Recommendations For versions prior to 5.0 build 4522, update to version 5.0 build 4522 or later to...

PT-2016-5105

Name of the Vulnerable Software and Affected Versions Ecava IntegraXor versions prior to 5.0 build 4522 Description The issue allows remote attackers to obtain sensitive information by reading detailed error messages. Recommendations For versions prior to 5.0 build 4522, update to version 5.0 bui...

PT-2016-5103

Name of the Vulnerable Software and Affected Versions Ecava IntegraXor versions prior to 5.0 build 4522 Description The issue allows remote attackers to bypass authentication and access unspecified web pages. Recommendations For versions prior to 5.0 build 4522, update to version 5.0 build 4522 o...

PT-2016-5107

Name of the Vulnerable Software and Affected Versions Ecava IntegraXor versions prior to 5.0 build 4522 Description The issue makes it easier for remote attackers to obtain potentially sensitive information via script access to the session cookie, as the HTTPOnly flag is not included in the...

PT-2016-5108

Name of the Vulnerable Software and Affected Versions Ecava IntegraXor versions prior to 5.0 build 4522 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via a crafted URL. This could potentially lead to unauthorized actions on the affecte...

CVE-2016-2305

Cross-site scripting XSS vulnerability in Ecava IntegraXor before 5.0 build 4522 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

PT-2016-5106

Name of the Vulnerable Software and Affected Versions Ecava IntegraXor versions prior to 5.0 build 4522 Description The issue allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL. Recommendations For versions prior to 5.0 build 452...

CVE-2016-2304

CVE-2016-2304 affects Ecava IntegraXor prior to version 5.0, build 4522. The issue is that the HTTPOnly flag is not set on the session cookie in the web server, enabling a remote attacker to access the cookie via scripts and potentially log in as an administrator. Public sources describe this as ...

Ecava IntegraXor SQL Injection Vulnerability

Ecava IntegraXor is a set of Web-based tools for creating and running HMI Human Machine Interface interfaces for SCADA systems from Ecava Malaysia. A SQL injection vulnerability exists in Ecava IntegraXor versions prior to 5.0 build 4522. A remote attacker can exploit the vulnerability to execute...

Ecava IntegraXor Information Disclosure Vulnerability

Ecava IntegraXor is a set of Web-based tools for creating and running HMI interfaces for SCADA systems. A security vulnerability exists in Ecava IntegraXor that could be exploited by a remote attacker to obtain sensitive log information...

Ecava IntegraXor HMI Privilege Bypass Vulnerability

Ecava IntegraXor is a set of Web-based tools for creating and running HMI interfaces for SCADA systems. The Ecava IntegraXor HMI fails to properly process specific elements of input, allowing remote attackers to exploit the vulnerability to bypass security restrictions...

Ecava IntegraXor Information Disclosure Vulnerability (CNVD-2016-02341)

Ecava IntegraXor is a set of Web-based tools for creating and running HMI interfaces for SCADA systems. An information disclosure vulnerability exists in Ecava IntegraXor prior to version 5.0 build 4522 that stems from the program not setting the HTTPOnly flag in the session cookie. A remote...

Ecava IntegraXor Transfer Unencrypted Vulnerability

Ecava IntegraXor is a set of Web-based tools for creating and running HMI interfaces for SCADA systems. A transmit unencrypted vulnerability exists in Ecava IntegraXor prior to version 5.0 build 4522, which originates when the HMI web server transmits unencrypted data. A remote attacker could...