CVE-2017-14007

CVE-2017-14007 affects the ProMinent MultiFLEX M10a Controller web interface. The issue is Insufficient Session Expiration: a user’s session remains usable beyond the last activity, allowing an attacker to reuse an old session for authorization. Public sources (NVD) document the vulnerability wit...

CVE-2017-14009

An Information Exposure issue was discovered in ProMinent MultiFLEX M10a Controller web interface. When an authenticated user uses the Change Password feature on the application, the current password for the user is specified in plaintext. This may allow an attacker who has been authenticated to...

CVE-2017-14005

The CVE is for ProMinent MultiFLEX M10a Controller web interface. Affected: all versions of the MultiFLEX M10a Controller web UI. Issue: Unverified Password Change allows an authenticated attacker to change a user’s password, enabling future access and potential configuration changes. Impact: hig...

CVE-2017-14013

The CVE-2017-14013 issue is confirmed in ProMinent MultiFLEX M10a Controller web interface, where the logout function removes the user’s session only on the client side (Client-Side Enforcement of Server-Side Security). This allows potential bypass of protection mechanisms and identity impersonat...

CVE-2017-14011

A Cross-Site Request Forgery issue was discovered in ProMinent MultiFLEX M10a Controller web interface. The application does not sufficiently verify requests, making it susceptible to cross-site request forgery. This may allow an attacker to execute unauthorized code, resulting in changes to the...

ProMinent MultiFLEX M10a Controller Password Change Vulnerability

The MultiFLEX M10a Controller is a water treatment controller. A password change vulnerability exists in the ProMinent MultiFLEX M10a Controller, where the application does not require the user to know the original password when setting a new password for the user, which can be exploited by an...

ProMinent MultiFLEX M10a Controller Authentication Bypass Vulnerability

The MultiFLEX M10a Controller is a water treatment controller. An authentication bypass vulnerability exists in ProMinent MultiFLEX M10a Controller, where the logout feature in the application deletes a user's session on the client side only. An attacker can exploit the vulnerability to bypass...

ProMinent MultiFLEX M10a Controller Cross-Site Request Forgery Vulnerability

The MultiFLEX M10a Controller is a water treatment controller. A cross-site request forgery vulnerability exists in the ProMinent MultiFLEX M10a Controller, where the application does not adequately validate requests, making it susceptible to cross-site request forgery. An attacker could execute...

ProMinent MultiFLEX M10a Controller Session Stealing Vulnerability

The MultiFLEX M10a Controller is a water treatment controller. A session stealing vulnerability exists in ProMinent MultiFLEX M10a Controller, where a user's session can be used for a period of time longer than the last activity, which can be exploited by an attacker to reuse an old session for...

ProMinent MultiFLEX M10a Controller

CVSS v3 8.8 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: ProMinent Equipment: MultiFLEX M10a Controller Vulnerabilities: Client-Side Enforcement of Server-Side Security, Insufficient Session Expiration, Cross-Site Request Forgery, Information Exposure, and Unverified Passwo...

agenciasinc.es XSS vulnerability

Open Bug Bounty ID: OBB-63259 Description| Value ---|--- Affected Website:| agenciasinc.es Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat She...

Prominent Technologies CMS SQL Injection

Exploit Title : prominenttech Cms Sql Injection Vulnerabilitiy Author : IrIsT.Ir Discovered By : Am!r Home : http://IrIsT.Ir/forum Software Link : http://www.prominenttech.com Security Risk : High Version : All Version Tested on : GNU/Linux Ubuntu - Windows Server - win7 Dork : "Powered by...

MyBB 1.4.10 Cross Site Scripting

=============================================== + MyBB v1.4.10 XSS Vulnerability + Author: Steven Abbagnaro + Site: http://ProminentSecurity.com + Contact: [email protected] =============================================== + Exploit http://server/myps.php?action=donate&username="/...

CentOS Update for python CESA-2007:1077-01 centos2 i386

Check for the Version of python OpenVAS Vulnerability Test CentOS Update for python CESA-2007:1077-01 centos2 i386 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...