CVE-2019-16321

ScadaBR 1.0CE, and 1.1.x through 1.1.0-RC, has XSS via a request for a nonexistent resource, as demonstrated by the dwr/test/ PATHINFO...

Design/Logic Flaw

ScadaBR 1.0CE, and 1.1.x through 1.1.0-RC, has XSS via a request for a nonexistent resource, as demonstrated by the dwr/test/ PATHINFO...

CVE-2019-16321

ScadaBR 1.0CE, and 1.1.x through 1.1.0-RC, has XSS via a request for a nonexistent resource, as demonstrated by the dwr/test/ PATHINFO...

CVE-2019-16321

CVE-2019-16321 affects ScadaBR 1.0CE and 1.1.x up to 1.1.0-RC, where an XSS exists through requests for nonexistent resources, demonstrated via the dwr/test/ PATH_INFO. The underlying issue is unsafe handling of PATH_INFO/requests leading to script inclusion or injection in responses. The Red Hat...

ScadaBR Credentials Dumper Exploit

This module retrieves credentials from ScadaBR, including service credentials and unsalted SHA1 password hashes for all users, by invoking the 'EmportDwr.createExportData' DWR method of Mango M2M which is exposed to all authenticated users regardless of privilege level. This module has been teste...

ScadaBR Credentials Dumper

This module retrieves credentials from ScadaBR, including service credentials and unsalted SHA1 password hashes for all users, by invoking the EmportDwr.createExportData DWR method of Mango M2M which is exposed to all authenticated users regardless of privilege level. This module has been tested...