PT-2014-8473

Name of the Vulnerable Software and Affected Versions Schrack Technik microControl versions prior to 1.7.0 937 Description The issue allows remote attackers to obtain access data for the ftp and telnet services via a direct request for ZTPUsrDtls.txt, due to sensitive information being stored und...

CVE-2014-8329: Improper Authentication

Schrack Technik microControl with firmware before 1.7.0 937 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain access data for the ftp and telnet services via a direct request for ZTPUsrDtls.txt...

PT-2014-6451

Name of the Vulnerable Software and Affected Versions Schrack Technik microControl versions prior to 1.7.0 Description The issue concerns a hardcoded password for the user account in the web interface, making it easier for remote attackers to gain access. Recommendations For versions prior to...

CVE-2014-5396: Undefined Security Weakness

The web interface in Schrack Technik microControl with firmware before 1.7.0 937 has a hardcoded password of not for the "user" account, which makes it easier for remote attackers to obtain access via unspecified vectors...

CVE-2014-5382

Schrack Technik microControl firmware 1.7.0 (937) web interface contains multiple XSS vulnerabilities that allow remote attackers to inject arbitrary web script or HTML via the position textbox in the configuration menu or other unspecified vectors. The issue is documented in CVE-2014-5382 and af...

PT-2014-6439

Name of the Vulnerable Software and Affected Versions Schrack Technik microControl version 1.7.0 937 Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the web interface. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the...

CVE-2014-5382: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the web interface in Schrack Technik microControl with firmware 1.7.0 937 allow remote attackers to inject arbitrary web script or HTML via the position textbox in the configuration menu or other unspecified vectors...