CVE-2018-18879

In firmware version MS2.6.9900 of Columbia Weather MicroServer, an authenticated web user can pipe commands directly to the underlying operating system as user input is not sanitized in networkdiags.php...

Command injection

In firmware version MS2.6.9900 of Columbia Weather MicroServer, an authenticated web user can pipe commands directly to the underlying operating system as user input is not sanitized in networkdiags.php...

CVE-2018-18878

CVE-2018-18878 affects Columbia Weather MicroServer firmware MS_2.6.9900 where the BACnet daemon improperly validates input, allowing a remote attacker to send crafted packets and cause a denial-of-service/unavailability. Red Hat/NVD references corroborate the vulnerability and its high 7.5 (CVSS...

CVE-2018-18878

In firmware version MS2.6.9900 of Columbia Weather MicroServer, the BACnet daemon does not properly validate input, which could allow a remote attacker to send specially crafted packets causing the device to become unavailable...

CVE-2018-18879

In firmware version MS2.6.9900 of Columbia Weather MicroServer, an authenticated web user can pipe commands directly to the underlying operating system as user input is not sanitized in networkdiags.php...

CVE-2018-18880

In firmware version MS2.6.9900 of Columbia Weather MicroServer, a networkdiags.php reflected Cross-site scripting XSS vulnerability allows remote authenticated users to inject arbitrary web script...

CVE-2018-18880

CVE-2018-18880 affects Columbia Weather Systems Weather MicroServer firmware MS_2.6.9900. A cross-site scripting flaw in the page networkdiags.php allows remote authenticated users to inject arbitrary web scripts (CWE-79). Root cause: improper input handling in the affected web page. Impact is XS...

CVE-2018-18880: Improper Neutralization of Input During Web Page Generation

In firmware version MS2.6.9900 of Columbia Weather MicroServer, a networkdiags.php reflected Cross-site scripting XSS vulnerability allows remote authenticated users to inject arbitrary web script...

PT-2019-9660

Name of the Vulnerable Software and Affected Versions Columbia Weather MicroServer version MS 2.6.9900 Description A reflected Cross-site scripting XSS vulnerability in the networkdiags.php file allows remote authenticated users to inject arbitrary web script. Recommendations For version MS...

PT-2019-9658

Name of the Vulnerable Software and Affected Versions Columbia Weather MicroServer version MS 2.6.9900 Description The issue allows an authenticated web user to execute commands directly on the underlying operating system due to unsanitized user input in the networkdiags.php file. Recommendations...

CVE-2018-18879: Improper Control of Generation of Code

In firmware version MS2.6.9900 of Columbia Weather MicroServer, an authenticated web user can pipe commands directly to the underlying operating system as user input is not sanitized in networkdiags.php...

CVE-2018-18878: Improper Input Validation

In firmware version MS2.6.9900 of Columbia Weather MicroServer, the BACnet daemon does not properly validate input, which could allow a remote attacker to send specially crafted packets causing the device to become unavailable...

CVE-2018-18876: Improper Limitation of a Pathname to a Restricted Directory

In firmware version MS2.6.9900 of Columbia Weather MicroServer, a readoutsrd.php directory traversal issue makes it possible to read any file present on the underlying operating system...

CVE-2018-18875: Improper Neutralization of Input During Web Page Generation

In firmware version MS2.6.9900 of Columbia Weather MicroServer, a stored Cross-site scripting XSS vulnerability allows remote authenticated users to inject arbitrary web script via changestationname.php...

CVE-2018-18877: Improper Authentication

In firmware version MS2.6.9900 of Columbia Weather MicroServer, an authenticated web user can access an alternative configuration page configmain.php that allows manipulation of the device...

PT-2019-9656

Name of the Vulnerable Software and Affected Versions Columbia Weather MicroServer version MS 2.6.9900 Description The issue allows an authenticated web user to access an alternative configuration page, specifically the config main.php page, which enables manipulation of the device. Recommendatio...

PT-2019-9657

Name of the Vulnerable Software and Affected Versions Columbia Weather MicroServer version MS 2.6.9900 Description The issue arises from the BACnet daemon's failure to properly validate input. This could allow a remote attacker to send specially crafted packets, potentially causing the device to...

PT-2019-9654

Name of the Vulnerable Software and Affected Versions Columbia Weather MicroServer version MS 2.6.9900 Description A stored Cross-site scripting XSS issue allows remote authenticated users to inject arbitrary web script via the "changestationname.php" endpoint. Recommendations For version MS...

PT-2019-9655

Name of the Vulnerable Software and Affected Versions Columbia Weather MicroServer version MS 2.6.9900 Description A directory traversal issue in the readouts rd.php directory of Columbia Weather MicroServer's firmware allows an attacker to read any file present on the underlying operating system...

This Week in Security News: Phishing Attacks and Ransomware

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about schemes used in phishing and other email-based attacks. Also, learn how ransomware continues to make a significant impact in the...