Session fixation

An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. An attacker can establish a new user session, without invalidating any existing session identifier, which gives the opportunity to steal authenticated session...

CVE-2017-5139

An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. Any user is able to disclose a password by accessing a specific URL, because of Plaintext Storage of a Password...

CVE-2017-5141

An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. An attacker can establish a new user session, without invalidating any existing session identifier, which gives the opportunity to steal authenticated session...

CVE-2017-5139: Insufficiently Protected Credentials

An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. Any user is able to disclose a password by accessing a specific URL, because of Plaintext Storage of a Password...

CVE-2017-5143: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. A user without authenticating can make a directory traversal attack by accessing a specific URL...

CVE-2017-5142: Improper Privilege Management

An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. A user with low privileges is able to open and change the parameters by accessing a specific URL because of Improper Privilege Management...

CVE-2017-5140: Insufficiently Protected Credentials

An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. Password is stored in clear text...

CVE-2017-5141: Session Fixation

An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. An attacker can establish a new user session, without invalidating any existing session identifier, which gives the opportunity to steal authenticated session...

PT-2017-16337

Name of the Vulnerable Software and Affected Versions Honeywell XL Web II controller XL1000C500 versions XLWebExe-2-01-00 and prior Honeywell XLWeb 500 versions XLWebExe-1-02-08 and prior Description An issue allows an attacker to establish a new user session without invalidating any existing...

PT-2017-16335

Name of the Vulnerable Software and Affected Versions Honeywell XL Web II controller XL1000C500 versions XLWebExe-2-01-00 and prior Honeywell XLWeb 500 versions XLWebExe-1-02-08 and prior Description The issue allows any user to disclose a password by accessing a specific URL due to plaintext...

PT-2017-16338

Name of the Vulnerable Software and Affected Versions Honeywell XL Web II controller XL1000C500 versions XLWebExe-2-01-00 and prior Honeywell XLWeb 500 versions XLWebExe-1-02-08 and prior Description The issue is related to improper privilege management, allowing a user with low privileges to...

PT-2017-16336

Name of the Vulnerable Software and Affected Versions Honeywell XL Web II controller versions XL1000C500 XLWebExe-2-01-00 and prior Honeywell XLWeb 500 versions XLWebExe-1-02-08 and prior Description An issue was discovered where the password is stored in clear text. Recommendations For Honeywell...

Honeywell XL Web II Controller Session Fixation Vulnerability

Honeywell XL Web Controller is a web-based SCADA system. A session fixation vulnerability exists in Honeywell XL Web II Controller, which can be exploited by an attacker to establish a new user session and steal authenticated sessions...

Honeywell XL Web II Controller plaintext stored password vulnerability (CNVD-2017-00914)

Honeywell XL Web Controller is a web-based SCADA system. A plaintext stored password vulnerability exists in Honeywell XL Web II Controller, which can be exploited by an attacker to obtain a user's password...