Carel pCOWeb <B1.2.4 - Cross-Site Scripting

Carel pCOWeb prior to B1.2.4 is vulnerable to stored cross-site scripting, as demonstrated by the config/pwsnmp.html "System contact" field. id: CVE-2019-11370 info: name: Carel pCOWeb B1.2.4 - Cross-Site Scripting author: arafatansari severity: medium description: | Carel pCOWeb prior to B1.2.4 ...

CAREL Boss Mini <= 1.4.0 - Local File Inclusion

Boss Mini 1.4.0 Build 6221 contains a file inclusion caused by manipulation of the 'path' argument in boss/servlet/document, letting remote attackers include arbitrary files, exploit requires remote access. id: CVE-2023-3643 info: name: CAREL Boss Mini = 1.4.0 - Local File Inclusion author:...

Carel pCOWeb HVAC BACnet Gateway 2.1.0 - Path Traversal

Carel pCOWeb HVAC BACnet Gateway 2.1.0 contains an unauthenticated arbitrary file disclosure caused by improper verification of the 'file' GET parameter in logdownload.cgi, letting attackers disclose sensitive files via directory traversal, exploit requires no authentication. id: CVE-2022-37122...

CVE-2022-37122-Exploit

CVE-2022-37122 경로 탐색 스캐너 Carel pCOWeb logdownload.cgi 경로 탐색 취약점CVE-2022-37122을 감지하기 위한 강력하고 기능이 풍부한 스캐너입니다. 보안 연구원과 공인된 침투 테스터를 위해 설계되었습니다. 🚨 중요 공지 교육 및 버그 바운티 전용 이 도구는 다음 용도로 사용됩니다: 교육 목적 공인된 보안 테스트 명시적 허가를 받은 버그 바운티 헌팅 절대 자신이 소유하지 않거나 명시적인 서면 허가 없이 테스트할 시스템에 이 도구를 사용하지 마십시오. ✨ 기능 🎯 안전한 기본 페이로드 ...

CVE-2022-37122

Carel pCOWeb HVAC BACnet Gateway 2.1.0, Firmware: A2.1.0 - B2.1.0, Application Software: 2.15.4A Software v16 13020200 suffers from an unauthenticated arbitrary file disclosure vulnerability. Input passed through the 'file' GET parameter through the 'logdownload.cgi' Bash script is not properly...

📄 CAREL Boss / Boss Mini 1.4.0 Path Traversal

Proof of concept for an older vulnerability in 2023 where CAREL Boss and Boss Mini version 1.4.0 suffer from a path traversal vulnerability. ============================================================================================================================================= | Title : Boss...

Exploit for Path Traversal in Carel Pcoweb_Card_Firmware

CVE-2022-37122 Path Traversal Scanner !Bannerhttps://raw.g...

EUVD-2019-5004

Malware in sbrugna...

EUVD-2019-18858

Malware in sbrugna...

EUVD-2019-3047

Malware in sbrugna...

EUVD-2011-3450

Malware in sbrugna...

EUVD-2022-37733

Malicious code in bioql PyPI...

CVE-2022-34827

Carel Boss Mini 1.5.0 has Improper Access Control...

CVE-2019-11369

An issue was discovered in Carel pCOWeb prior to B1.2.4. In /config/pwchangeusers.html the device stores cleartext passwords, which may allow sensitive information to be read by someone with access to the device...

CVE-2019-13549

Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 – B1.2.4. The authentication mechanism on affected systems does not provide a sufficient level of protection against unauthorized configuration changes. Primary operations, namely turning the cooling unit on an...

CVE-2019-11370

Stored XSS was discovered in Carel pCOWeb prior to B1.2.4, as demonstrated by the config/pwsnmp.html "System contact" field...

CAREL Boss-Mini

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 9.3 ATTENTION : Exploitable remotely/low attack complexity/public exploits are available Vendor : CAREL Equipment : Boss-Mini Vulnerability : Path Traversal 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to...

VulnCheck KEV: CVE-2019-11370

Stored XSS was discovered in Carel pCOWeb prior to B1.2.4, as demonstrated by the config/pwsnmp.html "System contact" field...

Carel Boss Mini 安全漏洞

Carel Boss Mini is a locally supervised solution for small, medium and large systems from Carel Italia. A security vulnerability exists in Carel Boss Mini version 1.4.0 Build 6221, which stems from the parameter path of the file boss/servlet/document can lead to file inclusion...

Carel pCOWeb 安全漏洞

Carel pCOWeb is a programmable control card. A security vulnerability exists in Carel pCOWeb card BIOS version v6.27, BOOT version v5.00, and web version v2.2. An attacker could use this vulnerability to gain access to the configuration and service interfaces...