EUVD-2019-2577

Malware in sbrugna...

CVE-2019-10847

Computrols CBAS 18.0.0 allows Cross-Site Request Forgery...

Design/Logic Flaw

Computrols CBAS 18.0.0 allows Username Enumeration...

Cross site request forgery (csrf)

Computrols CBAS 18.0.0 allows Cross-Site Request Forgery...

CVE-2019-10847

Computrols CBAS 18.0.0 allows Cross-Site Request Forgery...

CVE-2019-10848

Computrols CBAS 18.0.0 allows Username Enumeration...

Default credentials

Computrols CBAS 18.0.0 has Default Credentials...

Code injection

Computrols CBAS 18.0.0 allows unprotected Subversion SVN directory / source code disclosure...

CVE-2019-10846

Computrols CBAS 18.0.0 allows Unauthenticated Reflected Cross-Site Scripting vulnerabilities in the login page and password reset page via the username GET parameter...

CVE-2019-10850

Computrols CBAS 18.0.0 has Default Credentials...

CVE-2019-10849

Computrols CBAS 18.0.0 allows unprotected Subversion SVN directory / source code disclosure...

Authentication flaw

Computrols CBAS 18.0.0 allows Authentication Bypass...

CVE-2019-10851

Computrols CBAS 18.0.0 has hard-coded encryption keys...

Default credentials

Computrols CBAS 18.0.0 mishandles password hashes. The approach is MD5 with a pw prefix, e.g., if the password is admin, it will calculate the MD5 hash of pwadmin and store it in a MySQL database...

CVE-2019-10851

Computrols CBAS 18.0.0 has hard-coded encryption keys...

Sql injection

Computrols CBAS 18.0.0 allows Authenticated Blind SQL Injection via the id GET parameter, as demonstrated by the index.php?m=servers&a=startpulling&id= substring...

Hardcoded credentials

Computrols CBAS 18.0.0 has hard-coded encryption keys...

CVE-2019-10854

Computrols CBAS 18.0.0 allows Authenticated Command Injection...

CVE-2019-10854

CVE-2019-10854 affects Computrols CBAS Web (18.0.0/19.0.0). The vulnerability is described as a command-injection flaw in the json.php endpoint that can allow OS command execution, reported as part of a CBAS Web remote command injection chain. Public material (Exploits/Advisories) documents unaut...

CVE-2019-10855

CVE-2019-10855 affects Computrols CBAS Web (CBAS Web) and is tied to improper password handling. The documented vulnerability is that CBAS 18.0.0 and related versions store passwords by hashing with MD5 prefixed by a password indicator (e.g., pwadmin), meaning plain or weakly hashed passwords are...