CVE-2019-10846

CVE-2019-10846 affects Computrols CBAS Web (versions prior to fixed 19.0.1/18.0.1 etc.). It describes an Unauthenticated Reflected Cross-Site Scripting vulnerability in the login and password-reset pages via the username GET parameter. Impact per sources is client-side script execution in a user’...

CVE-2019-10849

Computrols CBAS 18.0.0 allows unprotected Subversion SVN directory / source code disclosure...

CVE-2019-10849

CBAS Web (Computrols CBAS) 19.0.0 is affected by an information-disclosure vulnerability due to an unprotected Subversion/SVN directory that can disclose the firmware source code. The Red Hat advisory and exploit reports confirm the issue affects CBAS Web and maps to CVE-2019-10849, with an impac...

CVE-2019-10850

Computrols CBAS 18.0.0 has Default Credentials...

CVE-2019-10850

CVE-2019-10850 involves Computrols CBAS 18.0.0 with default credentials. The trusted-identity issue allows unauthenticated access (PR:N, UI:N) over network, yielding high confidentiality, integrity, and availability impact per NVD metrics (CVSS v3: 9.8). Reports in CNVD describe a building-automa...

CVE-2019-10851

CVE-2019-10851 affects Computrols CBAS Web; vulnerability stems from hard-coded encryption keys used to decrypt database backups in CBAS Web scripts. An authenticated attacker could access the device’s full database and discover sensitive information. Mitigations referenced in multiple advisories...

CVE-2019-10851

Computrols CBAS 18.0.0 has hard-coded encryption keys...

CVE-2019-10852

Computrols CBAS 18.0.0 allows Authenticated Blind SQL Injection via the id GET parameter, as demonstrated by the index.php?m=servers&a=startpulling&id= substring...

CVE-2019-10852

CVE-2019-10852 affects Computrols CBAS Web (CBAS Web) with an authenticated SQL injection in the id GET parameter of index.php?m=servers&a=start_pulling&id=. The vulnerability arises from improper input validation in the SQL construction, enabling arbitrary SQL commands with partial confidentiali...

CVE-2019-10853

Computrols CBAS 18.0.0 allows Authentication Bypass...

CVE-2019-10853

CVE-2019-10853 affects Computrols CBAS Web (CBAS Web) and causes an Authentication Bypass via an alternate path/channel in the auth module. Affected software includes CBAS Web versions around 18.0.x and 19.0.x (per Red Hat, NCCIC ICS-CERT, CVE listings). The CVE is rated high (NVD CVSSv3 base sco...

CVE-2019-10854

Computrols CBAS 18.0.0 allows Authenticated Command Injection...

CVE-2019-10854

CVE-2019-10854 affects Computrols CBAS Web (18.0.0/19.0.0). The vulnerability is described as a command-injection flaw in the json.php endpoint that can allow OS command execution, reported as part of a CBAS Web remote command injection chain. Public material (Exploits/Advisories) documents unaut...

CVE-2019-10855

Computrols CBAS 18.0.0 mishandles password hashes. The approach is MD5 with a pw prefix, e.g., if the password is admin, it will calculate the MD5 hash of pwadmin and store it in a MySQL database...

CVE-2019-10855

CVE-2019-10855 affects Computrols CBAS Web (CBAS Web) and is tied to improper password handling. The documented vulnerability is that CBAS 18.0.0 and related versions store passwords by hashing with MD5 prefixed by a password indicator (e.g., pwadmin), meaning plain or weakly hashed passwords are...

CVE-2019-10846: Improper Neutralization of Input During Web Page Generation

Computrols CBAS 18.0.0 allows Unauthenticated Reflected Cross-Site Scripting vulnerabilities in the login page and password reset page via the username GET parameter...

CVE-2019-10852: Improper Neutralization of Special Elements used in an SQL Command

Computrols CBAS 18.0.0 allows Authenticated Blind SQL Injection via the id GET parameter, as demonstrated by the index.php?m=servers&a=startpulling&id= substring...

PT-2019-12054

Name of the Vulnerable Software and Affected Versions Computrols CBAS version 18.0.0 Description The issue is related to default credentials in the software. Recommendations For Computrols CBAS version 18.0.0, change the default credentials to strong, unique passwords to prevent unauthorized acce...

PT-2019-12056

Name of the Vulnerable Software and Affected Versions Computrols CBAS version 18.0.0 Description The issue allows authenticated blind SQL injection via the id GET parameter in the "index.php?m=servers&a=start pulling&id=" endpoint. This can be exploited as demonstrated by injecting a substring in...

PT-2019-12055

Name of the Vulnerable Software and Affected Versions Computrols CBAS version 18.0.0 Description The issue concerns hard-coded encryption keys in the software. Recommendations For version 18.0.0, consider changing the hard-coded encryption keys to unique, user-defined keys to mitigate the risk of...