CVE-2022-30317

Summary (CVE-2022-30317, Honeywell Experion LX) : The vulnerability arises from the EpicMo protocol (55565/TCP) used by the Honeywell Experion LX DCS for device diagnostics/maintenance, which exposes unauthenticated functionality. Affected products include Experion LX up to 2022-05-06. The issue ...

CVE-2022-30317: Missing Authentication for Critical Function

Honeywell Experion LX through 2022-05-06 has Missing Authentication for a Critical Function. According to FSCT-2022-0055, there is a Honeywell Experion LX Control Data Access CDA EpicMo protocol with unauthenticated functionality issue. The affected components are characterized as: Honeywell...

cda-intercorp.com Cross Site Scripting vulnerability OBB-2626179

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

cda-intercorp.com Cross Site Scripting vulnerability OBB-2622956

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

S-CMS enterprise website building system backend C_da*** parameter exists SQL injection vulnerability

S-CMS enterprise station building system is Zibo Shining Network Technology Co., Ltd. developed a specialized enterprise station building solutions for the product. There is a SQL injection vulnerability in the Cda parameter in the background of S-CMS enterprise website building system. Attackers...

cda-hd.pl XSS vulnerability

Open Bug Bounty ID: OBB-448814 Description| Value ---|--- Affected Website:| cda-hd.pl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2017-10418

Vulnerability in the PeopleSoft Enterprise PT PeopleTools component of Oracle PeopleSoft Products subcomponent: PeopleSoft CDA. The supported version that is affected is 8.56. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft...

Code injection

Vulnerability in the PeopleSoft Enterprise PT PeopleTools component of Oracle PeopleSoft Products subcomponent: PeopleSoft CDA. The supported version that is affected is 8.56. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft...

CVE-2017-10418: Undefined Security Weakness

Vulnerability in the PeopleSoft Enterprise PT PeopleTools component of Oracle PeopleSoft Products subcomponent: PeopleSoft CDA. The supported version that is affected is 8.56. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft...

CVE-2016-1986

CVE-2016-1986 affects HP Continuous Delivery Automation (CDA) 1.30. A deserialization vulnerability allows remote attackers to execute arbitrary commands via a crafted Java object, related to the Apache Commons Collections library. The NVD entry reports a high/critical impact (CVSS2: 7.5 HIGH; CV...

CVE-2016-1986: Improper Control of Generation of Code

HP Continuous Delivery Automation CDA 1.30 allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library...

CVE-2014-3861

Cross-site scripting XSS vulnerability in CDA.xsl in HL7 C-CDA 1.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted reference element within a nonXMLBody element...

CVE-2014-3862

CDA.xsl in HL7 C-CDA 1.1 and earlier allows remote attackers to discover potentially sensitive URLs via a crafted reference element that triggers creation of an IMG element with an arbitrary URL in its SRC attribute, leading to information disclosure in a Referer log...

Information disclosure

CDA.xsl in HL7 C-CDA 1.1 and earlier allows remote attackers to discover potentially sensitive URLs via a crafted reference element that triggers creation of an IMG element with an arbitrary URL in its SRC attribute, leading to information disclosure in a Referer log...

Design/Logic Flaw

CDA.xsl in HL7 C-CDA 1.1 and earlier does not anticipate the possibility of invalid C-CDA documents with crafted XML attributes, which allows remote attackers to conduct XSS attacks via a document containing a table that is improperly handled during unrestricted xsl:copy operations...

Cross site scripting

Cross-site scripting XSS vulnerability in CDA.xsl in HL7 C-CDA 1.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted reference element within a nonXMLBody element...

CVE-2014-3862

CVE-2014-3862 affects HL7 C-CDA 1.1 and earlier. A crafted reference element can cause the stylesheet to create an IMG element with an arbitrary URL in its SRC attribute, leading to information disclosure in a Referer log. The description covers the vulnerability vector and potential disclosure b...

CVE-2014-3861

CVE-2014-3861 is an XSS vulnerability in CDA.xsl affecting HL7 C-CDA 1.1 and earlier. The issue allows remote attackers to inject arbitrary web script or HTML via a crafted reference element within a nonXMLBody element. The available sources describe the flaw, its location, and impact (XSS) but d...

CVE-2014-3862

CDA.xsl in HL7 C-CDA 1.1 and earlier allows remote attackers to discover potentially sensitive URLs via a crafted reference element that triggers creation of an IMG element with an arbitrary URL in its SRC attribute, leading to information disclosure in a Referer log...

CVE-2014-5452

CDA.xsl in HL7 C-CDA 1.1 and earlier does not anticipate the possibility of invalid C-CDA documents with crafted XML attributes, which allows remote attackers to conduct XSS attacks via a document containing a table that is improperly handled during unrestricted xsl:copy operations...