91 matches found
PT-2019-12057
Name of the Vulnerable Software and Affected Versions Computrols CBAS version 18.0.0 Description The issue allows authentication bypass. Recommendations For version 18.0.0, update to a newer version that contains a fix for this issue...
PT-2019-12059
Name of the Vulnerable Software and Affected Versions Computrols CBAS version 18.0.0 Description The issue concerns the mishandling of password hashes. Specifically, it uses the MD5 hashing algorithm with a 'pw' prefix. For example, if the password is 'admin', it calculates the MD5 hash of...
PT-2019-12058
Name of the Vulnerable Software and Affected Versions Computrols CBAS version 18.0.0 Description The issue allows for authenticated command injection. Recommendations For version 18.0.0, update to a newer version that contains a fix for this issue...
PT-2019-12055
Name of the Vulnerable Software and Affected Versions Computrols CBAS version 18.0.0 Description The issue concerns hard-coded encryption keys in the software. Recommendations For version 18.0.0, consider changing the hard-coded encryption keys to unique, user-defined keys to mitigate the risk of...
CVE-2019-10846: Improper Neutralization of Input During Web Page Generation
Computrols CBAS 18.0.0 allows Unauthenticated Reflected Cross-Site Scripting vulnerabilities in the login page and password reset page via the username GET parameter...
CVE-2019-10851: Use of Hard-coded Credentials
Computrols CBAS 18.0.0 has hard-coded encryption keys...
CVE-2019-10852: Improper Neutralization of Special Elements used in an SQL Command
Computrols CBAS 18.0.0 allows Authenticated Blind SQL Injection via the id GET parameter, as demonstrated by the index.php?m=servers&a=startpulling&id= substring...
CVE-2019-10853: Undefined Security Weakness
Computrols CBAS 18.0.0 allows Authentication Bypass...
CVE-2019-10855: Inadequate Encryption Strength
Computrols CBAS 18.0.0 mishandles password hashes. The approach is MD5 with a pw prefix, e.g., if the password is admin, it will calculate the MD5 hash of pwadmin and store it in a MySQL database...