95 matches found
CVE-2019-10848
Computrols CBAS 18.0.0 allows Username Enumeration...
CVE-2019-10847
Computrols CBAS 18.0.0 allows Cross-Site Request Forgery...
Cross site request forgery (csrf)
Computrols CBAS 18.0.0 allows Cross-Site Request Forgery...
Design/Logic Flaw
Computrols CBAS 18.0.0 allows Username Enumeration...
CVE-2019-10847
CVE-2019-10847 affects Computrols CBAS Web (CSRF). Documents show a CSRF vulnerability in CBAS Web, notably in version 18.0.0 (and affected earlier versions) that can allow unauthorized actions such as adding a Super Admin via forged requests. Public advisories indicate remote exploitation is pos...
CVE-2019-10847
Computrols CBAS 18.0.0 allows Cross-Site Request Forgery...
CVE-2019-10848
Computrols CBAS 18.0.0 allows Username Enumeration...
CVE-2019-10848
CVE-2019-10848 affects Computrols CBAS Web (CBAS Web) versions around 18.x/19.x, where the Information Exposure Through Discrepancy (username enumeration) vulnerability exists in CBAS Web prior to certain fixes. Public sources (NVD, Red Hat advisories, Exploit-DB/PacketStorm) document that CBAS W...
Computrols CBAS Web Cross-Site Request Forgery Vulnerability (CNVD-2019-15903)
Computrols CBAS is a building automation system from Computrols USA. A cross-site request forgery vulnerability in Computrols CBAS version 18.0.0 can be exploited by an attacker to send an unintended request to a server via an affected client...
Computrols CBAS Web Cross-Site Request Forgery Vulnerability
Computrols CBAS is a building automation system from Computrols USA. A cross-site request forgery vulnerability exists in Computrols CBAS, which can be exploited by an attacker to send unintended requests to a server via an affected client...
CVE-2019-10846
Computrols CBAS 18.0.0 allows Unauthenticated Reflected Cross-Site Scripting vulnerabilities in the login page and password reset page via the username GET parameter...
Code injection
Computrols CBAS 18.0.0 allows unprotected Subversion SVN directory / source code disclosure...
CVE-2019-10850
Computrols CBAS 18.0.0 has Default Credentials...
CVE-2019-10849
Computrols CBAS 18.0.0 allows unprotected Subversion SVN directory / source code disclosure...
CVE-2019-10849
Computrols CBAS 18.0.0 allows unprotected Subversion SVN directory / source code disclosure...
Cross site scripting
Computrols CBAS 18.0.0 allows Unauthenticated Reflected Cross-Site Scripting vulnerabilities in the login page and password reset page via the username GET parameter...
Default credentials
Computrols CBAS 18.0.0 has Default Credentials...
CVE-2019-10850
Computrols CBAS 18.0.0 has Default Credentials...
CVE-2019-10855
Computrols CBAS 18.0.0 mishandles password hashes. The approach is MD5 with a pw prefix, e.g., if the password is admin, it will calculate the MD5 hash of pwadmin and store it in a MySQL database...