SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the zkClusterKey parameter, which is passed unescaped to an SQL query in executorCount. An attacker can execute arbitrary SQL commands by via the /console/dashboard/executorCount?zkClusterKey endpoint. Remediation Ther...

PT-2024-28947 · Rockwell Automation · Pavilion8

Name of the Vulnerable Software and Affected Versions: Rockwell Automation Pavilion8 version 5.20 Description: A vulnerability exists in the affected product due to a lack of encryption of sensitive information. This results in data being sent between the Console and the Dashboard without...