EUVD-2012-0237

Malware in sbrugna...

Eaton Lighting Systems EG2 Web Control Authentication Bypass Vulnerabilities

OVERVIEW This advisory was originally posted to the US-CERT secure Portal library on March 1, 2016, and is being released to the NCCIC/ICS-CERT web site. Independent researcher Maxim Rupp has identified vulnerabilities in Eaton Lighting Systems’ EG2 Web Control application. Eaton Lighting Systems...

CVE-2016-2272

Eaton Lighting EG2 Web Control 4.04P and earlier allows remote attackers to have an unspecified impact via a modified cookie...

CVE-2016-2272

Eaton Lighting EG2 Web Control 4.04P and earlier allows remote attackers to have an unspecified impact via a modified cookie...

CVE-2016-0871

Eaton Lighting EG2 Web Control 4.04P and earlier allows remote attackers to read the configuration file, and consequently discover credentials, via a direct request...

Design/Logic Flaw

Eaton Lighting EG2 Web Control 4.04P and earlier allows remote attackers to read the configuration file, and consequently discover credentials, via a direct request...

Code injection

Eaton Lighting EG2 Web Control 4.04P and earlier allows remote attackers to have an unspecified impact via a modified cookie...

CVE-2016-2272

CVE-2016-2272 affects Eaton Lighting EG2 Web Control versions 4.04P and earlier. The ICS advisory notes an authentication bypass/root cause: reliance on cookies without proper validation/integrity, enabling a remote attacker to alter browser cookies and perform administrative actions that could c...

CVE-2016-0871

The CVE-2016-0871 issue affects Eaton Lighting EG2 Web Control (V4.04P and prior). Root causes include CWE-565: Reliance on Cookies without Validation, and CWE-312: Cleartext Storage of Sensitive Information. A remote attacker could read configuration files and view credentials via a direct reque...

Eaton Lighting Systems EG2 Web Control Authentication Bypass Vulnerability (CNVD-2016-02006)

The Eaton Lighting Systems EG2 Web Control is a controller product from Eaton Lighting Systems USA for Internet and Wi-Fi LAN connections to the iLumin network. An authentication bypass vulnerability exists in Eaton Lighting Systems EG2 Web Control version 4.04P and earlier. A remote attacker cou...

Sql injection

Multiple SQL injection vulnerabilities in IBM Tivoli Provisioning Manager Express for Software Distribution 4.1.1 allow remote attackers to execute arbitrary SQL commands via 1 a SOAP message to the Printer.getPrinterAgentKey function in the SoapServlet servlet, 2 the User.updateUserValue functio...