CVE-2021-38403

CVE-2021-38403 affects Delta Electronics DIALink (versions 1.2.4.0 and earlier). The vulnerability is a cross-site scripting flaw where an authenticated attacker can inject arbitrary JavaScript into the supplier parameter of the API maintenance, potentially enabling remote code execution. Connect...

CVE-2021-38422

Delta Electronics DIALink is affected in versions 1.2.4.0 and earlier by CVE-2021-38422, which stores sensitive information in cleartext, potentially granting an attacker extensive access to the application directory and privilege escalation. The CVSS v3 base score is 7.8 (HIGH) with LOCAL attack...

CVE-2021-38422 Delta Electronics DIALink

Delta Electronics DIALink versions 1.2.4.0 and prior stores sensitive information in cleartext, which may allow an attacker to have extensive access to the application directory and escalate privileges...

CVE-2021-38418 Delta Electronics DIALink

Delta Electronics DIALink versions 1.2.4.0 and prior runs by default on HTTP, which may allow an attacker to be positioned between the traffic and perform a machine-in-the-middle attack to access information without authorization...

CVE-2021-38418

Delta Electronics DIALink (versions 1.2.4.0 and earlier) runs by default over HTTP, enabling potential machine-in-the-middle access to sensitive information. The CVE-2021-38418 issue is classified as high risk (CISA says 8.8/3.1) due to cleartext transmission of sensitive data. Affected component...

CVE-2021-38411 Delta Electronics DIALink

Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter deviceName of the API modbusWriter-Reader, which may allow an attacker to remotely execute code...

CVE-2021-38411

CVE-2021-38411 affects Delta Electronics DIALink (versions 1.2.4.0 and prior). The flaw is a Cross‑Site Scripting (XSS) in the API endpoint modbusWriter-Reader, where an authenticated attacker can inject arbitrary JavaScript code into the deviceName parameter, potentially enabling remote code exe...

CVE-2021-38403: Improper Neutralization of Input During Web Page Generation

Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter supplier of the API maintenance, which may allow an attacker to remotely execute code...

CVE-2021-38428: Improper Neutralization of Input During Web Page Generation

Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter name of the API schedule, which may allow an attacker to remotely execute code...

CVE-2021-38407: Improper Neutralization of Input During Web Page Generation

Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter name of the API devices, which may allow an attacker to remotely execute code...

PT-2021-22114

Name of the Vulnerable Software and Affected Versions Delta Electronics DIALink versions 1.2.4.0 and prior Description The issue allows an authenticated attacker to inject arbitrary JavaScript code into the name parameter of the "API devices" endpoint, which may enable remote code execution...

PT-2021-22122

Name of the Vulnerable Software and Affected Versions Delta Electronics DIALink versions 1.2.4.0 and prior Description The issue allows an authenticated attacker to inject arbitrary JavaScript code into the name parameter of the "API schedule" endpoint, which may enable remote code execution...

CVE-2021-38422: Cleartext Storage of Sensitive Information

Delta Electronics DIALink versions 1.2.4.0 and prior stores sensitive information in cleartext, which may allow an attacker to have extensive access to the application directory and escalate privileges...

PT-2021-22121

Name of the Vulnerable Software and Affected Versions Delta Electronics DIALink versions 1.2.4.0 and prior Description The issue allows an attacker to inject formulas into the tag data through the tag interface. These formulas can then be executed when the data is opened with a spreadsheet...

PT-2021-22161

Name of the Vulnerable Software and Affected Versions Delta Electronics DIALink versions 1.2.4.0 and prior Description The issue allows an authenticated attacker to inject arbitrary JavaScript code into the comment parameter of the API events, which may enable remote code execution. Recommendatio...

CVE-2021-38411: Improper Neutralization of Input During Web Page Generation

Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter deviceName of the API modbusWriter-Reader, which may allow an attacker to remotely execute code...

CVE-2021-38418: Cleartext Transmission of Sensitive Information

Delta Electronics DIALink versions 1.2.4.0 and prior runs by default on HTTP, which may allow an attacker to be positioned between the traffic and perform a machine-in-the-middle attack to access information without authorization...

CVE-2021-38416: Uncontrolled Search Path Element

Delta Electronics DIALink versions 1.2.4.0 and prior insecurely loads libraries, which may allow an attacker to use DLL hijacking and takeover the system where the software is installed...

CVE-2021-38488: Improper Neutralization of Input During Web Page Generation

Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter comment of the API events, which may allow an attacker to remotely execute code...

CVE-2021-38424: Improper Neutralization of Formula Elements in a CSV File

The tag interface of Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to an attacker injecting formulas into the tag data. Those formulas may then be executed when it is opened with a spreadsheet application...