PT-2021-22117

Name of the Vulnerable Software and Affected Versions Delta Electronics DIALink versions 1.2.4.0 and prior Description The issue allows an attacker to potentially use DLL hijacking and takeover the system where the software is installed due to insecure library loading. Recommendations For Delta...

CVE-2021-38420: Uncontrolled Search Path Element

Delta Electronics DIALink versions 1.2.4.0 and prior default permissions give extensive permissions to low-privileged user accounts, which may allow an attacker to modify the installation directory and upload malicious files...

PT-2021-22118

Name of the Vulnerable Software and Affected Versions Delta Electronics DIALink versions 1.2.4.0 and prior Description The issue allows an attacker to perform a machine-in-the-middle attack, accessing information without authorization because the software runs by default on HTTP. This enables the...

PT-2021-22120

Name of the Vulnerable Software and Affected Versions Delta Electronics DIALink versions 1.2.4.0 and prior Description The issue allows an attacker to have extensive access to the application directory and escalate privileges due to sensitive information being stored in cleartext. Recommendations...

PT-2021-22115

Name of the Vulnerable Software and Affected Versions Delta Electronics DIALink versions 1.2.4.0 and prior Description The issue allows an authenticated attacker to inject arbitrary JavaScript code into the deviceName parameter of the "modbusWriter-Reader" API, potentially enabling remote code...

PT-2021-22113

Name of the Vulnerable Software and Affected Versions Delta Electronics DIALink versions 1.2.4.0 and prior Description The issue allows an authenticated attacker to inject arbitrary JavaScript code into the supplier parameter of the API maintenance, potentially enabling remote code execution...

PT-2021-22119

Name of the Vulnerable Software and Affected Versions Delta Electronics DIALink versions 1.2.4.0 and prior Description The issue concerns default permissions that give extensive access to low-privileged user accounts. This may allow an attacker to modify the installation directory and upload...

Sensormatic Electronics VideoEdge

1. EXECUTIVE SUMMARY CVSS v3 6.1 ATTENTION: Exploitable remotely/low attack complexity Vendor: Sensormatic Electronics, LLC, a subsidiary of Johnson Controls, Inc. Equipment: VideoEdge Vulnerability: Cross-site Scripting 2. RISK EVALUATION Successful exploitation of this vulnerability could allow...

Sensormatic Electronics victor

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Sensormatic Electronics, LLC, a subsidiary of Johnson Controls, Inc. Equipment: victor Vulnerability: Use of Hard-coded Credentials 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an...

DIALink cross-site scripting vulnerability (CNVD-2021-84840)

DIALink is an equipment networking platform from Delta Electronics that effectively manages CNC machines and PLC-controlled machines, collects on-site equipment data and connects it to the upper management platform through a unified interface, and at the same time provides visual information...

DIALink cross-site scripting vulnerability

DIALink is an equipment networking platform from Delta Electronics that effectively manages CNC machines and PLC-controlled machines, collects on-site equipment data and connects it to the upper management platform through a unified interface, and at the same time provides visual information...

DIALink Incorrect Default Permissions Vulnerability

DIALink is an equipment networking platform from Delta Electronics that effectively manages CNC machines and PLC-controlled machines, collects on-site equipment data and connects it to the upper management platform through a unified interface, and at the same time provides visual information...

DIALink Sensitive Information Explicit Transfer Vulnerability

DIALink is an equipment networking platform from Delta Electronics that effectively manages CNC machines and PLC-controlled machines, collects on-site equipment data and connects it to the upper management platform through a unified interface, and at the same time provides visual information...

Unspecified vulnerability in DIALink (CNVD-2021-84834)

DIALink is an equipment networking platform from Delta Electronics that effectively manages CNC machines and PLC-controlled machines, collects on-site equipment data and connects it to the upper management platform through a unified interface, and at the same time provides visual information...

DIALink cross-site scripting vulnerability (CNVD-2021-84841)

DIALink is an equipment networking platform from Delta Electronics that effectively manages CNC machines and PLC-controlled machines, collects on-site equipment data and connects it to the upper management platform through a unified interface, and at the same time provides visual information...

CVE-2021-38411

Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter deviceName of the API modbusWriter-Reader, which may allow an attacker to remotely execute code...

CVE-2021-38422

Delta Electronics DIALink versions 1.2.4.0 and prior stores sensitive information in cleartext, which may allow an attacker to have extensive access to the application directory and escalate privileges...

CVE-2021-38418

Delta Electronics DIALink versions 1.2.4.0 and prior runs by default on HTTP, which may allow an attacker to be positioned between the traffic and perform a machine-in-the-middle attack to access information without authorization...

CVE-2021-38407

Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter name of the API devices, which may allow an attacker to remotely execute code...

CVE-2021-38428

Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter name of the API schedule, which may allow an attacker to remotely execute code...