Delta Controls enteliTOUCH 3.40.3935 Cross Site Request Forgery

enteliTouch CSRF CSRF Add User: input type="hidden" name="Username" va...

Delta Controls enteliTOUCH 3.40.3935 Cookie User Password Disclosure Vulnerability

Delta Controls enteliTOUCH 3.40.3935 Cookie User Password Disclosure Vendor: Delta Controls Inc. Product web page: https://www.deltacontrols.com Affected version: 3.40.3935 3.40.3706 3.33.4005 Summary: enteliTOUCH - Touchscreen Building Controller. Get instant access to the heart of your BAS. The...

Delta Controls enteliTOUCH 3.40.3935 Cross Site Request Forgery Vulnerability

enteliTouch CSRF CSRF Add User: input type=...

Delta Controls enteliTOUCH 3.40.3935 Cross-Site Request Forgery (CSRF)

Summary enteliTOUCH - Touchscreen Building Controller. Get instant access to the heart of your BAS. The enteliTOUCH has a 7-inch, high-resolution display that serves as an interface to your building. Use it as your primary interface for smaller facilities or as an on-the-spot access point for...

idealhealthinc.com Cross Site Scripting vulnerability OBB-2498292

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

zbzcms cross-site scripting vulnerability

zbzcms Station Helper CMS is a content management website of China Station Helper CMS zbzcms Inc. zbzcms version 1.0 has a cross-site scripting vulnerability, no detailed vulnerability details are currently available...

CVE-2021-43442

A Logic Flaw vulnerability exists in i3 International Inc Annexxus Camera V5.2.0 build 150317 Ax46, V5.0.9 build 151106 Ax68, and V5.0.9 build 150615 Ax78 due to a failure to allow the creation of more than one administrator account; however, this can be bypassed by parameter maniulation using PU...

CVE-2021-37293

A Directory Traversal vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 via the page GET parameter in index.php...

CVE-2021-37291

An SQL Injection vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 ivia the inputid POST parameter in index.php...

Sql injection

An SQL Injection vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 ivia the inputid POST parameter in index.php...

Design/Logic Flaw

A Logic Flaw vulnerability exists in i3 International Inc Annexxus Camera V5.2.0 build 150317 Ax46, V5.0.9 build 151106 Ax68, and V5.0.9 build 150615 Ax78 due to a failure to allow the creation of more than one administrator account; however, this can be bypassed by parameter maniulation using PU...

Directory traversal

A Directory Traversal vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 via the page GET parameter in index.php...

CVE-2021-43442

A Logic Flaw vulnerability exists in i3 International Inc Annexxus Camera V5.2.0 build 150317 Ax46, V5.0.9 build 151106 Ax68, and V5.0.9 build 150615 Ax78 due to a failure to allow the creation of more than one administrator account; however, this can be bypassed by parameter maniulation using PU...

CVE-2021-43442

CVE-2021-43442 concerns a logic flaw in i3 International Annexxus Cameras (Ax-n 5.2.0 Ax46; 5.0.9 Ax68; 5.0.9 Ax78) where the system blocks multiple admin accounts but can be bypassed via parameter manipulation using PUT/DELETE and by calling the UserPermission endpoint with the created account’s...

CVE-2021-37292

An Access Control vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 due to an undocumented backdoor account. A malicious user can log in using the backdor account with admin highest privileges and obtain system control...

CVE-2021-37292

CVE-2021-37292 affects KevinLAB Building Energy Management System 4ST BEMS 1.0.0. The NUCLEI template confirms an undocumented backdoor account with admin-level privileges enables login and full remote control, bypassing authentication. Impact is full system control and remote administration. Mit...

CVE-2021-37293

CVE-2021-37293 affects KevinLAB Building Energy Management System 4ST BEMS 1.0.0. A directory traversal/file path disclosure vulnerability exists in index.php where the input passed via the page GET parameter is used to include files. The ZSL report indicates an authenticated file disclosure path...

CVE-2021-37293

A Directory Traversal vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 via the page GET parameter in index.php...

CVE-2021-37291

CVE-2021-37291 : KevinLAB BEMS 1.0.0 is affected by an SQL injection in the input_id POST parameter (in /http/index.php). The vulnerability arises from unsanitized input used in SQL queries, enabling unauthenticated attackers to read/modify data and potentially perform admin actions. The NUCLEI t...

CVE-2021-37291

An SQL Injection vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 ivia the inputid POST parameter in index.php...