CVE-2016-2304

CVE-2016-2304 affects Ecava IntegraXor prior to version 5.0, build 4522. The issue is that the HTTPOnly flag is not set on the session cookie in the web server, enabling a remote attacker to access the cookie via scripts and potentially log in as an administrator. Public sources describe this as ...

CVE-2016-2306

The HMI web server in Ecava IntegraXor before 5.0 build 4522 allows remote attackers to obtain sensitive cleartext information by sniffing the network...

CVE-2016-2302

CVE-2016-2302 affects Ecava IntegraXor web-based HMI (IntegraXor) before version 5.0, build 4522. Root cause: cleartext transmission of sensitive information and related information disclosure via detailed error messages. Impact: remote attacker could obtain sensitive information from the affecte...

CVE-2016-2303

CVE-2016-2303: Ecava IntegraXor before 5.0 build 4522 is vulnerable to CRLF injection in HTTP headers, enabling HTTP response splitting via a crafted URL. Affected product: Ecava IntegraXor HMI web server (pre-5.0 build 4522). Root cause: improper neutralization of CRLF sequences in HTTP header h...

CVE-2016-2301

SQL injection vulnerability in Ecava IntegraXor before 5.0 build 4522 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

CVE-2016-2304

Ecava IntegraXor before 5.0 build 4522 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie...

CVE-2016-2302

Ecava IntegraXor before 5.0 build 4522 allows remote attackers to obtain sensitive information by reading detailed error messages...

Ecava IntegraXor Privilege Bypass Vulnerability

Ecava IntegraXor is a set of Web-based tools for creating and running HMI interfaces for SCADA systems. Ecava IntegraXor fails to properly check for user authorization when processing user access to sensitive web pages, allowing remote attackers to exploit the vulnerability to bypass security...

Ecava IntegraXor SQL Injection Vulnerability

Ecava IntegraXor is a set of Web-based tools for creating and running HMI Human Machine Interface interfaces for SCADA systems from Ecava Malaysia. A SQL injection vulnerability exists in Ecava IntegraXor versions prior to 5.0 build 4522. A remote attacker can exploit the vulnerability to execute...

Ecava IntegraXor Information Disclosure Vulnerability (CNVD-2016-02341)

Ecava IntegraXor is a set of Web-based tools for creating and running HMI interfaces for SCADA systems. An information disclosure vulnerability exists in Ecava IntegraXor prior to version 5.0 build 4522 that stems from the program not setting the HTTPOnly flag in the session cookie. A remote...

Ecava IntegraXor Information Disclosure Vulnerability

Ecava IntegraXor is a set of Web-based tools for creating and running HMI interfaces for SCADA systems. A security vulnerability exists in Ecava IntegraXor that could be exploited by a remote attacker to obtain sensitive log information...

Ecava IntegraXor Cross-Site Scripting Vulnerability (CNVD-2016-02333)

Ecava IntegraXor is a set of Web-based tools for creating and running HMI interfaces for SCADA systems. A cross-site scripting vulnerability in Ecava IntegraXor for HMI operations using SCADA applications allows remote attackers to exploit the vulnerability to inject malicious script or HTML code...

Ecava IntegraXor Transfer Unencrypted Vulnerability

Ecava IntegraXor is a set of Web-based tools for creating and running HMI interfaces for SCADA systems. A transmit unencrypted vulnerability exists in Ecava IntegraXor prior to version 5.0 build 4522, which originates when the HMI web server transmits unencrypted data. A remote attacker could...

Ecava IntegraXor HMI Privilege Bypass Vulnerability

Ecava IntegraXor is a set of Web-based tools for creating and running HMI interfaces for SCADA systems. The Ecava IntegraXor HMI fails to properly process specific elements of input, allowing remote attackers to exploit the vulnerability to bypass security restrictions...

Ecava IntegraXor Remote Code Execution Vulnerability

Ecava IntegraXor is a set of Web-based tools for creating and running HMI interfaces for SCADA systems. Ecava IntegraXor fails to perform input validation. A remote attacker could exploit the vulnerability to execute arbitrary code by sending a specially crafted request...

Ecava IntegraXor Report save SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Ecava IntegraXor. Authentication is not required to exploit this vulnerability. The specific flaw exists in the handling of save report requests. The vulnerability is caused by the lack of input...

Ecava IntegraXor Report summary_opt SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Ecava IntegraXor. Authentication is not required to exploit this vulnerability. The specific flaw exists in the handling of summaryopt report requests. The vulnerability is caused by the lack of...

Ecava IntegraXor Report batchlist SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Ecava IntegraXor. Authentication is not required to exploit this vulnerability. The specific flaw exists in the handling of batchlist report requests. The vulnerability is caused by the lack of inp...

Ecava IntegraXor Report summary SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Ecava IntegraXor. Authentication is not required to exploit this vulnerability. The specific flaw exists in the handling of summary report requests. The vulnerability is caused by the lack of input...

Ecava IntegraXor Report batch SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Ecava IntegraXor. Authentication is not required to exploit this vulnerability. The specific flaw exists in the handling of batch report requests. The vulnerability is caused by the lack of input...