Design/Logic Flaw

Infinite Automation Mango Automation 2.5.x and 2.6.x through 2.6.0 build 430 allows remote authenticated users to execute arbitrary OS commands via unspecified vectors...

CVE-2015-7904

Unrestricted file upload vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote authenticated users to execute arbitrary JSP code via vectors involving an upload of an image file...

CVE-2015-6493

Cross-site request forgery CSRF vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x through 2.6.0 build 430 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors...

CVE-2015-7902

Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 provides different error messages for failed login attempts in unspecified circumstances, which allows remote attackers to obtain sensitive information via a series of requests...

CVE-2015-7901

Infinite Automation Mango Automation versions 2.5.x–2.6.0 beta (builds prior to 430) contain an OS command injection vulnerability that can be exploited by an authenticated remote user to execute arbitrary commands. Affected component/issue is demonstrated by public exploit references (e.g., Expl...

CVE-2015-7904

CVE-2015-7904 affects Mango Automation by Infinite Automation Systems. An authenticated remote user can trigger arbitrary JSP code execution due to improper verification of uploaded image files, allowing unrestricted file upload in Mango Automation 2.5.x and 2.6.x prior to 2.6.0 build 430. Public...

CVE-2015-7903

Mango Automation (Infinite Automation Systems) is affected by CVE-2015-7903: an SQL injection vulnerability in Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 that allows an authenticated remote user to execute arbitrary SQL commands via unspecified vectors. Public discussions indicate th...

CVE-2015-7902

The CVE-2015-7902 entry relates to Mango Automation (Infinite Automation Systems) versions 2.5.x and 2.6.x before 2.6.0 build 430, where login error handling exposes distinct error messages that can lead to information disclosure via sequences of requests. The vulnerability allows remote attacker...

CVE-2015-7903

SQL injection vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-7901

Infinite Automation Mango Automation 2.5.x and 2.6.x through 2.6.0 build 430 allows remote authenticated users to execute arbitrary OS commands via unspecified vectors...

CVE-2015-6494

Cross-site scripting XSS vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-6493

CVE-2015-6493 affects Infinite Automation Mango Automation versions 2.5.x through 2.6.x (up to 2.6.0 build 430). It is a Cross-Site Request Forgery (CSRF) vulnerability that can allow an authenticated remote attacker to hijack the victim’s session, with unspecified vectors. Public exploitation ev...

CVE-2015-7900

Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote attackers to obtain sensitive debugging information by entering a crafted URL to trigger an exception, and then visiting a certain status page...

CVE-2015-7904

Unrestricted file upload vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote authenticated users to execute arbitrary JSP code via vectors involving an upload of an image file...

CVE-2015-6494

Summary: CVE-2015-6494 is a cross-site scripting (XSS) vulnerability in Infinite Automation Mango Automation, affecting version series 2.5.x and 2.6.x before 2.6.0 build 430. An authenticated remote user could inject arbitrary web script/HTML via unspecified vectors. The issue was publicized with...

Mango Automation Version Detection

Detects the installed version of Mango Automation. This script sends an HTTP GET request and tries to get the version from the response. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

Mango Automation Multiple Vulnerabilities

Mango Automation is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Mango Automation 2.6.0 Command Execution Cross Site Request Forgery

Mango Automation 2.6.0 CSRF Arbitrary Command Execution Exploit Vendor: Infinite Automation Systems Inc. Product web page: http://www.infiniteautomation.com/ Affected version: 2.5.2 and 2.6.0 beta build 327 Summary: Mango Automation is a flexible SCADA, HMI And Automation software application tha...

Mango Automation 2.6.0 - Multiple Vulnerabilities

Exploit for jsp platform in category web applications Mango Automation 2.6.0 CSRF File Upload And Arbitrary JSP Code Execution Vendor: Infinite Automation Systems Inc. Product web page: http://www.infiniteautomation.com/ Affected version: 2.5.2 and 2.6.0 beta build 327 Summary: Mango Automation i...

Mango Automation 2.6.0 - Multiple Vulnerabilities

Mango Automation 2.6.0 - Multiple Vulnerabilities Mango Automation 2.6.0 CSRF File Upload And Arbitrary JSP Code Execution Vendor: Infinite Automation Systems Inc. Product web page: http://www.infiniteautomation.com/ Affected version: 2.5.2 and 2.6.0 beta build 327 Summary: Mango Automation is a...