CVE-2019-14929

CVE-2019-14929 affects Mitsubishi Electric Europe B.V. smartRTU ME-RTU devices (firmware up to 2.02) and INEA ME-RTU devices (up to 3.0). The root cause is unprotected storage of credentials (passwords stored in plaintext) due to weak credential management, enabling an unauthenticated attacker to...

CVE-2019-14929

An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Stored cleartext passwords could allow an unauthenticated attacker to obtain configured username and password combinations on the RTU due to the weak credentials management ...

CVE-2019-14930

An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Undocumented hard-coded user passwords for root, ineaadmin, mitsadmin, and maint could allow an attacker to gain unauthorised access to the RTU. Also, the accounts ineaadmin...

CVE-2019-14930

CVE-2019-14930 affects Mitsubishi Electric Europe B.V. ME-RTU (through 2.02) and INEA ME-RTU (through 3.0). The issue arises from undocumented hard-coded credentials for root, ineaadmin, mitsadmin, and maint, enabling unauthenticated access to the RTU. Additionally, ineaadmin and mitsadmin can es...

CVE-2019-14926

An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Hard-coded SSH keys allow an attacker to gain unauthorised access or disclose encrypted data on the RTU due to the keys not being regenerated on initial installation or with...

CVE-2019-14926

CVE-2019-14926 concerns hard-coded SSH keys in Mitsubishi Electric ME-RTU (firmware up to 2.02) and INEA ME-RTU (up to 3.0). The root cause is static private-key values stored in /etc/ssh/ssh_host_rsa_key, /etc/ssh/ssh_host_ecdsa_key, and /etc/ssh/ssh_host_dsa_key that are publicly available from...

CVE-2019-14928

The CVE-2019-14928 issue affects Mitsubishi Electric Europe B.V. ME-RTU devices up to firmware 2.02 and INEA ME-RTU devices up to 3.0, with stored cross-site scripting (XSS) vulnerabilities in the web interface. The vulnerability arises from insufficient input validation, e.g., the SerialInitialM...

CVE-2019-14928

An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. A number of stored cross-site script XSS vulnerabilities allow an attacker to inject malicious code directly into the application. An example input variable vulnerable to...

CVE-2019-14927

The CVE-2019-14927 vulnerability affects Mitsubishi Electric Europe B.V. ME-RTU (versions up to 2.02) and INEA ME-RTU (up to 3.0), enabling an unauthenticated remote download of the device’s configuration file containing usernames, passwords, and other sensitive RTU data. This is an unauthenticat...

CVE-2019-14927

An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. An unauthenticated remote configuration download vulnerability allows an attacker to download the smartRTU's configuration file which contains data such as usernames,...

CVE-2019-14931

CVE-2019-14931 describes an unauthenticated remote OS command injection in Mitsubishi Electric ME-RTU (firmware ≤2.02) and INEA ME-RTU (≤3.0), exploitable via unsafe data in the Mobile Connection Test host parameter (shell command separator ';'). Impact is remote command execution with high sever...

PT-2019-13870 · Mitsubishi · Me-Rtu

Name of the Vulnerable Software and Affected Versions: Mitsubishi Electric Europe B.V. ME-RTU devices versions 2.02 and earlier INEA ME-RTU devices versions 3.0 and earlier Description: An issue allows an attacker to inject malicious code directly into the application through stored cross-site...

SQL Injection Vulnerability in Use Me Online's Website Building System

Founded in March 2005, Chengdu Use Me Online Technology Development Co., Ltd. is a high-tech Internet technology service provider. A SQL injection vulnerability exists in the website building system of Chengdu Online, which can be exploited by an attacker to obtain sensitive information from the...

WordPress copy-me plugin cross-site request forgery vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in version 1.0.0 of the WordPress copy-me plugin. The...

CVE-2016-10938

The copy-me plugin 1.0.0 for WordPress has CSRF for copying non-public posts to a public location...

CVE-2016-10938

The copy-me plugin 1.0.0 for WordPress has CSRF for copying non-public posts to a public location...

Cross site request forgery (csrf)

The copy-me plugin 1.0.0 for WordPress has CSRF for copying non-public posts to a public location...

CVE-2016-10938

The CVE-2016-10938 entry concerns the WordPress copy-me plugin version 1.0.0, which exposes a CSRF vulnerability that allows copying non-public posts to a public location. Multiple connected records (including Red Hat, CNVD/CVELIST, NVD, WPVulnDB) corroborate that the issue is a cross-site reques...

The vulnerability in the TokenBasedRememberMeServices2.java component of the Jenkins automation server allows a malicious individual to gain unauthorized access to protected information.

The vulnerability of the TokenBasedRememberMeServices2.java component located at core/src/main/java/hudson/security/TokenBasedRememberMeServices2.java in the Jenkins automation server is related to an incorrect session duration. Exploiting this vulnerability could allow a malicious actor, operati...

Mitsubishi Electric smartRTU and Inea ME-RTU Operating System Command Injection Vulnerability

Mitsubishi Electric smartRTU is an intelligent Remote Terminal Unit RTU from Mitsubishi Electric, Japan.Inea ME-RTU is an intelligent communication gateway product from Inea, Slovenia. An operating system command injection vulnerability exists in Mitsubishi Electric smartRTU version 2.02 and...