CVE-2021-40336

A vulnerability exists in the http web interface where the web interface does not validate data in an HTTP header. This causes a possible HTTP response splitting, which if exploited could lead an attacker to channel down harmful code into the user’s web browser, such as to steal the session...

CVE-2021-40335

A vulnerability exists in the HTTP web interface where the web interface does not sufficiently verify if a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. This cause a Cross Site Request Forgery CSRF, which if exploited could lead an attack...

Cross site request forgery (csrf)

A vulnerability exists in the HTTP web interface where the web interface does not sufficiently verify if a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. This cause a Cross Site Request Forgery CSRF, which if exploited could lead an attack...

Design/Logic Flaw

A vulnerability exists in the http web interface where the web interface does not validate data in an HTTP header. This causes a possible HTTP response splitting, which if exploited could lead an attacker to channel down harmful code into the user’s web browser, such as to steal the session...

CVE-2021-40336

Hitachi Energy MSM (versions 2.2 and prior) is affected by CVE-2021-40336 due to improper validation of data in HTTP headers, enabling HTTP response splitting and potential in-browser code execution to steal session cookies. ED docs indicate a remediation path: update to a fixed MSM version, and ...

CVE-2021-40336 HTTP Response Splitting in Hitachi Energy’s MSM Product

A vulnerability exists in the http web interface where the web interface does not validate data in an HTTP header. This causes a possible HTTP response splitting, which if exploited could lead an attacker to channel down harmful code into the user’s web browser, such as to steal the session...

CVE-2021-40335 Cross Site Request Forgery (CSRF) in Hitachi Energy’s MSM Product

A vulnerability exists in the HTTP web interface where the web interface does not sufficiently verify if a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. This cause a Cross Site Request Forgery CSRF, which if exploited could lead an attack...

CVE-2021-40335

Hitachi Energy MSM (Mon i toring System for high‑voltage switchgear) is affected by CVE-2021-40335. The vulnerability is a Cross‑Site Request Forgery (CSRF) in the HTTP web interface caused by insufficient verification of user‑intended, well‑formed requests. A successful exploit could allow an at...

Hitachi Energy MSM 跨站请求伪造漏洞

Hitachi Energy MSM is Hitachi Energy Switzerland's solution for monitoring, managing and analyzing the performance of all types of high-voltage switchgear in new installations, as well as retrofitting existing high-voltage assets. A security vulnerability exists in Hitachi Energy MSM version 2.2...

PT-2022-5005 · Hitachi Energy · Hitachi Energy Msm

Name of the Vulnerable Software and Affected Versions: Hitachi Energy MSM versions V2.2 and prior Description: A vulnerability exists in the HTTP web interface where it does not sufficiently verify if a well-formed, valid, consistent request was intentionally provided by the user who submitted th...

Hitachi Energy MSM 注入漏洞

Hitachi Energy MSM is Hitachi's solution for monitoring, managing, and analyzing the performance of all types of high-voltage switchgear in new installations, as well as retrofitting existing high-voltage assets. An injection vulnerability exists in Hitachi Energy MSM 2.2 and prior versions, whic...

CVE-2021-40335

A vulnerability exists in the HTTP web interface where the web interface does not sufficiently verify if a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. This cause a Cross Site Request Forgery CSRF, which if exploited could lead an attack...

CVE-2022-31517

The HolgerGraef/MSM repository through 2021-04-20 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

CVE-2022-31517

The HolgerGraef/MSM repository through 2021-04-20 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

Path traversal

The HolgerGraef/MSM repository through 2021-04-20 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

CVE-2022-31517

The CVE-2022-31517 entry concerns the HolgerGraef/MSM repository up to 2021-04-20. Affects the application/component that uses Flask's send_file, where unsafe usage enables absolute path traversal. The root cause is unsafe handling of file paths in send_file, leading to potential access of restri...

Marval MSM Cross-Site Request Forgery Vulnerability

Marval MSM is an innovative IT service management software from Marval UK. The Marval MSM v14.19.0.12476 release has a cross-site request forgery vulnerability that can be exploited by an attacker to disable 2FA by sending a malicious form to a user...

CVE-2022-31884

Marval MSM v14.19.0.12476 has an Improper Access Control vulnerability which allows a low privilege user to delete other users API Keys including high privilege and the Administrator users API Keys...

CVE-2022-31887

Marval MSM v14.19.0.12476 has a 0-Click Account Takeover vulnerability which allows an attacker to change any user's password in the organization, this means that the user can also escalate achieve Privilege Escalation by changing the administrator password...

CVE-2022-31884

Marval MSM v14.19.0.12476 has an Improper Access Control vulnerability which allows a low privilege user to delete other users API Keys including high privilege and the Administrator users API Keys...