Sql injection

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 the Sentilo Proxy server was discovered to contain a SQL injection vulnerability allowing an attacker to query other tables of the Sentilo service...

Cross site scripting

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 the Sentilo Proxy is prone to reflected XSS which only affects the Sentilo service...

CVE-2022-28816 Reflected XSS in Carlo Gavazzi UWP 3.0

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 the Sentilo Proxy is prone to reflected XSS which only affects the Sentilo service...

CVE-2022-28816

CVE-2022-28816 affects Carlo Gavazzi UWP3.0 and CPY Car Park Server 2.8.3 . The Sentilo Proxy is prone to a reflected XSS vulnerability that impacts the Sentilo service. Public references (NVD, Red Hat, CVE List) concur the issue exists with multiple versions; however, the provided documents do n...

CVE-2022-28815 SQL-Injection in Carlo Gavazzi UWP 3.0 Sentilo Proxy

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 the Sentilo Proxy server was discovered to contain a SQL injection vulnerability allowing an attacker to query other tables of the Sentilo service...

CVE-2022-28815

The CVE-2022-28815 entry describes a SQL injection vulnerability in the Sentilo Proxy component used by Carlo Gavazzi UWP3.0 and CPY Car Park Server (version 2.8.3). The underlying issue is unsafe SQL handling within the Sentilo Proxy, enabling an attacker to query other tables of the Sentilo ser...

CVE-2022-28814

CVE-2022-28814 affects Carlo Gavazzi UWP3.0 and CPY Car Park Server v2.8.3. The vulnerability is a relative path traversal that enables a remote attacker to read arbitrary files and gain full control of the device. The CVSSv3.1 base score is 9.8 (CRITICAL) with network attack vector, no user inte...

CVE-2022-28812 Use of Hard-coded Credentials in UWP3.0 allows SuperUser authentication bypass in Car Park Server.

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of hard-coded credentials to gain SuperUser access to the device...

CVE-2022-28812

CVE-2022-28812 involves Carlo Gavazzi UWP3.0 (multiple versions) and CPY Car Park Server 2.8.3, where a remote, unauthenticated attacker can exploit hard-coded credentials to obtain SuperUser access. The CVE is supported by multiple sources in the connected set (Red Hat, NVD/NVD-derived entries, ...

CVE-2022-28812 Use of Hard-coded Credentials in UWP3.0 allows SuperUser authentication bypass in Car Park Server.

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of hard-coded credentials to gain SuperUser access to the device...

CVE-2022-28811

CVE-2022-28811 affects Carlo Gavazzi UWP3.0 (multiple versions) and CPY Car Park Server 2.8.3. The vulnerability stems from improper input validation on an API-submitted parameter, enabling a remote, unauthenticated attacker to execute arbitrary OS commands. The CVSS score is 9.8 (Critical) with ...

CVE-2022-28811 Possible command injection in Car Park Server in Carlo Gavazzi UWP3.0

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could utilize an improper input validation on an API-submitted parameter to execute arbitrary OS commands...

CVE-2022-22526 Missing authentication for API in Carlo Gavazzi UWP 3.0 Car Park Server

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a missing authentication allows for full access via API...

CVE-2022-22526

CVE-2022-22526 affects Carlo Gavazzi UWP3.0 and CPY Car Park Server (v2.8.3). The root cause is a missing authentication mechanism that allows full access via the API, enabling unauthorized control or data access. Public sources in connected documents describe an access control error leading to r...

CVE-2022-22524 SQL-injection in Carlo Gavazzi UWP 3.0 allows for full database access

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 an unauthenticated remote attacker could utilize a SQL-Injection vulnerability to gain full database access, modify users and stop services...

CVE-2022-22524

CVE-2022-22524 affects Carlo Gavazzi UWP3.0 and CPY Car Park Server (v2.8.3). Multiple sources describe a SQL injection that allows an unauthenticated remote attacker to gain full database access, modify users, and stop services. The affected components include UWP3.0 monitoring gateway/controlle...

CVE-2022-22525

The CVE-2022-22525 affects Carlo Gavazzi UWP3.0 and CPY Car Park Server 2.8.3. It stems from missing input sanitization in the backup restore function, enabling a remote attacker with admin rights to execute arbitrary commands. Connections across sources consistently identify the affected compone...

CVE-2022-22523 Carlo Gavazzi UWP 3.0 WebApp allows for authentication bypass

An improper authentication vulnerability exists in the Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 Web-App which allows an authentication bypass to the context of an unauthorised user if free-access is disabled...

CVE-2022-22523

CVE-2022-22523 involves an improper authentication issue in Carlo Gavazzi UWP3.0 (multiple versions) and CPY Car Park Server Web-App 2.8.3, enabling an authentication bypass for unauthorised users when free-access is disabled. Supported sources indicate the vulnerability affects Carlo Gavazzi UWP...

CVE-2022-22523 Carlo Gavazzi UWP 3.0 WebApp allows for authentication bypass

An improper authentication vulnerability exists in the Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 Web-App which allows an authentication bypass to the context of an unauthorised user if free-access is disabled...