CVE-2024-11305

A vulnerability classified as critical was found in Altenergy Power Control Software up to 20241108. This vulnerability affects the function getstatuszigbee of the file /index.php/display/statuszigbee. The manipulation of the argument date leads to sql injection. The attack can be initiated...

CVE-2024-11305 Altenergy Power Control Software status_zigbee get_status_zigbee sql injection

A vulnerability classified as critical was found in Altenergy Power Control Software up to 20241108. This vulnerability affects the function getstatuszigbee of the file /index.php/display/statuszigbee. The manipulation of the argument date leads to sql injection. The attack can be initiated...

CVE-2024-11305 Altenergy Power Control Software status_zigbee get_status_zigbee sql injection

A vulnerability classified as critical was found in Altenergy Power Control Software up to 20241108. This vulnerability affects the function getstatuszigbee of the file /index.php/display/statuszigbee. The manipulation of the argument date leads to sql injection. The attack can be initiated...

CVE-2024-11305

Altenergy Power Control Software contains a SQL injection in the get_status_zigbee function (file /index.php/display/status_zigbee) index parameter date. The vulnerability affects versions up to 20241108 and can be exploited remotely. The nuclei template specifies that authenticated attackers cou...

Altenergy Power System Control Software injection vulnerability

Altenergy Power System Control Software is microinverter control software from Altenergy Power System. An injection vulnerability exists in Altenergy Power System Control Software version 20241108 and prior versions, which stems from an SQL injection in parameter date...

CVE-2024-11306: Improper Authorization

A vulnerability, which was classified as critical, has been found in Altenergy Power Control Software up to 20241108. This issue affects some unknown processing of the file /index.php/display/database/. The manipulation leads to improper authorization. The attack may be initiated remotely. The...

CVE-2024-11305: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability classified as critical was found in Altenergy Power Control Software up to 20241108. This vulnerability affects the function getstatuszigbee of the file /index.php/display/statuszigbee. The manipulation of the argument date leads to sql injection. The attack can be initiated...

Altenergy Power System Control Software injection vulnerability

Altenergy Power System Control Software is microinverter control software from Altenergy Power System. An injection vulnerability exists in Altenergy Power Control Software 20241108 and prior versions that stems from an improper authorization issue in the file /index.php/display/database/...

CVE-2024-52876

Holy Stone Remote ID Module HSRID01, firmware distributed with the Drone Go2 mobile application before 1.1.8, allows unauthenticated "remote power off" actions in broadcast mode via multiple read operations on the ASTM Remote ID 0xFFFA GATT...

CVE-2024-52876

Holy Stone Remote ID Module HSRID01, firmware distributed with the Drone Go2 mobile application before 1.1.8, allows unauthenticated "remote power off" actions in broadcast mode via multiple read operations on the ASTM Remote ID 0xFFFA GATT...

CVE-2024-52876

Holy Stone Remote ID Module HSRID01, firmware distributed with the Drone Go2 mobile application before 1.1.8, allows unauthenticated "remote power off" actions in broadcast mode via multiple read operations on the ASTM Remote ID 0xFFFA GATT...

CVE-2024-52876

The Holy Stone Remote ID Module HSRID01 contains a vulnerability in firmware versions distributed with the Drone Go2 mobile application prior to version 1.1.8 . The flaw allows unauthenticated "remote power off" actions in broadcast mode. This is triggered by performing multiple read operations o...

PT-2024-16898 · Unknown · Altenergy Power Control

Name of the Vulnerable Software and Affected Versions: Altenergy Power Control Software versions up to 20241108 Description: A critical issue has been found in the software, affecting some unknown processing of the file /index.php/display/database/, leading to improper authorization. The attack m...

CVE-2024-52876: Out-of-bounds Read

Holy Stone Remote ID Module HSRID01, firmware distributed with the Drone Go2 mobile application before 1.1.8, allows unauthenticated "remote power off" actions in broadcast mode via multiple read operations on the ASTM Remote ID 0xFFFA GATT...

PT-2024-16897 · Altenergy · Altenergy Power Control

Name of the Vulnerable Software and Affected Versions: Altenergy Power Control Software versions up to 20241108 Description: A critical vulnerability has been found in the Altenergy Power Control Software, affecting the get status zigbee function of the file /index.php/display/status zigbee. The...

PT-2024-35473 · Holy Stone · Holy Stone Remote Id Module Hsrid01 +1

Name of the Vulnerable Software and Affected Versions: Holy Stone Remote ID Module HSRID01, firmware distributed with the Drone Go2 mobile application before version 1.1.8 Description: The issue allows unauthenticated "remote power off" actions in broadcast mode via multiple read operations on th...

Microsoft Power Pages Misconfigurations Expose Millions of Records Globally

SaaS Security firm AppOmni has identified misconfigurations in Microsoft Power Pages that can lead to severe data breaches.…...

Power Monitoring Expert XSS

The vulnerability of the Power Monitoring Expert, Power Operation, and Power SCADA Operation software relates to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks from a remote location...

EcoStruxure Power Monitoring Expert Code Execution

The vulnerability of the software-based web server of EcoStruxure Power Monitoring Expert is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially crafted package...

kernel: mptcp: pm: Fix uaf in __timer_delete_sync

A use-after-free flaw was found in the Linux kernel’s Multipath TCP MPTCP subsystem. This flaw allows a local user to crash or potentially escalate their privileges on the system...