APsystems Energy Communication Unit (ECU-C) Power Control Software

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION : Exploitable via adjacent network / low attack complexity Vendor : APsystems Equipment : Energy communication Unit ECU-C Power Control Software Vulnerability : Improper Access Control 2. RISK EVALUATION Successful exploitation of this...

Voltronic Power ViewPower Pro

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/Low attack complexity Vendor: Voltronic Power Equipment: ViewPower Pro Vulnerabilities: Deserialization of Untrusted Data, Missing Authentication for Critical Function, Exposed Dangerous Method or Function, OS Command...

Security Bulletin: [All] Apache Tomcat (core only) - CVE-2023-45648 (Publicly disclosed vulnerability)

Summary Apache Tomcat is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2023-45648 DESCRIPTION: Apache Tomcat is vulnerable to HTTP request smuggling, caused by improper parsing of HTTP trailer headers. By sending a specially...

Security Bulletin: [All] Apache Tomcat (core only) - CVE-2023-42795 (Publicly disclosed vulnerability)

Summary Apache Tomcat is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2023-42795 DESCRIPTION: Apache Tomcat could allow a remote attacker to obtain sensitive information, caused by an incomplete Cleanup vulnerability when...

power-steering.co.uk Cross Site Scripting vulnerability OBB-3834240

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

LinuxMonitorConsole Code Execution

The vulnerability of the LinuxMonitorConsole software for controlling power supply sources from Voltronic Power ViewPower is related to the use of dangerous methods or functions. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code through a specially created...

MonitorConsole Class Power Source DoS

The vulnerability of the MonitorConsole class in the software for managing power sources of Voltronic Power ViewPower is related to the use of dangerous methods or functions. Exploiting this vulnerability could allow a malicious actor to cause a service failure through a specially crafted HTTP...

MonitorConsole Class Code Execution

The vulnerability of the MonitorConsole class in the software for controlling power supply sources of Voltronic Power ViewPower is related to the use of dangerous methods or functions. Exploiting this vulnerability may allow a malicious actor to execute arbitrary code through a specially created...

Voltronic Power ViewPower updateManagerPassword Auth Bypass

The vulnerability of the updateManagerPassword method in the software for managing power supply sources of Voltronic Power ViewPower is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker, operating remotely, to bypass the authentication...

Voltronic Power ViewPower Pro getMacAddressByIP Code Execution

The vulnerability of the “getMacAddressByIP” function in the software for controlling power sources of Voltronic Power ViewPower Pro is related to the lack of measures taken to clean data at the control level. Exploiting this vulnerability could allow a malicious actor, operating remotely, to...

Voltronic Power ViewPower UploadAction Code Execution

The vulnerability of the UpLoadAction class in the software for managing power sources of Voltronic Power ViewPower Pro relates to the unlimited loading of dangerous files. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code and gain full control over the...

Voltronic Power ViewPower Pro selectEventConfig SQLi

The vulnerability of the selectEventConfig method in the software for managing power supply sources of Voltronic Power ViewPower Pro relates to the lack of measures taken to protect the SQL query structure when data cleaning is insufficient. Exploiting this vulnerability could allow an attacker...

Voltronic Power ViewPower Shutdown Code Execution

The vulnerability of the shutdown method in software for controlling power sources of Voltronic Power View exists because measures to neutralize the special elements used in the operating system are not taken. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Voltronic Power ViewPower Set Shutdown Privilege Escalation

The vulnerability of the setShutdown method in software for controlling power sources of Voltronic Power ViewPower is related to the use of dangerous methods or functions. Exploiting this vulnerability could allow attackers to enhance their privileges...

Voltronic Power ViewPower SQL Injection

The vulnerability of the selectDeviceListBy method in the software for managing power sources of Voltronic Power ViewPower Pro is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker to execute arbitrary SQL queries remotely...

Voltronic Power View doDocument XXE

The vulnerability of the doDocument method in the software for managing power sources of Voltronic Power ViewPower Pro is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability could allow an attacker to perform XXE attacks remotely...

UpsScheduler Class Code Execution

The vulnerability of the UpsScheduler class in the software for managing power sources of Voltronic Power ViewPower is related to the use of dangerous methods or functions. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code through a specially created request...

Voltronic Power View Privilege Escalation

The vulnerability of the software for managing power supply sources in Voltronic Power ViewPower is related to incorrect default permissions. Exploiting this vulnerability can allow attackers to enhance their privileges...

MySQL Privilege Escalation

The vulnerability of the MySQL component in the software for managing power sources in Voltronic Power ViewPower Pro lies in the use of rigidly encoded credentials. Exploiting this vulnerability could allow an attacker to elevate their privileges to the level of an administrator...

Voltronic Power ViewPower Shutdown Code Execution

The vulnerability of the shutdown method used in software for controlling Voltronic Power ViewPower is related to the use of a dangerous function or method. Exploiting this vulnerability could allow an attacker to execute arbitrary code...