CVE-2015-6474

The CVE-2015-6474 entry concerns IBC Solar ServeMaster TLP+ and Danfoss TLX Pro+ where an attacker can discover cleartext passwords by viewing the HTML source of web pages. Affected products are web-based SCADA systems; the root cause is improper handling/storage of credentials leading to exposur...

CVE-2015-6475

CVE-2015-6475 involves multiple cross-site scripting (XSS) vulnerabilities in the web-based SCADA products served by IBC Solar: ServeMaster TLP+ and Danfoss TLX Pro+. The public records describe XSS as the underlying issue enabling an attacker to inject arbitrary web script or HTML via unspecifie...

CVE-2015-6475

Multiple cross-site scripting XSS vulnerabilities in IBC Solar ServeMaster TLP+ and Danfoss TLX Pro+ allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-6469

The interpreter in IBC Solar ServeMaster TLP+ and Danfoss TLX Pro+ allows remote attackers to discover script source code via unspecified vectors...

PT-2015-7263

Name of the Vulnerable Software and Affected Versions IBC Solar ServeMaster TLP+ affected versions not specified Danfoss TLX Pro+ affected versions not specified Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to injec...

PT-2015-7262

Name of the Vulnerable Software and Affected Versions IBC Solar ServeMaster TLP+ affected versions not specified Danfoss TLX Pro+ affected versions not specified Description The issue allows remote attackers to discover cleartext passwords by reading HTML source code. Recommendations For IBC Sola...

CVE-2015-6469: Exposure of Sensitive Information to an Unauthorized Actor

The interpreter in IBC Solar ServeMaster TLP+ and Danfoss TLX Pro+ allows remote attackers to discover script source code via unspecified vectors...

CVE-2015-6475: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in IBC Solar ServeMaster TLP+ and Danfoss TLX Pro+ allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-6474: Exposure of Sensitive Information to an Unauthorized Actor

IBC Solar ServeMaster TLP+ and Danfoss TLX Pro+ allow remote attackers to discover cleartext passwords by reading HTML source code...

PT-2015-7259

Name of the Vulnerable Software and Affected Versions IBC Solar ServeMaster TLP+ affected versions not specified Danfoss TLX Pro+ affected versions not specified Description The issue allows remote attackers to discover script source code. Recommendations For IBC Solar ServeMaster TLP+, at the...

SMA Solar Sunny WebBox Privilege Gain Vulnerability

The SMA Solar Sunny WebBox is a device from SMA Germany for remote monitoring and maintenance of medium and large PV plants. A security vulnerability exists in the SMA Solar Sunny WebBox, which can be exploited by remote attackers to gain access...

CVE-2015-3964

SMA Solar Sunny WebBox has hardcoded passwords, which makes it easier for remote attackers to obtain access via unspecified vectors...

Hardcoded credentials

SMA Solar Sunny WebBox has hardcoded passwords, which makes it easier for remote attackers to obtain access via unspecified vectors...

CVE-2015-3964

SMA Solar Sunny WebBox has hardcoded passwords, which makes it easier for remote attackers to obtain access via unspecified vectors...

CVE-2015-3964

CVE-2015-3964 affects SMA Solar Technology AG Sunny WebBox. The vulnerability arises from hardcoded credentials in Sunny WebBox firmware, enabling remote attackers to obtain complete access via unspecified remote vectors. The NVD listing assigns a CVSS v2 base score of 10.0 (HIGH) with AV:N/AC:L/...

PT-2015-3055

Name of the Vulnerable Software and Affected Versions SMA Solar Sunny WebBox affected versions not specified Description The issue concerns hardcoded passwords in the SMA Solar Sunny WebBox system, making it easier for remote attackers to gain access. Recommendations At the moment, there is no...

CVE-2015-3964: Undefined Security Weakness

SMA Solar Sunny WebBox has hardcoded passwords, which makes it easier for remote attackers to obtain access via unspecified vectors...

IBC Solar ServeMaster Source Code Vulnerability

OVERVIEW Independent researcher Maxim Rupp has identified three vulnerabilities in IBC Solar products. The vulnerabilities are disclosure of applications source code, plain text passwords, and cross site scripting. IBC Solar has not produced a patch to mitigate these vulnerabilities. These...

Sinapsi eSolar Light Plaintext Password Disclosure Vulnerability

Sinapsi eSolar Light is a monitoring system for use within solar applications from the Italian company Sinapsi. A security vulnerability in Sinapsi eSolar Light allows a remote attacker to read the HTML source code in the mail-configuration page to obtain a clear-text password and use it for...

SMA Solar Technology AG Sunny WebBox Hard-Coded Account Vulnerability

OVERVIEW This updated advisory is a follow-up to the advisory titled ICSA-15-181-02 SMA Solar Technology AG Sunny WebBox Hard-Coded Account Vulnerability that was published September 3, 2015, on the NCCIC/ICS-CERT web site. Aleksandr Timorin of PT Security has identified a hard-coded account...