CVE-2022-31491

CVE-2022-31491 此仓库包含 Metasploit 模块和 PoC 文件。 更多信息 Voltronic Viewpower/Pro 及其更名/衍生版本 这款 UPS 管理软件通常允许通过 Web 界面经过正确身份验证和授权的用户，在软件检测到受管 UPS 正在关机时，将系统配置为运行一条由用户选择的操作系统命令。例如，通过单条命令停止批处理作业或向另一个系统发送警报。 由于一个相关的关键底层功能通过网络暴露（CWE-749：暴露不安全的活跃功能），且无需任何身份验证或授权，攻击者即可发送特制的 UDP 数据包，立即运行任意代码，而无论是否存在受管 UPS 或其状态如何。...

CVE-2022-43110

CVE-2022-43110 更多信息 Voltronic Viewpower/Pro 及其重命名/衍生版本 该UPS管理软件本应只允许经过正确身份验证和授权的管理员用户通过网络界面配置系统。 由于（CWE-425：直接请求'强制浏览'），未经授权、未经身份验证的远程攻击者可以更改系统，包括：更改网络界面管理员密码、查看/更改系统配置、枚举连接的UPS设备以及关闭连接的UPS设备。这还包括能够配置操作系统命令，这些命令应在系统检测到连接的UPS关机时运行。...

EUVD-2023-56282

Malicious code in bioql PyPI...

EUVD-2022-54224

Malicious code in bioql PyPI...

EUVD-2023-56298

Malicious code in bioql PyPI...

EUVD-2023-56305

Malicious code in bioql PyPI...

EUVD-2023-56296

Malicious code in bioql PyPI...

EUVD-2023-56283

Malicious code in bioql PyPI...

CVE-2022-31491

Voltronic Power ViewPower through 1.04-24215, ViewPower Pro through 2.0-22165, and PowerShield Netguard before 1.04-23292 allows a remote attacker to run arbitrary code via an unspecified web interface related to detection of a managed UPS shutting down. An unauthenticated attacker can use this t...

Voltronic Power多款产品 安全漏洞

Voltronic Power ViewPower and others are products of Voltronic Power.Voltronic Power ViewPower is a monitoring and management software for solar inverters.Voltronic Power ViewPower Pro is a software for monitoring and managing uninterrupted Voltronic Power ViewPower Pro is a software program for...

CVE-2022-31491

Voltronic Power ViewPower through 1.04-24215, ViewPower Pro through 2.0-22165, and PowerShield Netguard before 1.04-23292 allows a remote attacker to run arbitrary code via an unspecified web interface related to detection of a managed UPS shutting down. An unauthenticated attacker can use this t...

CVE-2022-31491

CVE-2022-31491 affects Voltronic Power ViewPower (<= 1.04-24215), ViewPower Pro (<= 2.0-22165), and PowerShield Netguard ( 1.04-24215, ViewPower Pro > 2.0-22165, Netguard >= 1.04-23292); multiple advisories (CISA ICS, Red Hat, NVD) corroborate the vulnerability. If available, PoC/Expl...

Exploit for CVE-2022-31491

CVE-2022-31491 Metasploit module and PoC are coming. Further...

Voltronic Power ViewPower XML External Entity Injection Vulnerability

Voltronic Power ViewPower is Voltronic Power's monitoring and management software for solar inverters. Voltronic Power ViewPower Pro suffers from an XML external entity injection vulnerability that can be exploited by attackers to disclose sensitive information...

Voltronic Power ViewPower Elevation of Privilege Vulnerability

Voltronic Power ViewPower is Voltronic Power's monitoring and management software for solar inverters. An elevation of privilege vulnerability exists in Voltronic Power ViewPower Pro due to hard-coded database credentials. An attacker can exploit the vulnerability to escalate privileges and execu...

CVE-2023-51595

Voltronic Power ViewPower Pro selectDeviceListBy SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower Pro. Authentication is not required to exploit this vulnerability. The...

CVE-2023-51595

Voltronic Power ViewPower Pro selectDeviceListBy SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower Pro. Authentication is not required to exploit this vulnerability. The...

CVE-2023-51588

Voltronic Power ViewPower Pro MySQL Use of Hard-coded Credentials Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Voltronic Power ViewPower Pro. An attacker must first obtain the ability to execute...

CVE-2023-51590

Voltronic Power ViewPower Pro UpLoadAction Unrestricted File Upload Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower Pro. Authentication is not required to exploit this vulnerability. T...

CVE-2023-51591

Voltronic Power ViewPower Pro doDocument XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Voltronic Power ViewPower Pro. Authentication is not required to exploit this...