CVE-2017-5141

An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. An attacker can establish a new user session, without invalidating any existing session identifier, which gives the opportunity to steal authenticated session...

CVE-2017-5140

CVE-2017-5140 affects Honeywell XL Web II controller family (XL1000C500 XLWebExe-2-01-00 and earlier; XLWeb 500 XLWebExe-1-02-08 and earlier). Root cause: passwords stored in clear text, enabling password disclosure via a specific URL. The vulnerability can be exploited remotely; ICS-CERT notes a...

CVE-2017-5141

The CVE-2017-5141 issue affects Honeywell XL Web II controllers: XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. The vulnerability allows an attacker to establish a new user session without invalidating an existing session identifier, enabling session fixation and...

CVE-2017-5143

The CVE-2017-5143 issue affects Honeywell XL Web II controllers (XL1000C500 XLWebExe-2-01-00 and prior) and XLWeb 500 XLWebExe-1-02-08 and prior. A directory traversal vulnerability allows an unauthenticated user to access a crafted URL, enabling path traversal on the device. Connected sources co...

CVE-2017-5142

An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. A user with low privileges is able to open and change the parameters by accessing a specific URL because of Improper Privilege Management...

CVE-2017-5139

CVE-2017-5139 affects Honeywell XL Web II controller family (XL1000C500 XLWebExe-2-01-00 and prior; XLWeb 500 XLWebExe-1-02-08 and prior). Root cause: plaintext storage of a password, enabling password disclosure via a specific URL. Impact per sources: remote exposure of passwords, with high-seve...

CVE-2017-5139

An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. Any user is able to disclose a password by accessing a specific URL, because of Plaintext Storage of a Password...

CVE-2017-5140

An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. Password is stored in clear text...

CVE-2017-5142

The CVE-2017-5142 issue affects Honeywell XL Web II controllers (XL1000C500 XLWebExe-2-01-00 and prior; XLWeb 500 XLWebExe-1-02-08 and prior). It stems from Improper Privilege Management, enabling a user with low privileges to open and change parameters by accessing a specific URL. Exploitation c...

PT-2017-16337

Name of the Vulnerable Software and Affected Versions Honeywell XL Web II controller XL1000C500 versions XLWebExe-2-01-00 and prior Honeywell XLWeb 500 versions XLWebExe-1-02-08 and prior Description An issue allows an attacker to establish a new user session without invalidating any existing...

CVE-2017-5143: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. A user without authenticating can make a directory traversal attack by accessing a specific URL...

CVE-2017-5141: Session Fixation

An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. An attacker can establish a new user session, without invalidating any existing session identifier, which gives the opportunity to steal authenticated session...

PT-2017-16336

Name of the Vulnerable Software and Affected Versions Honeywell XL Web II controller versions XL1000C500 XLWebExe-2-01-00 and prior Honeywell XLWeb 500 versions XLWebExe-1-02-08 and prior Description An issue was discovered where the password is stored in clear text. Recommendations For Honeywell...

CVE-2017-5142: Improper Privilege Management

An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. A user with low privileges is able to open and change the parameters by accessing a specific URL because of Improper Privilege Management...

PT-2017-16335

Name of the Vulnerable Software and Affected Versions Honeywell XL Web II controller XL1000C500 versions XLWebExe-2-01-00 and prior Honeywell XLWeb 500 versions XLWebExe-1-02-08 and prior Description The issue allows any user to disclose a password by accessing a specific URL due to plaintext...

PT-2017-16338

Name of the Vulnerable Software and Affected Versions Honeywell XL Web II controller XL1000C500 versions XLWebExe-2-01-00 and prior Honeywell XLWeb 500 versions XLWebExe-1-02-08 and prior Description The issue is related to improper privilege management, allowing a user with low privileges to...

PT-2017-16339

Name of the Vulnerable Software and Affected Versions Honeywell XL Web II controller versions XL1000C500 XLWebExe-2-01-00 and prior Honeywell XLWeb 500 versions XLWebExe-1-02-08 and prior Description A directory traversal attack can be made by accessing a specific URL without authenticating...

CVE-2017-5139: Insufficiently Protected Credentials

An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. Any user is able to disclose a password by accessing a specific URL, because of Plaintext Storage of a Password...

CVE-2017-5140: Insufficiently Protected Credentials

An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. Password is stored in clear text...

Google Pixel/Pixel XL HTC Touchscreen Driver Elevation of Privilege Vulnerability

Google Pixel & Pixel XL are new Android smartphones launched by Google on October 4, 2016, succeeding the previous Nexus series. An elevation of privilege vulnerability exists in the HTC touchscreen driver, which can be exploited by an attacker to cause a native app to execute arbitrary code in t...