CVE-2017-5142

An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. A user with low privileges is able to open and change the parameters by accessing a specific URL because of Improper Privilege Management...

CVE-2017-5141

An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. An attacker can establish a new user session, without invalidating any existing session identifier, which gives the opportunity to steal authenticated session...

CVE-2017-5140

An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. Password is stored in clear text...

CVE-2017-5140

An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. Password is stored in clear text...

CVE-2017-5140

An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. Password is stored in clear text...

CVE-2017-5139: Insufficiently Protected Credentials

An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. Any user is able to disclose a password by accessing a specific URL, because of Plaintext Storage of a Password...

PT-2017-16335

Name of the Vulnerable Software and Affected Versions Honeywell XL Web II controller XL1000C500 versions XLWebExe-2-01-00 and prior Honeywell XLWeb 500 versions XLWebExe-1-02-08 and prior Description The issue allows any user to disclose a password by accessing a specific URL due to plaintext...

PT-2017-16339

Name of the Vulnerable Software and Affected Versions Honeywell XL Web II controller versions XL1000C500 XLWebExe-2-01-00 and prior Honeywell XLWeb 500 versions XLWebExe-1-02-08 and prior Description A directory traversal attack can be made by accessing a specific URL without authenticating...

CVE-2017-5142: Improper Privilege Management

An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. A user with low privileges is able to open and change the parameters by accessing a specific URL because of Improper Privilege Management...

CVE-2017-5141: Session Fixation

An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. An attacker can establish a new user session, without invalidating any existing session identifier, which gives the opportunity to steal authenticated session...

CVE-2017-5140: Insufficiently Protected Credentials

An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. Password is stored in clear text...

PT-2017-16336

Name of the Vulnerable Software and Affected Versions Honeywell XL Web II controller versions XL1000C500 XLWebExe-2-01-00 and prior Honeywell XLWeb 500 versions XLWebExe-1-02-08 and prior Description An issue was discovered where the password is stored in clear text. Recommendations For Honeywell...

PT-2017-16337

Name of the Vulnerable Software and Affected Versions Honeywell XL Web II controller XL1000C500 versions XLWebExe-2-01-00 and prior Honeywell XLWeb 500 versions XLWebExe-1-02-08 and prior Description An issue allows an attacker to establish a new user session without invalidating any existing...

Honeywell FALCON XLWeb FTP服务器跨目录漏洞

No description provided by source...

Honeywell FALCON XLWeb系列控制器登录绕过漏洞

No description provided by source...

Honeywell XLWEB SCADA Path Traversal

SCADA - EXPLOITING CVE-2015-0984 FOR SHELL ACCESS This post is a follow up detailing how to achieve control of the actual XLWEB SCADA controller. The vulnerability is assigned with reference CVE-2015-0984. Rather than the application level administrative access as discussed in the email regarding...

CVE-2014-2717

Honeywell FALCON XLWeb Linux controller devices 2.04.01 and earlier and FALCON XLWeb XLWebExe controller devices 2.02.11 and earlier allow remote attackers to bypass authentication and obtain administrative access by visiting the change-password page...

CVE-2014-3110

Multiple cross-site scripting XSS vulnerabilities on Honeywell FALCON XLWeb Linux controller devices 2.04.01 and earlier and FALCON XLWeb XLWebExe controller devices 2.02.11 and earlier allow remote attackers to inject arbitrary web script or HTML via invalid input...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities on Honeywell FALCON XLWeb Linux controller devices 2.04.01 and earlier and FALCON XLWeb XLWebExe controller devices 2.02.11 and earlier allow remote attackers to inject arbitrary web script or HTML via invalid input...

Authentication flaw

Honeywell FALCON XLWeb Linux controller devices 2.04.01 and earlier and FALCON XLWeb XLWebExe controller devices 2.02.11 and earlier allow remote attackers to bypass authentication and obtain administrative access by visiting the change-password page...