CVE-2019-11367

CVE-2019-11367 affects AUO Solar Data Recorder pre-1.3.0. The web portal uses HTTP Basic Authentication and leaks credentials via the WWW-Authenticate header, allowing login with exposed account/password without further authentication. Exploitable by accessing the /protect/ area; multiple public ...

CVE-2019-11368

AU Optronics Solar Data Recorder prior to version 1.3.0 is affected by CVE-2019-11368: a stored XSS vulnerability in the web interface reachable via the protect/config.htm addr parameter. The issue permits script execution within the context of an authenticated user (stored in the application's b...