Delta Electronics vulnerabilities, page 5

226 vulnerabilities

Known vulnerabilities in Delta Electronics products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 37 products.

5.5MediumCVE-2022-1331delta electronics · dmars +1 moreDelta Electronics DMARS Improper Restriction of XML External Entity ReferenceIn four instances DMARS (All versions prior to v2.1.10.24) does not properly restrict references of XML external entities while processing specific project files, which may allow unauthorized information disclosure.EPSS0.81%10CriticalCVE-2022-1366delta electronics · diaenergie +1 moredelta electronics diaenergieDelta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in HandlerChart.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.EPSS19.35%10CriticalCVE-2022-1378delta electronics · diaenergie +1 moredelta electronics diaenergieDelta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_pgHandler.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.EPSS19.35%10CriticalCVE-2022-1367delta electronics · diaenergie +1 moredelta electronics diaenergieDelta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in Handler_TCV.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.EPSS19.35%7.8HighCVE-2022-1402delta electronics · asda-soft +1 moreDelta Electronics ASDA-Soft Out-of-bounds ReadASDA-Soft: Version 5.4.1.0 and prior does not properly sanitize input while processing a specific project file, allowing a possible out-of-bounds read condition.EPSS0.84%10CriticalCVE-2022-1375delta electronics · diaenergie +1 moredelta electronics diaenergieDelta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_slogHandler.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.EPSS1.22%7.8HighCVE-2022-1405delta electronics · cncsoft +1 moreDelta Electronics CNCSoft Stack-based Buffer OverflowCNCSoft: All versions prior to 1.01.32 does not properly sanitize input while processing a specific project file, allowing a possible stack-based buffer overflow condition.EPSS2.17%10CriticalCVE-2022-1377delta electronics · diaenergie +1 moredelta electronics diaenergieDelta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_rltHandler.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.EPSS1.22%7.8HighCVE-2022-1403delta electronics · asda-soft +1 moreDelta Electronics ASDA-Soft Out-of-bounds WriteASDA-Soft: Version 5.4.1.0 and prior does not properly sanitize input while processing a specific project file, allowing a possible out-of-bounds write condition.EPSS0.84%10CriticalCVE-2022-1372delta electronics · diaenergie +1 moredelta electronics diaenergieDelta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in dlSlog.aspx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.EPSS1.22%10CriticalCVE-2022-1374delta electronics · diaenergie +1 moredelta electronics diaenergieDelta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_unHandler.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.EPSS1.22%10CriticalCVE-2022-1376delta electronics · diaenergie +1 moredelta electronics diaenergieDelta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_privgrpHandler.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.EPSS1.22%10CriticalCVE-2022-1370delta electronics · diaenergie +1 moredelta electronics diaenergieDelta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in ReadREGbyID. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.EPSS1.22%10CriticalCVE-2022-1371delta electronics · diaenergie +1 moredelta electronics diaenergieDelta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in ReadRegf. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.EPSS1.22%7.1HighCVE-2022-1404delta electronics · cncsoft +1 moreDelta Electronics CNCSoft Out-of-bounds ReadDelta Electronics CNCSoft (All versions prior to 1.01.32) does not properly sanitize input while processing a specific project file, allowing a possible out-of-bounds read condition.EPSS0.33%10CriticalCVE-2022-1369delta electronics · diaenergie +1 moredelta electronics diaenergieDelta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in ReadRegIND. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.EPSS1.22%9.8CriticalCVE-2022-41778delta electronics · infrasuite device master +1 moredelta electronics infrasuite device masterDelta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize user-supplied data provided through the Device-DataCollect service port without proper verification. An attacker could provide malicious serialized objects to execute arbitrary code upon deserialization.EPSS1.03%8.8HighCVE-2022-41775delta electronics · diaenergie +1 moreDelta Electronics DIAEnergie SQL InjectionSQL Injection in Handler_CFG.ashx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via NetworkEPSS0.66%9.1CriticalCVE-2022-41629delta electronics · infrasuite device master +1 moredelta electronics infrasuite device masterDelta Electronics InfraSuite Device Master versions 00.00.01a and prior allow unauthenticated users to access the aprunning endpoint, which could allow an attacker to retrieve any file from the “RunningConfigs” directory. The attacker could then view and modify configuration files such as UserListInfo.xml, which would allow them to see existing administrative passwords.EPSS0.67%8.8HighCVE-2022-41644delta electronics · infrasuite device master +1 moredelta electronics infrasuite device masterDelta Electronics InfraSuite Device Master versions 00.00.01a and prior lacks authentication for a function that changes group privileges. An attacker could use this to create a denial-of-service state or escalate their own privileges.EPSS0.77%