Deltaww Diaenergie vulnerabilities, page 4

92 vulnerabilities

Known vulnerabilities in Deltaww Diaenergie, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

10CriticalCVE-2022-27175delta electronics · diaenergie +1 moreDelta Electronics DIAEnergie SQL Injection in GetCalcTagListDelta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in GetCalcTagList. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.EPSS1.22%9.8CriticalCVE-2022-3214delta electronics · diaenergy +1 moreDelta Electronics DIAEnergy Use of Hard-coded CredentialsDelta Industrial Automation's DIAEnergy, an industrial energy management system, is vulnerable to CWE-798, Use of Hard-coded Credentials. Versions prior to  1.9.03.009 have this vulnerability. Executable files could be uploaded to certain directories using hard-coded bearer authorization, allowing remote code execution.EPSS2.00%6.1MediumCVE-2022-33005deltaww · diaenergiedeltaww diaenergieA cross-site scripting (XSS) vulnerability in the System Settings/IOT Settings module of Delta Electronics DIAEnergie v1.08.00 allows attackers to execute arbitrary web scripts via a crafted payload injected into the Name text field.EPSS0.63%8.8HighCVE-2024-42417delta electronics · diaenergie +1 moreDelta Electronics DIAEnergie SQL InjectionDelta Electronics DIAEnergie is vulnerable to an SQL injection in the script Handler_CFG.ashx. An authenticated attacker may be able to exploit this issue to cause delay in the targeted product.EPSS7.03%7.5HighCVE-2024-4549delta electronics · diaenergie +1 moreDelta Electronics DIAEnergie SQL InjectionA denial of service vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior. When processing an 'ICS Restart!' message, CEBC.exe restarts the system.EPSS1.11%9.8CriticalCVE-2024-4548delta electronics · diaenergie +1 moreDelta Electronics DIAEnergie SQL InjectionAn SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateHDMWYC' message, which is split into 4 fields using the '~' character as the separator. An unauthenticated remote attacker can perform SQLi via the fourth field.EPSS29.43%9.8CriticalCVE-2024-4547delta electronics · diaenergie +1 moreDelta Electronics DIAEnergie Unauthenticated SQL InjectionA SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateScript' message, which is splitted into 4 fields using the '~' character as the separator. An unauthenticated remote attacker can perform SQLi via the fourth fieldEPSS1.90%8.8HighCVE-2024-25567delta electronics · diaenergie +1 moreDelta Electronics DIAEnergie Path traversalPath traversal attack is possible and write outside of the intended directory and may access sensitive information. If a file name is specified that already exists on the file system, then the original file will be overwritten.EPSS0.66%9.8CriticalCVE-2024-25574delta electronics · diaenergie +1 moreDelta Electronics DIAEnergie SQL InjectionSQL injection vulnerability exists in GetDIAE_usListParameters.EPSS8.79%8.8HighCVE-2024-25937delta electronics · diaenergie +1 moreDelta Electronics DIAEnergie SQL injectionSQL injection vulnerability exists in the script DIAE_tagHandler.ashx.EPSS8.48%9.8CriticalCVE-2024-43699delta electronics · diaenergie +1 moreDelta Electronics DIAEnergie SQL InjectionDelta Electronics DIAEnergie is vulnerable to an SQL injection in the script AM_RegReport.aspx. An unauthenticated attacker may be able to exploit this issue to obtain records contained in the targeted product.EPSS0.54%5.4MediumCVE-2024-28045delta electronics · diaenergie +1 moreDelta Electronics DIAEnergie Cross-site scriptingImproper neutralization of input within the affected product could lead to cross-site scripting.EPSS0.29%8.8HighCVE-2024-28891delta electronics · diaenergie +1 moreDelta Electronics DIAEnergie SQL injectionSQL injection vulnerability exists in the script Handler_CFG.ashx.EPSS8.48%8.8HighCVE-2024-28029delta electronics · diaenergie +1 moreClient-Side Enforcement of Server-Side Security in Delta Electronics DIAEnergiePrivileges are not fully verified server-side, which can be abused by a user with limited privileges to bypass authorization and access privileged functionality.EPSS0.65%8.1HighCVE-2024-28171delta electronics · diaenergie +1 moreDelta Electronics DIAEnergie Path traversalIt is possible to perform a path traversal attack and write outside of the intended directory. If a file name is specified that already exists on the file system, then the original file will be overwritten.EPSS0.65%8.8HighCVE-2024-28040delta electronics · diaenergie +1 moreDelta Electronics DIAEnergie SQL injectionSQL injection vulnerability exists in GetDIAE_astListParameters.EPSS8.48%8.8HighCVE-2024-34032delta electronics · diaenergie +1 moreSQL Injection in Delta Electronics DIAEnergieDelta Electronics DIAEnergie is vulnerable to an SQL injection vulnerability that exists in the GetDIACloudList endpoint. An authenticated attacker can exploit this issue to potentially compromise the system on which DIAEnergie is deployed.EPSS8.74%8.8HighCVE-2024-34031delta electronics · diaenergie +1 moreSQL Injection vulnerability in Delta Electronics DIAEnergieDelta Electronics DIAEnergie is vulnerable to an SQL injection vulnerability that exists in the script Handler_CFG.ashx. An authenticated attacker can exploit this issue to potentially compromise the system on which DIAEnergie is deployed.EPSS0.50%8.8HighCVE-2024-34033delta electronics · diaenergie +1 morePath Traversal vulnerability in Delta Electronics DIAEnergieDelta Electronics DIAEnergie has insufficient input validation which makes it possible to perform a path traversal attack and write outside of the intended directory. If a file name is specified that already exists on the file system, then the original file will be overwritten.EPSS1.00%8.8HighCVE-2024-23975delta electronics · diaenergie +1 moreDelta Electronics DIAEnergie SQL injectionSQL injection vulnerability exists in GetDIAE_slogListParameters.EPSS8.48%