11 results (0.016 seconds)

CVSS: 6.5EPSS: 0%CPEs: 11EXPL: 0

CVE-2024-25138 – AutomationDirect C-MORE EA9 HMI Plaintext Storage of a Password

https://notcve.org/view.php?id=CVE-2024-25138

In AutomationDirect C-MORE EA9 HMI, credentials used by the platform are stored as plain text on the device. En AutomationDirect C-MORE EA9 HMI, las credenciales utilizadas por la plataforma se almacenan como texto plano en el dispositivo. • https://https://www.cisa.gov/news-events/ics-advisories/icsa-24-086-01 • CWE-256: Plaintext Storage of a Password •

CVSS: 4.3EPSS: 0%CPEs: 11EXPL: 0

CVE-2024-25137 – AutomationDirect C-MORE EA9 HMI Stack-based Buffer Overflow

https://notcve.org/view.php?id=CVE-2024-25137

In AutomationDirect C-MORE EA9 HMI there is a program that copies a buffer of a size controlled by the user into a limited sized buffer on the stack which may lead to a stack overflow. The result of this stack-based buffer overflow can lead to denial-of-service conditions. En AutomationDirect C-MORE EA9 HMI hay un programa que copia un búfer de un tamaño controlado por el usuario en un búfer de tamaño limitado en la pila, lo que puede provocar un desbordamiento de la pila. El resultado de este desbordamiento de búfer en la región stack de la memoria puede provocar condiciones de denegación de servicio. • https://https://www.cisa.gov/news-events/ics-advisories/icsa-24-086-01 • CWE-121: Stack-based Buffer Overflow •

CVSS: 7.5EPSS: 0%CPEs: 11EXPL: 0

CVE-2024-25136 – AutomationDirect C-MORE EA9 HMI Path Traversal

https://notcve.org/view.php?id=CVE-2024-25136

There is a function in AutomationDirect C-MORE EA9 HMI that allows an attacker to send a relative path in the URL without proper sanitizing of the content. Hay una función en AutomationDirect C-MORE EA9 HMI que permite a un atacante enviar una ruta relativa en la URL sin una sanitización adecuada del contenido. • https://https://www.cisa.gov/news-events/ics-advisories/icsa-24-086-01 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 7.8EPSS: 0%CPEs: 24EXPL: 0

CVE-2022-2006 – AutomationDirect C-more EA9 HMI Uncontrolled Search Path Element

https://notcve.org/view.php?id=CVE-2022-2006

AutomationDirect DirectLOGIC has a DLL vulnerability in the install directory that may allow an attacker to execute code during the installation process. This issue affects: AutomationDirect C-more EA9 EA9-T6CL versions prior to 6.73; EA9-T6CL-R versions prior to 6.73; EA9-T7CL versions prior to 6.73; EA9-T7CL-R versions prior to 6.73; EA9-T8CL versions prior to 6.73; EA9-T10CL versions prior to 6.73; EA9-T10WCL versions prior to 6.73; EA9-T12CL versions prior to 6.73; EA9-T15CL versions prior to 6.73; EA9-RHMI versions prior to 6.73; EA9-PGMSW versions prior to 6.73; AutomationDirect DirectLOGIC presenta una vulnerabilidad de DLL en el directorio de instalación que puede permitir a un atacante ejecutar código durante el proceso de instalación. Este problema afecta a: AutomationDirect C-more EA9 EA9-T6CL versiones anteriores a 6.73; EA9-T6CL-R versiones anteriores a 6.73; EA9-T7CL versiones anteriores a 6.73; EA9-T7CL-R versiones anteriores a 6.73; EA9-T8CL versiones anteriores a 6. 73; EA9-T10CL versiones anteriores a 6.73; EA9-T10WCL versiones anteriores a 6.73; EA9-T12CL versiones anteriores a 6.73; EA9-T15CL versiones anteriores a 6.73; EA9-RHMI versiones anteriores a 6.73; EA9-PGMSW versiones anteriores a 6.73; • https://www.cisa.gov/uscert/ics/advisories/icsa-22-167-01 • CWE-427: Uncontrolled Search Path Element •

CVSS: 7.5EPSS: 0%CPEs: 24EXPL: 0

CVE-2022-2005 – AutomationDirect C-more EA9 HMI Cleartext Transmission

https://notcve.org/view.php?id=CVE-2022-2005

AutomationDirect C-more EA9 HTTP webserver uses an insecure mechanism to transport credentials from client to web server, which may allow an attacker to obtain the login credentials and login as a valid user. This issue affects: AutomationDirect C-more EA9 EA9-T6CL versions prior to 6.73; EA9-T6CL-R versions prior to 6.73; EA9-T7CL versions prior to 6.73; EA9-T7CL-R versions prior to 6.73; EA9-T8CL versions prior to 6.73; EA9-T10CL versions prior to 6.73; EA9-T10WCL versions prior to 6.73; EA9-T12CL versions prior to 6.73; EA9-T15CL versions prior to 6.73; EA9-RHMI versions prior to 6.73; EA9-PGMSW versions prior to 6.73; El servidor web HTTP de AutomationDirect C-more EA9 usa un mecanismo inseguro para transportar las credenciales del cliente al servidor web, lo que puede permitir a un atacante obtener las credenciales de inicio de sesión e iniciar sesión como un usuario válido. Este problema afecta a: AutomationDirect C-more EA9 versiones EA9-T6CL anteriores a la 6.73; EA9-T6CL-R versiones anteriores a la 6.73; EA9-T7CL versiones anteriores a la 6.73; EA9-T7CL-R versiones anteriores a la 6.73; EA9-T8CL versiones anteriores a la 6. 73; EA9-T10CL versiones anteriores a 6.73; EA9-T10WCL versiones anteriores a 6.73; EA9-T12CL versiones anteriores a 6.73; EA9-T15CL versiones anteriores a 6.73; EA9-RHMI versiones anteriores a 6.73; EA9-PGMSW versiones anteriores a 6.73; • https://www.cisa.gov/uscert/ics/advisories/icsa-22-167-01 • CWE-319: Cleartext Transmission of Sensitive Information •