CVSS: 6.4EPSS: 0%CPEs: 2EXPL: 0CVE-2022-47187 – File upload XSS vulnerability in Generex CS141
https://notcve.org/view.php?id=CVE-2022-47187
28 Sep 2023 — There is a file upload XSS vulnerability in Generex CS141 below 2.06 version. The web application allows file uploading, making it possible to upload a file with HTML content. When HTML files are allowed, XSS payload can be injected into the uploaded file. Hay una vulnerabilidad XSS de carga de archivos en Generex CS141 por debajo de la versión 2.06. La aplicación web permite la carga de archivos, posibilitando la carga de un archivo con contenido HTML. • https://www.generex.de/support/changelogs/cs141/2-12 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.4EPSS: 0%CPEs: 2EXPL: 0CVE-2022-47186 – Unrestricted Upload of File vulnerability in Generex CS141
https://notcve.org/view.php?id=CVE-2022-47186
28 Sep 2023 — There is an unrestricted upload of file vulnerability in Generex CS141 below 2.06 version. An attacker could upload and/or delete any type of file, without any format restriction and without any authentication, in the "upload" directory. Hay una vulnerabilidad de carga de archivos sin restricciones en Generex CS141 por debajo de la versión 2.06. Un atacante podría cargar y/o eliminar cualquier tipo de archivo, sin ninguna restricción de formato y sin ninguna autenticación, en el directorio "upload". • https://www.generex.de/support/changelogs/cs141/page:2 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 10.0EPSS: 1%CPEs: 2EXPL: 0CVE-2022-47190 – RCE via file upload vulnerability in Generex CS141
https://notcve.org/view.php?id=CVE-2022-47190
31 Mar 2023 — Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a firmware file containing a webshell that could allow him to execute arbitrary code as root. • https://www.generex.de/support/changelogs/cs141/2-12 • CWE-20: Improper Input Validation CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 0CVE-2022-47191 – Privilege Escalation via file upload vulnerability at Generex CS141
https://notcve.org/view.php?id=CVE-2022-47191
31 Mar 2023 — Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a firmware file containing a file with modified permissions, allowing him to escalate privileges. • https://www.generex.de/support/changelogs/cs141/2-12 • CWE-20: Improper Input Validation CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 0CVE-2022-47192 – Admin password reset via file upload vulnerability in Generex CS141
https://notcve.org/view.php?id=CVE-2022-47192
31 Mar 2023 — Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a backup file containing a modified "users.json" to the web server of the device, allowing him to replace the administrator password. • https://www.generex.de/support/changelogs/cs141/2-12 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-47188 – Improper Input Validation in Generex CS141
https://notcve.org/view.php?id=CVE-2022-47188
31 Mar 2023 — There is an arbitrary file reading vulnerability in Generex UPS CS141 below 2.06 version. An attacker, making use of the default credentials, could upload a backup file containing a symlink to /etc/shadow, allowing him to obtain the content of this path. • https://www.generex.de/support/changelogs/cs141/2-12 • CWE-20: Improper Input Validation CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 9.4EPSS: 0%CPEs: 2EXPL: 0CVE-2022-47189 – DoS via file upload vulnerability at Generex CS141
https://notcve.org/view.php?id=CVE-2022-47189
31 Mar 2023 — Generex UPS CS141 below 2.06 version, allows an attacker toupload a firmware file containing an incorrect configuration, in order to disrupt the normal functionality of the device. • https://www.generex.de/support/changelogs/cs141/2-12 • CWE-20: Improper Input Validation •
CVSS: 9.1EPSS: 3%CPEs: 2EXPL: 1CVE-2022-42457
https://notcve.org/view.php?id=CVE-2022-42457
06 Oct 2022 — Generex CS141 through 2.10 allows remote command execution by administrators via a web interface that reaches run_update in /usr/bin/gxserve-update.sh (e.g., command execution can occur via a reverse shell installed by install.sh). Generex CS141 hasta la versión 2.10 permite la ejecución de comandos remotos por parte de los administradores a través de una interfaz web que llega a run_update en /usr/bin/gxserve-update.sh (por ejemplo, la ejecución de comandos puede ocurrir a través de un shell inverso instal... • https://github.com/hubertfarnsworth12/Generex-CS141-Authenticated-Remote-Command-Execution •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2020-11420
https://notcve.org/view.php?id=CVE-2020-11420
27 Apr 2020 — UPS Adapter CS141 before 1.90 allows Directory Traversal. An attacker with Admin or Engineer login credentials could exploit the vulnerability by manipulating variables that reference files and by doing this achieve access to files and directories outside the web root folder. An attacker may access arbitrary files and directories stored in the file system, but integrity of the files are not jeopardized as attacker have read access rights only. UPS Adapter CS141 versiones anteriores a la versión 1.90, permit... • https://library.e.abb.com/public/ee46f3ff5823400f991ebd9bd43a297e/2CMT2020-005913%20Security%20Advisory%20CS141.pdf • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •