CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 1CVE-2018-10693
https://notcve.org/view.php?id=CVE-2018-10693
An issue was discovered on Moxa AWK-3121 1.14 devices. It provides ping functionality so that an administrator can execute ICMP calls to check if the network is working correctly. However, the same functionality allows an attacker to execute commands on the device. The POST parameter "srvName" is susceptible to a buffer overflow. By crafting a packet that contains a string of 516 characters, it is possible for an attacker to execute the attack. • http://packetstormsecurity.com/files/153223/Moxa-AWK-3121-1.14-Information-Disclosure-Command-Execution.html https://github.com/samuelhuntley/Moxa_AWK_1121/blob/master/Moxa_AWK_1121 https://seclists.org/bugtraq/2019/Jun/8 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 1CVE-2018-10692
https://notcve.org/view.php?id=CVE-2018-10692
An issue was discovered on Moxa AWK-3121 1.14 devices. The session cookie "Password508" does not have an HttpOnly flag. This allows an attacker who is able to execute a cross-site scripting attack to steal the cookie very easily. Fue encontrado un problema en los dispositivos Moxa AWK-3121 versión 1.14. La cookie de sesión "Password508" no presenta una bandera HttpOnly. • http://packetstormsecurity.com/files/153223/Moxa-AWK-3121-1.14-Information-Disclosure-Command-Execution.html https://github.com/samuelhuntley/Moxa_AWK_1121/blob/master/Moxa_AWK_1121 https://seclists.org/bugtraq/2019/Jun/8 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2018-10691
https://notcve.org/view.php?id=CVE-2018-10691
An issue was discovered on Moxa AWK-3121 1.14 devices. It is intended that an administrator can download /systemlog.log (the system log). However, the same functionality allows an attacker to download the file without any authentication or authorization. Fue encontrado un problema en los dispositivos Moxa AWK-3121 versión 1.14. Se pretende que un administrador pueda descargar el archivo /SystemLog.log (el registro de sistema). • http://packetstormsecurity.com/files/153223/Moxa-AWK-3121-1.14-Information-Disclosure-Command-Execution.html https://github.com/samuelhuntley/Moxa_AWK_1121/blob/master/Moxa_AWK_1121 https://seclists.org/bugtraq/2019/Jun/8 • CWE-284: Improper Access Control •
CVSS: 8.1EPSS: 1%CPEs: 2EXPL: 2CVE-2018-10690
https://notcve.org/view.php?id=CVE-2018-10690
An issue was discovered on Moxa AWK-3121 1.14 devices. The device by default allows HTTP traffic thus providing an insecure communication mechanism for a user connecting to the web server. This allows an attacker to sniff the traffic easily and allows an attacker to compromise sensitive data such as credentials. Fue encontrado un problema en los dispositivos Moxa AWK-3121 versión 1.14. El dispositivo por defecto permite el tráfico HTTP así que proporciona un mecanismo de comunicación no seguro para un usuario que conecta con el servidor Web. • http://packetstormsecurity.com/files/153223/Moxa-AWK-3121-1.14-Information-Disclosure-Command-Execution.html https://github.com/samuelhuntley/Moxa_AWK_1121/blob/master/Moxa_AWK_1121 https://seclists.org/bugtraq/2019/Jun/8 • CWE-311: Missing Encryption of Sensitive Data •
CVSS: 6.5EPSS: 0%CPEs: 28EXPL: 0CVE-2016-8362
https://notcve.org/view.php?id=CVE-2016-8362
An issue was discovered in Moxa OnCell OnCellG3470A-LTE, AWK-1131A/3131A/4131A Series, AWK-3191 Series, AWK-5232/6232 Series, AWK-1121/1127 Series, WAC-1001 V2 Series, WAC-2004 Series, AWK-3121-M12-RTG Series, AWK-3131-M12-RCC Series, AWK-5232-M12-RCC Series, TAP-6226 Series, AWK-3121/4121 Series, AWK-3131/4131 Series, and AWK-5222/6222 Series. Any user is able to download log files by accessing a specific URL. Ha sido descubierto un problema en Moxa OnCell OnCellG3470A-LTE, AWK-1131A/3131A/4131A Series, AWK-3191 Series, AWK-5232/6232 Series, AWK-1121/1127 Series, WAC-1001 V2 Series, WAC-2004 Series, AWK-3121-M12-RTG Series, AWK-3131-M12-RCC Series, AWK-5232-M12-RCC Series, TAP-6226 Series, AWK-3121/4121 Series, AWK-3131/4131 Series y AWK-5222/6222 Series. Cualquier usuario puede descargar archivos de inicio de sesión al acceder a una URL específica. • http://www.securityfocus.com/bid/94092 https://ics-cert.us-cert.gov/advisories/ICSA-16-308-01 • CWE-287: Improper Authentication •