Gavazziautomation
Gavazziautomation UWP 3.0 Monitoring Gateway AND Controller Firmware: vulnerabilidades y CVE
Gavazziautomation UWP 3.0 Monitoring Gateway AND Controller Firmware tiene 11 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 6 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE11
Últimos 12 meses0
Críticas6
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2022-28816 | Media (6.1) | 0.43% | — | 28 sept 2022 | In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 the Sentilo Proxy is prone to reflected XSS which only affects the Sentilo service. |
| CVE-2022-28815 | Baja (2.7) | 0.53% | — | 28 sept 2022 | In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 the Sentilo Proxy server was discovered to contain a SQL injection vulnerability allowing an attacker to query other tables of the… |
| CVE-2022-28814 | Crítica (9.8) | 1.3% | — | 28 sept 2022 | Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 was discovered to be vulnerable to a relative path traversal vulnerability which enables remote attackers to read arbitrary files and… |
| CVE-2022-28813 | Alta (7.5) | 1.0% | — | 28 sept 2022 | In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of an SQL-injection to gain access to a volatile temporary database with the… |
| CVE-2022-28812 | Crítica (9.8) | 1.0% | — | 28 sept 2022 | In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of hard-coded credentials to gain SuperUser access to the device. |
| CVE-2022-28811 | Crítica (9.8) | 1.2% | — | 28 sept 2022 | In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could utilize an improper input validation on an API-submitted parameter to execute arbitrary OS… |
| CVE-2022-22526 | Crítica (9.8) | 0.84% | — | 28 sept 2022 | In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a missing authentication allows for full access via API. |
| CVE-2022-22525 | Alta (7.2) | 1.2% | — | 28 sept 2022 | In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 an remote attacker with admin rights could execute arbitrary commands due to missing input sanitization in the backup restore function |
| CVE-2022-22524 | Crítica (9.4) | 1.2% | — | 28 sept 2022 | In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 an unauthenticated remote attacker could utilize a SQL-Injection vulnerability to gain full database access, modify users and stop… |
| CVE-2022-22523 | Alta (7.5) | 0.86% | — | 28 sept 2022 | An improper authentication vulnerability exists in the Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 Web-App which allows an authentication bypass to the context of an unauthorised… |
| CVE-2022-22522 | Crítica (9.8) | 1.1% | — | 28 sept 2022 | In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of hard-coded credentials to gain full access to the device. |