Elcomplus - vulnerabilities (CVEs)
9 CVEs in 3 products, 0 in the last 30 days, newest from 2022-06-27.
Products
- Smartptt - 4 CVEs
- Smartics - 3 CVEs
- Smartptt Scada Server - 2 CVEs
Newest CVEs of Elcomplus
- CVE-2022-2106 - CVSS 3.8 (low), 2022-06-27: Elcomplus SmartICS v2.3.4.0 does not validate the filenames sufficiently, which enables authenticated administrator-level users to perform path traversal…
- CVE-2022-2088 - CVSS 6.8 (medium), 2022-06-27: An authenticated user with admin privileges may be able to terminate any process on the system running Elcomplus SmartICS v2.3.4.0.
- CVE-2022-2140 - CVSS 9 (critical), 2022-06-27: Elcomplus SmartICS v2.3.4.0 does not neutralize user-controllable input, which allows an authenticated user to inject arbitrary code into specific parameters.
- CVE-2021-43938 - CVSS 9.8 (critical), 2022-04-29: Elcomplus SmartPTT SCADA Server is vulnerable to an unauthenticated user can request various files from the server without any authentication or authorization.
- CVE-2021-43937 - CVSS 8.8 (high), 2022-04-29: Elcomplus SmartPTT SCADA Server web application does not, or cannot, sufficiently verify whether a well-formed, valid, consistent request was intentionally…
- CVE-2021-43934 - CVSS 9.8 (critical), 2022-04-28: Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate upload requests, enabling a malicious user to potentially…
- CVE-2021-43932 - CVSS 9 (critical), 2022-04-28: Elcomplus SmartPTT is vulnerable when an attacker injects JavaScript code into a specific parameter that can executed upon accessing the dashboard or the main…
- CVE-2021-43939 - CVSS 8.8 (high), 2022-04-28: Elcomplus SmartPTT is vulnerable when a low-authenticated user can access higher level administration authorization by issuing requests directly to the…
- CVE-2021-43930 - CVSS 4.9 (medium), 2022-04-28: Elcomplus SmartPTT is vulnerable as the backup and restore system does not adequately validate download requests, enabling malicious users to perform path…
