Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

12 records

Vendor: Eaton Component: Intelligent Power Manager Clear all filters
TI-2021-06024 CVE-2021-23286 · GHSA-7pmh-g9pc-h622

Security issues in Eaton Intelligent Power Manager Infrastructure

Priority LOW 35

Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) version 1.5.0plus205 and all prior versions are vulnerable to CSV Formula Injection.

CVSS 3.1HIGH 8.0 Adjacent network No auth User interaction EPSS 0.00419 Published 2022-04-18 No fix listed CWE-1236
TI-2021-06023 CVE-2021-23285 · GHSA-hxrm-74mf-m4wm

Security issues in Eaton Intelligent Power Manager Infrastructure

Priority LOW 22

Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) version 1.5.0plus205 and all prior versions are vulnerable to reflected Cross-site Scripting vulnerability.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00422 Published 2022-04-18 No fix listed CWE-79
TI-2021-06025 CVE-2021-23287 · GHSA-gmcp-3xfw-qqwf

Security issues in Intelligent Power Manager (IPM 1)

Priority LOW 26

The vulnerability exists due to insufficient validation of input of certain resources within the IPM software.

CVSS 3.1MEDIUM 5.6 Adjacent network High privileges User interaction EPSS 0.00462 Published 2022-04-01 Fixed in 1.70 CWE-79
TI-2021-06018 CVE-2021-23280 · GHSA-52vj-66ff-3q3r

Arbitrary file upload in Eaton Intelligent Power manager

Priority MEDIUM 44

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file upload vulnerability.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00904 Published 2021-04-13 Fixed in 1.69 CWE-434
TI-2021-06019 CVE-2021-23281 · GHSA-p6w4-xgmf-8r7g

Remote code execution in Eaton Intelligent Power manager

Priority MEDIUM 47

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated remote code execution vulnerability.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.02314 Published 2021-04-13 Fixed in 1.69 CWE-94
TI-2021-06017 CVE-2021-23279 · GHSA-h7cg-8375-67fx

Arbitrary File delete

Priority HIGH 65

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated arbitrary file delete vulnerability induced due to improper input validation in meta_driver_srv.js class with saveDriverData action usi…

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.27947 Published 2021-04-13 Fixed in 1.69 CWE-20
TI-2021-06016 CVE-2021-23278 · GHSA-9wgr-5887-h4gv

Arbitrary File delete

Priority MEDIUM 43

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file delete vulnerability induced due to improper input validation at server/maps_srv.js with action removeBackground and serve…

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.01052 Published 2021-04-13 Fixed in 1.69 CWE-20
TI-2020-05470 CVE-2020-6651 · GHSA-h5vj-g7qc-m75w

Command injection via specially crafted file name during config file upload

Priority MEDIUM 42

Improper Input Validation in Eaton's Intelligent Power Manager (IPM) v 1.67 & prior on file name during configuration file import functionality allows attackers to perform command injection or code execution via speciall…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02147 Published 2020-05-07 No fix listed CWE-20
TI-2020-05471 CVE-2020-6652 · GHSA-8wh6-v49g-v744

Incorrect privilege assignment allowing non-admin users to upload config files

Priority LOW 34

Incorrect Privilege Assignment vulnerability in Eaton's Intelligent Power Manager (IPM) v1.67 & prior allow non-admin users to upload the system configuration files by sending specially crafted requests.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00356 Published 2020-05-07 No fix listed CWE-266