TI-2023-03060 CVE-2023-3267 · GHSA-hpm4-5h9r-6rg6
OS command injection in CyberPower PowerPanel Enterprise
Priority MEDIUM 45
When adding a remote backup location, an authenticated user can pass arbitrary OS commands through the username field.
Vulnerabilities
6 records
TI-2023-03059 CVE-2023-3266 · GHSA-928v-hp47-95m3
A non-feature complete authentication mechanism exists in the production application…
Priority MEDIUM 51
A non-feature complete authentication mechanism exists in the production application allowing an attacker to bypass all authentication checks if LDAP authentication is selected.An unauthenticated attacker can leverage th…
TI-2023-03058 CVE-2023-3265 · GHSA-4f45-vh57-p56g
An authentication bypass exists on CyberPower PowerPanel Enterprise by failing to…
Priority MEDIUM 52
An authentication bypass exists on CyberPower PowerPanel Enterprise by failing to sanitize meta-characters from the username, allowing an attacker to login into the application with the default user "cyberpower" by appen…
TI-2023-03057 CVE-2023-3264 · GHSA-8x2v-2298-37mj
Hard-coded credentials in Dataprobe iBoot PDU
Priority MEDIUM 43
The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier uses hard-coded credentials for all interactions with the internal Postgres database.
TI-2023-03054 CVE-2023-3261 · GHSA-2868-gw76-97vq
Memory corruption in Dataprobe iBoot PDU
Priority MEDIUM 40
The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier contains a buffer overflow vulnerability in the librta.so.0.0.0 library.Successful exploitation could cause denial of service or unexpected behavi…
TI-2023-03053 CVE-2023-3260 · GHSA-xrfp-wpx5-pg4h
OS command injection in Dataprobe iBoot PDU
Priority MEDIUM 43
The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to command injection via the `user-name` URL parameter.