Vulnerabilities

TI-2018-15985 CVE-2018-1000631 · GHSA-h34f-jfj7-68j2

Battelle V2I Hub 3.0 is vulnerable to SQL injection.

MEDIUM 47

Battelle V2I Hub 3.0 is vulnerable to SQL injection.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02346 Published 2018-12-28 No fix listed CWE-89

TI-2018-15984 CVE-2018-1000630 · GHSA-mg74-x7cm-fcp3

Battelle V2I Hub 2.5.1 is vulnerable to SQL injection.

LOW 35

Battelle V2I Hub 2.5.1 is vulnerable to SQL injection.

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.01856 Published 2018-12-28 No fix listed CWE-89

TI-2018-15983 CVE-2018-1000629 · GHSA-3mgx-38jx-2wgw

Battelle V2I Hub 2.5.1 is vulnerable to cross-site scripting, caused by improper…

LOW 30

Battelle V2I Hub 2.5.1 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by api/SystemConfigActions.php?action=add and the index.php script.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01277 Published 2018-12-28 No fix listed CWE-79

TI-2018-15982 CVE-2018-1000628 · GHSA-3mgj-2f83-wr3q

Battelle V2I Hub 2.5.1 could allow a remote attacker to bypass security restrictions…

MEDIUM 47

Battelle V2I Hub 2.5.1 could allow a remote attacker to bypass security restrictions, caused by the direct checking of the API key against a user-supplied value in PHP's GET global variable array using PHP's strcmp() fun…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02848 Published 2018-12-28 No fix listed

TI-2018-15981 CVE-2018-1000627 · GHSA-h89g-92w5-6r7q

Battelle V2I Hub 2.5.1 could allow a remote attacker to obtain sensitive information…

MEDIUM 46

Battelle V2I Hub 2.5.1 could allow a remote attacker to obtain sensitive information, caused by the failure to restrict access to the API key file.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02281 Published 2018-12-28 No fix listed CWE-522

TI-2018-15980 CVE-2018-1000626 · GHSA-wjf4-qx4c-9q8h

Battelle V2I Hub 2.5.1 could allow a remote attacker to bypass security restrictions…

MEDIUM 47

Battelle V2I Hub 2.5.1 could allow a remote attacker to bypass security restrictions, caused by the lack of requirement to change the default API key.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02848 Published 2018-12-28 No fix listed

TI-2018-15979 CVE-2018-1000625 · GHSA-j3gq-75j7-7266

Battelle V2I Hub 2.5.1 contains hard-coded credentials for the administrative account.

MEDIUM 46

Battelle V2I Hub 2.5.1 contains hard-coded credentials for the administrative account.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.0228 Published 2018-12-28 No fix listed CWE-798

TI-2018-15978 CVE-2018-1000624 · GHSA-jf4r-98w7-6qr2

Battelle V2I Hub 2.5.1 is vulnerable to a denial of service, caused by the failure to…

LOW 37

Battelle V2I Hub 2.5.1 is vulnerable to a denial of service, caused by the failure to restrict access to a sensitive functionality.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.02218 Published 2018-12-28 No fix listed CWE-269

Vulnerabilities

Filters