Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Release: Microchip TimeProvider 4100 2.4.7 Clear all filters
TI-2024-29286 CVE-2024-43683 · GHSA-x22r-xgr5-23hh

Improper verification of the Host header in TimeProvider 4100

Priority LOW 39

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Microchip TimeProvider 4100 allows XSS Through HTTP Headers.This issue affects TimeProvider 4100: from 1.0.

CVSS 4.0HIGH 8.7 Network No auth User interaction EPSS 0.00226 Published 2024-10-04 Fixed in 2.4.7 CWE-601
TI-2024-29288 CVE-2024-43685 · GHSA-mwp3-45p3-xq9x

Session token fixation in TimeProvider 4100

Priority MEDIUM 40

Improper Authentication vulnerability in Microchip TimeProvider 4100 (login modules) allows Session Hijacking.This issue affects TimeProvider 4100: from 1.0 before 2.4.7.

CVSS 4.0HIGH 8.7 Network No auth User interaction EPSS 0.0044 Published 2024-10-04 Fixed in 2.4.7 CWE-613
TI-2024-29289 CVE-2024-43686 · GHSA-mf33-2wpg-fv43

Reflected XSS in TimeProvider 4100 chart component

Priority LOW 39

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip TimeProvider 4100 (data plot modules) allows Reflected XSS.This issue affects TimeProvider 4100: from…

CVSS 4.0MEDIUM 5.4 Adjacent network Low privileges User interaction EPSS 0.12987 Published 2024-10-04 Fixed in 2.4.7 CWE-79
TI-2024-08405 CVE-2024-9054 · GHSA-69rg-jv6m-76wg

Remote code Execution inTimeProvider® 4100

Priority MEDIUM 55

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Microchip TimeProvider 4100 (Configuration modules)…

CVSS 4.0HIGH 8.5 Network Low privileges User interaction EPSS 0.15626 Published 2024-10-04 Fixed in 2.4.7 CWE-78
TI-2024-07232 CVE-2024-7801 · GHSA-hmr6-x7h8-r5mp

SQL injection in get_chart_data in TimeProvider 4100

Priority LOW 30

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Microchip TimeProvider 4100 (Data plot modules) allows SQL Injection.This issue affects TimeProvider 4100: from 1.0 be…

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00843 Published 2024-10-04 Fixed in 2.4.7 CWE-89