Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: ANDRITZ Clear all filters
TI-2026-46518 CVE-2026-65311 · GHSA-cv9h-3483-8gjq

Missing authentication for logging-configuration endpoint

Priority LOW 30

The HTTP server component of ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions exposes an undocumented endpoint that changes the server's logging level and target without requiring authentication.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00455 Published 2026-07-31 Fixed in 8.00 CWE-284
TI-2026-46517 CVE-2026-65310 · GHSA-7cj5-w2hx-f2wc

Missing authentication and permissive CORS policy

Priority LOW 39

ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration of affected versions, exposes its data and configuration endpoint without any authentication and permissive CORS on every response.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.005 Published 2026-07-31 Fixed in 7.40 CWE-306
TI-2026-46516 CVE-2026-65309 · GHSA-9mhg-63g6-hvrp

Storage of passwords in a reversible format

Priority LOW 32

ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions stores and transmits user passwords using a reversible format instead of a one-way password hash.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00245 Published 2026-07-31 Fixed in 7.50 CWE-257