Vendor
Eaton
59 known vulnerabilities.
Products
30 results · Clear filters · Feed
-
Medium 5.9
Eaton easySoft improperly validates TLS certificates presented by easyE4 devices. A network-adjacent attacker could exp…
-
Medium 5.9
A security misconfiguration was identified in Eaton Intelligent Power Protector (IPP), where an HTTP response header wa…
-
Medium 5.7
Eaton Intelligent Power Protector (IPP) uses an insecure cookie configuration, which could allow a network‑based attack…
-
Medium 6.5
Eaton Intelligent Power Protector (IPP) software allows repeated authentication attempts against the web interface logi…
-
Medium 6.0
Due to improper input validation in one of the Eaton Intelligent Power Protector (IPP) XML, it is possible for an attac…
-
Medium 6.1
The encryption mechanism used in Eaton's EasySoft project file was insecure and susceptible to brute force attacks, an …
-
Medium 5.7
The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentia…
-
Medium 6.7
Improper quotation in search paths in the Eaton UPS Companion software installer could lead to arbitrary code execution…
-
Medium 4.7
An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing th…
-
Medium 4.7
An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing th…
-
Medium 5.7
The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentia…
-
Medium 5.6
Improper cookie attributes in Foreseer Reporting Software (FRS)
Secure flag not set and SameSIte was set to Lax in the Foreseer Reporting Software (FRS). Absence of this secure flag could lead into the session cookie being transmitted over unencrypted HTTP connections. This security issue has been resolved in the latest v…
-
Medium 6.3
Insecure storage of connection strings in FRS
The connection string visible to users with access to FRSCore database on Foreseer Reporting Software (FRS) VM, this string can be used for gaining administrative access to the 4crXref database. This vulnerability has been resolved in the latest version 1.5.1…
-
Medium 6.7
Improper Input Validation in Foreseer Reporting Software (FRS)
The user input was not sanitized on Reporting Hierarchy Management page of Foreseer Reporting Software (FRS) application which could lead into execution of arbitrary JavaScript in a browser context for all the interacting users. This security issue has been p…
-
Medium 6.7
Improper access control mechanism in IPP
IPP software prior to v1.71 is vulnerable to default credential vulnerability. This could lead attackers to identify and access vulnerable systems.
-
Medium 5.1
Insufficient verification of authenticity in IPP
IPP software versions prior to v1.71 do not sufficiently verify the authenticity of data, in a way that causes it to accept invalid data.
-
Medium 5.2
Stored Cross-site Scripting reported in Intelligent Power Manager v1
Eaton Intelligent Power Manager (IPM) prior to 1.70 is vulnerable to stored Cross site scripting. The vulnerability exists due to insufficient validation of input from certain resources by the IPM software. The attacker would need access to the local Subnet a…
-
Medium 5.6
The Eaton Foreseer software provides multiple customizable input fields for the users to configure parameters in the to…
-
Medium 6.3
The Eaton Foreseer software provides the feasibility for the user to configure external servers for multiple purposes s…
-
Medium 6.7
The Eaton Foreseer software provides users the capability to customize the dashboard in WebView pages. However, the inp…
-
Medium 5.9
Insecure storage of password in easySoft
Eaton easySoft software is used to program easy controllers and displays for configuring, programming and defining parameters for all the intelligent relays. This software has a password protection functionality to secure the project file from unauthorized ac…
-
Medium 6.8
Weak encoding vulnerability in easyE4
Eaton easyE4 PLC offers a device password protection functionality to facilitate a secure connection and prevent unauthorized access. It was observed that the device password was stored with a weak encoding algorithm in the easyE4 program file when exported t…
-
Medium 4.7
Security issue in SMP Gateway automation platform
Denial-of-service vulnerability in the web server of the Eaton SMP Gateway allows attacker to potentially force an unexpected restart of the automation platform, impacting the availability of the product. In rare situations, the issue could cause the SMP devi…
-
Medium 5.2
Security issues in Eaton Intelligent Power Protector (IPP)
Eaton Intelligent Power Protector (IPP) prior to version 1.69 is vulnerable to stored Cross Site Scripting. The vulnerability exists due to insufficient validation of user input and improper encoding of the output for certain resources within the IPP software.
-
Medium 5.7
Security issues in Eaton Intelligent Power Manager Infrastructure
Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) version 1.5.0plus205 and all prior versions are vulnerable to CSV Formula Injection. This issue affects: Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) all version 1.5.0p…
-
Medium 5.7
Security issues in Eaton Intelligent Power Manager Infrastructure
Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure) version 1.5.0plus205 and all prior versions are vulnerable to Stored Cross-site Scripting vulnerability. This issue affects: Eaton Intelligent Power Manager Infrastructure (IPM Infrastructure…
-
Medium 5.6
Security issues in Intelligent Power Protector
The vulnerability exists due to insufficient validation of input from certain resources by the IPP software. The attacker would need access to the local Subnet and an administrator interaction to compromise the system. This issue affects: Intelligent Power Pr…
-
Medium 5.6
Security issues in Intelligent Power Manager (IPM 1)
The vulnerability exists due to insufficient validation of input of certain resources within the IPM software. This issue affects: Intelligent Power Manager (IPM 1) versions prior to 1.70.
-
Medium 5.8
File parsing Type Confusion Remote code execution vulerability
Eaton's easySoft software v7.xx prior to v7.22 are susceptible to file parsing type confusion remote code execution vulnerability. A malicious entity can execute a malicious code or make the application crash by tricking user upload a malformed .E70 file in t…
-
Medium 5.8
File parsing Out-Of-Bounds read remote code execution
The Eaton's easySoft software v7.xx prior to v7.22 are susceptible to Out-of-bounds remote code execution vulnerability. A malicious entity can execute a malicious code or make the application crash by tricking user to upload the malformed .E70 file in the ap…