Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2021-23280

Arbitrary File upload

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file upload vulnerability. IPM’s maps_srv.js allows an attacker to upload a malicious NodeJS file using uploadBackgroud action. An attacker can upload a malicious code or execute any command using a specially crafted packet to exploit the vulnerability.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Vendors
Eaton
Products
Intelligent Power Manager Intelligent Power Manager Virtual Appliance Intelligent Power Protector
CVE-2021-23279

Arbitrary File delete

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated arbitrary file delete vulnerability induced due to improper input validation in meta_driver_srv.js class with saveDriverData action using invalidated driverID. An attacker can send specially crafted packets to delete the files on the system where IPM software is installed.

CVSS 3.1 · 8 High EPSS 27.9% KEV · Not listed
Vendors
Eaton
Products
Intelligent Power Manager Intelligent Power Manager Virtual Appliance Intelligent Power Protector
CVE-2021-23278

Arbitrary File delete

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated arbitrary file delete vulnerability induced due to improper input validation at server/maps_srv.js with action removeBackground and server/node_upgrade_srv.js with action removeFirmware. An attacker can send specially crafted packets to delete the files on the system where IPM software is installed.

CVSS 3.1 · 8.7 High EPSS 1.1% KEV · Not listed
Vendors
Eaton
Products
Intelligent Power Manager Intelligent Power Manager Virtual Appliance Intelligent Power Protector
CVE-2021-23277

Improper Neutralization of Directives in Dynamically Evaluated Code

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated eval injection vulnerability. The software does not neutralize code syntax from users before using in the dynamic evaluation call in loadUserFile function under scripts/libs/utils.js. Successful exploitation can allow attackers to control the input to the function and execute attacker controlled commands.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Eaton
Products
Intelligent Power Manager Intelligent Power Manager Virtual Appliance Intelligent Power Protector
CVE-2021-23276

Improper Neutralization of Special Elements used in an SQL Command

Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to authenticated SQL injection. A malicious user can send a specially crafted packet to exploit the vulnerability. Successful exploitation of this vulnerability can allow attackers to add users in the data base.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Eaton
Products
Intelligent Power Manager Intelligent Power Manager Virtual Appliance Intelligent Power Protector