Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 11

Export CSV
CVE-2022-28813

SQL-injection in Car Park Server 3.0 allows for full database access.

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of an SQL-injection to gain access to a volatile temporary database with the current states of the device.

CVSS 3.1 · 7.5 High EPSS 1.0% KEV · Not listed
Vendors
Gavazziautomation
Products
Cpy Car Park Server Uwp 3.0 Monitoring Gateway And Controller Uwp 3.0 Monitoring Gateway And Controller Firmware
CVE-2022-22522

Hard-coded credentials in Carlo Gavazzi UWP3.0 allows for authentication bypass and full control of the device

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of hard-coded credentials to gain full access to the device.

CVSS 3.1 · 9.8 Critical EPSS 1.2% KEV · Not listed
Vendors
Gavazziautomation
Products
Cpy Car Park Server Uwp 3.0 Monitoring Gateway And Controller Uwp 3.0 Monitoring Gateway And Controller Firmware
CVE-2022-22523

Carlo Gavazzi UWP 3.0 WebApp allows for authentication bypass

An improper authentication vulnerability exists in the Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 Web-App which allows an authentication bypass to the context of an unauthorised user if free-access is disabled.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Gavazziautomation
Products
Cpy Car Park Server Uwp 3.0 Monitoring Gateway And Controller Uwp 3.0 Monitoring Gateway And Controller Firmware
CVE-2022-22524

SQL-injection in Carlo Gavazzi UWP 3.0 allows for full database access

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 an unauthenticated remote attacker could utilize a SQL-Injection vulnerability to gain full database access, modify users and stop services .

CVSS 3.1 · 9.4 Critical EPSS 1.2% KEV · Not listed
Vendors
Gavazziautomation
Products
Cpy Car Park Server Uwp 3.0 Monitoring Gateway And Controller Uwp 3.0 Monitoring Gateway And Controller Firmware
CVE-2022-22525

Command injection in restore function of Carlo Gavazzi UWP3.0 allows for command injection

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 an remote attacker with admin rights could execute arbitrary commands due to missing input sanitization in the backup restore function

CVSS 3.1 · 7.2 High EPSS 1.2% KEV · Not listed
Vendors
Gavazziautomation
Products
Cpy Car Park Server Uwp 3.0 Monitoring Gateway And Controller Uwp 3.0 Monitoring Gateway And Controller Firmware
CVE-2022-28811

Possible command injection in Car Park Server in Carlo Gavazzi UWP3.0

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could utilize an improper input validation on an API-submitted parameter to execute arbitrary OS commands.

CVSS 3.1 · 9.8 Critical EPSS 1.3% KEV · Not listed
Vendors
Gavazziautomation
Products
Cpy Car Park Server Uwp 3.0 Monitoring Gateway And Controller Uwp 3.0 Monitoring Gateway And Controller Firmware
CVE-2022-28815

SQL-Injection in Carlo Gavazzi UWP 3.0 Sentilo Proxy

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 the Sentilo Proxy server was discovered to contain a SQL injection vulnerability allowing an attacker to query other tables of the Sentilo service.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Gavazziautomation
Products
Cpy Car Park Server Uwp 3.0 Monitoring Gateway And Controller Uwp 3.0 Monitoring Gateway And Controller Firmware
CVE-2022-28814

Path traversal in Carlo Gavazzi UWP 3.0 could lead to full device access

Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 was discovered to be vulnerable to a relative path traversal vulnerability which enables remote attackers to read arbitrary files and gain full control of the device.

CVSS 3.1 · 9.8 Critical EPSS 1.3% KEV · Not listed
Vendors
Gavazziautomation
Products
Cpy Car Park Server Uwp 3.0 Monitoring Gateway And Controller Uwp 3.0 Monitoring Gateway And Controller Firmware
CVE-2022-28812

Use of Hard-coded Credentials in UWP3.0 allows SuperUser authentication bypass in Car Park Server.

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of hard-coded credentials to gain SuperUser access to the device.

CVSS 3.1 · 9.8 Critical EPSS 1.0% KEV · Not listed
Vendors
Gavazziautomation
Products
Cpy Car Park Server Uwp 3.0 Monitoring Gateway And Controller Uwp 3.0 Monitoring Gateway And Controller Firmware