Cyberpower Powerpanel_server
6 CVEs affecting Cyberpower Powerpanel_server. Latest disclosed: 2023-08-14. Critical: 3, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-3266 | Critical | 9.8 | 2023-08-14 | A non-feature complete authentication mechanism exists in the production application allowing an attacker to bypass all authentication checks if LDAP authentic… |
CVE-2023-3265 | Critical | 9.8 | 2023-08-14 | An authentication bypass exists on CyberPower PowerPanel Enterprise by failing to sanitize meta-characters from the username, allowing an attacker to login int… |
CVE-2023-3267 | Critical | 9.1 | 2023-08-14 | When adding a remote backup location, an authenticated user can pass arbitrary OS commands through the username field. The username is passed without sanitizat… |
CVE-2023-3261 | High | 7.5 | 2023-08-14 | The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier contains a buffer overflow vulnerability in the librta.so.0.0.0 library.Successful ex… |
CVE-2023-3260 | High | 7.2 | 2023-08-14 | The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to command injection via the `user-name` URL parameter. An authenticate… |
CVE-2023-3264 | Medium | 6.7 | 2023-08-14 | The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier uses hard-coded credentials for all interactions with the internal Postgres database… |