Delta Electronics
Page 2 of 3 — Delta Electronics CVEs from a corpus of 224, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-39226 | Critical | 9.8 | 2023-11-30 | In Delta Electronics InfraSuite Device Master v.1.0.7, a vulnerability exists that allows an unauthenticated attacker to execute arbitrary code through a singl… |
CVE-2023-5461 | Low | 3.7 | 2023-10-09 | A vulnerability was found in Delta Electronics WPLSoft 2.51. It has been classified as problematic. Affected is an unknown function of the component Modbus Han… |
CVE-2023-5460 | Low | 3.5 | 2023-10-09 | A vulnerability was found in Delta Electronics WPLSoft up to 2.51 and classified as problematic. This issue affects some unknown processing of the component Mo… |
CVE-2023-5459 | Medium | 6.5 | 2023-10-09 | A vulnerability has been found in Delta Electronics DVP32ES2 PLC 1.48 and classified as critical. This vulnerability affects unknown code of the component Pass… |
CVE-2023-5068 | High | 7.8 | 2023-09-21 | Delta Electronics DIAScreen may write past the end of an allocated buffer while parsing a specially crafted input file. This could allow an attacker to execu… |
CVE-2023-34316 | Medium | 6.5 | 2023-07-10 | An attacker could bypass the latest Delta Electronics InfraSuite Device Master (versions prior to 1.0.7) patch, which could allow an attacker to retrieve file… |
CVE-2023-30765 | High | 8.8 | 2023-07-10 | Delta Electronics InfraSuite Device Master versions prior to 1.0.7 contain improper access controls that could allow an attacker to alter privilege management… |
CVE-2023-34347 | Critical | 9.8 | 2023-07-10 | Delta Electronics InfraSuite Device Master versions prior to 1.0.7 contains classes that cannot be deserialized, which could allow an attack to remotely ex… |
CVE-2023-25177 | High | 7.8 | 2023-06-07 | Delta Electronics' CNCSoft-B DOPSoft versions 1.0.0.4 and prior are vulnerable to stack-based buffer overflow, which could allow an attacker to execute arbi… |
CVE-2023-24014 | High | 7.8 | 2023-06-07 | Delta Electronics' CNCSoft-B DOPSoft versions 1.0.0.4 and prior are vulnerable to heap-based buffer overflow, which could allow an attacker to execute arbitr… |
CVE-2023-0432 | Critical | 9.0 | 2023-03-31 | The web configuration service of the affected device contains an authenticated command injection vulnerability. It can be used to execute system commands on t… |
CVE-2023-1145 | High | 7.8 | 2023-03-27 | Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a deserialization vulnerability targeting the Device-DataCollect serv… |
CVE-2023-1144 | High | 8.8 | 2023-03-27 | Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contains an improper access control vulnerability in which an attacker can use the Device-Ga… |
CVE-2023-1143 | High | 8.8 | 2023-03-27 | In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could use Lua scripts, which could allow an attacker to remotely execute arb… |
CVE-2023-1142 | High | 7.5 | 2023-03-27 | In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could use URL decoding to retrieve system files, credentials, and bypass aut… |
CVE-2023-1141 | High | 8.8 | 2023-03-27 | Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a command injection vulnerability that could allow an attacker to inject arbitrary c… |
CVE-2023-1140 | Critical | 9.8 | 2023-03-27 | Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability that could allow an attacker to achieve unauthenticated remote code… |
CVE-2023-1139 | High | 8.8 | 2023-03-27 | Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a deserialization vulnerability targeting the Device-gateway service, which… |
CVE-2023-1138 | High | 7.5 | 2023-03-27 | Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain an improper access control vulnerability, which could allow an attacker to retrieve… |
CVE-2023-1137 | Medium | 6.5 | 2023-03-27 | Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability in which a low-level user could extract files and plaintext credenti… |
CVE-2023-1136 | Critical | 9.8 | 2023-03-27 | In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an unauthenticated attacker could generate a valid token, which would lead to authentica… |
CVE-2023-1135 | High | 7.8 | 2023-03-27 | In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could set incorrect directory permissions, which co… |
CVE-2023-1134 | High | 7.1 | 2023-03-27 | Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a path traversal vulnerability, which could allow an attacker to read local… |
CVE-2023-1133 | Critical | 9.8 | 2023-03-27 | Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability in which the Device-status service listens on port 10100/ UDP by def… |
CVE-2023-0822 | High | 8.8 | 2023-02-17 | The affected product DIAEnergie (versions prior to v1.9.03.001) contains improper authorization, which could allow an unauthorized user to bypass authorizatio… |
CVE-2023-0251 | High | 7.8 | 2023-02-08 | Delta Electronics DIAScreen versions 1.2.1.23 and prior are vulnerable to a buffer overflow through improper restrictions of operations within memory, which co… |
CVE-2023-0250 | High | 7.8 | 2023-02-08 | Delta Electronics DIAScreen versions 1.2.1.23 and prior are vulnerable to a stack-based buffer overflow, which could allow an attacker to remotely execute arbi… |
CVE-2023-0249 | High | 7.8 | 2023-02-08 | Delta Electronics DIAScreen versions 1.2.1.23 and prior are vulnerable to out-of-bounds write, which may allow an attacker to remotely execute arbitrary code. |
CVE-2022-41778 | Critical | 9.8 | 2023-01-13 | Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize user-supplied data provided through the Device-DataCollect service port wi… |
CVE-2022-2966 | Low | 3.3 | 2022-12-16 | Out-of-bounds Read vulnerability in Delta Electronics DOPSoft.This issue affects DOPSoft: All Versions. |
CVE-2022-2660 | Critical | 9.8 | 2022-12-13 | Delta Industrial Automation DIALink versions 1.4.0.0 and prior are vulnerable to the use of a hard-coded cryptographic key which could allow an attacker to dec… |
CVE-2022-43506 | High | 8.8 | 2022-11-17 | SQL Injection in HandlerTag_KID.ashx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Network |
CVE-2022-43457 | High | 8.8 | 2022-11-17 | SQL Injection in HandlerPage_KID.ashx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Ne… |
CVE-2022-43452 | High | 8.8 | 2022-11-17 | SQL Injection in FtyInfoSetting.aspx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via N… |
CVE-2022-43447 | High | 8.8 | 2022-11-17 | SQL Injection in AM_EBillAnalysis.aspx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Net… |
CVE-2022-41775 | High | 8.8 | 2022-11-17 | SQL Injection in Handler_CFG.ashx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Network |
CVE-2022-41779 | High | 8.8 | 2022-10-31 | Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize network packets without proper verification. If the device connects to an… |
CVE-2022-41776 | High | 7.5 | 2022-10-31 | Delta Electronics InfraSuite Device Master versions 00.00.01a and prior allow unauthenticated users to trigger the WriteConfiguration method, which could allo… |
CVE-2022-41772 | Critical | 9.8 | 2022-10-31 | Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior mishandle .ZIP archives containing characters used in path traversal. This path traver… |
CVE-2022-41688 | Critical | 9.8 | 2022-10-31 | Delta Electronics InfraSuite Device Master versions 00.00.01a and prior lack proper authentication for functions that create and modify user groups. An attack… |
CVE-2022-41657 | Critical | 9.8 | 2022-10-31 | Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior allow attacker provided data already serialized into memory to be used in file operati… |
CVE-2022-41644 | High | 8.8 | 2022-10-31 | Delta Electronics InfraSuite Device Master versions 00.00.01a and prior lacks authentication for a function that changes group privileges. An attacker could… |
CVE-2022-41629 | High | 7.5 | 2022-10-31 | Delta Electronics InfraSuite Device Master versions 00.00.01a and prior allow unauthenticated users to access the aprunning endpoint, which could allow an att… |
CVE-2022-40202 | Critical | 9.8 | 2022-10-31 | The database backup function in Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior lacks proper authentication. An attacker could provide… |
CVE-2022-38142 | Critical | 9.8 | 2022-10-31 | Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize user-supplied data provided through the Device-Gateway service port withou… |
CVE-2022-41773 | High | 8.8 | 2022-10-27 | The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in CheckDIACloud. A low-privileged authenticated a… |
CVE-2022-41702 | High | 8.7 | 2022-10-27 | The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the InsertReg API. |
CVE-2022-41701 | High | 8.7 | 2022-10-27 | The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the PutShift API. |
CVE-2022-41651 | High | 8.7 | 2022-10-27 | The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the SetPF API. |
CVE-2022-41555 | High | 8.7 | 2022-10-27 | The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the PutLineMessageSetting… |
CVE-2022-41133 | High | 8.8 | 2022-10-27 | The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in GetDIAE_line_message_settingsListParameters. A… |
CVE-2022-40967 | High | 8.8 | 2022-10-27 | The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in CheckIoTHubNameExisted. A low-privileged authen… |
CVE-2022-40965 | High | 8.7 | 2022-10-27 | The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the PostEnergyType API. |
CVE-2022-3214 | Critical | 9.8 | 2022-09-16 | Delta Industrial Automation's DIAEnergy, an industrial energy management system, is vulnerable to CWE-798, Use of Hard-coded Credentials. Versions prior to 1… |
CVE-2022-2759 | Medium | 5.5 | 2022-08-31 | Delta Electronics Delta Robot Automation Studio (DRAS) versions prior to 1.13.20 are affected by improper restrictions where the software processes an XML docu… |
CVE-2022-1405 | High | 7.8 | 2022-08-31 | CNCSoft: All versions prior to 1.01.32 does not properly sanitize input while processing a specific project file, allowing a possible stack-based buffer overfl… |
CVE-2022-1404 | Low | 3.3 | 2022-08-31 | Delta Electronics CNCSoft (All versions prior to 1.01.32) does not properly sanitize input while processing a specific project file, allowing a possible out-of… |
CVE-2021-32969 | High | 7.8 | 2022-05-24 | Delta Electronics DIAScreen versions prior to 1.1.0 are vulnerable to an out-of-bounds write condition, which may result in a system crash or allow an attacker… |
CVE-2021-32965 | High | 7.8 | 2022-05-24 | Delta Electronics DIAScreen versions prior to 1.1.0 are vulnerable to type confusion, which may allow an attacker to remotely execute arbitrary code. |
CVE-2022-1331 | Medium | 5.5 | 2022-05-03 | In four instances DMARS (All versions prior to v2.1.10.24) does not properly restrict references of XML external entities while processing specific project fil… |
CVE-2022-1378 | Critical | 9.8 | 2022-05-02 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_pgHandler.ashx. This allows an attacker… |
CVE-2022-1377 | Critical | 9.8 | 2022-05-02 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_rltHandler.ashx. This allows an attacker… |
CVE-2022-1376 | Critical | 9.8 | 2022-05-02 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_privgrpHandler.ashx. This allows an atta… |
CVE-2022-1375 | Critical | 9.8 | 2022-05-02 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_slogHandler.ashx. This allows an attacke… |
CVE-2022-1374 | Critical | 9.8 | 2022-05-02 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_unHandler.ashx. This allows an attacker… |
CVE-2022-1372 | Critical | 9.8 | 2022-05-02 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in dlSlog.aspx. This allows an attacker to injec… |
CVE-2022-1371 | Critical | 9.8 | 2022-05-02 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in ReadRegf. This allows an attacker to inject a… |
CVE-2022-1370 | Critical | 9.8 | 2022-05-02 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in ReadREGbyID. This allows an attacker to injec… |
CVE-2022-1369 | Critical | 9.8 | 2022-05-02 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in ReadRegIND. This allows an attacker to inject… |
CVE-2022-1367 | Critical | 9.8 | 2022-05-02 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in Handler_TCV.ashx. This allows an attacker to… |
CVE-2022-1366 | Critical | 9.8 | 2022-05-02 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in HandlerChart.ashx. This allows an attacker to… |
CVE-2022-1403 | High | 7.8 | 2022-04-29 | ASDA-Soft: Version 5.4.1.0 and prior does not properly sanitize input while processing a specific project file, allowing a possible out-of-bounds write conditi… |
CVE-2022-1402 | High | 7.8 | 2022-04-29 | ASDA-Soft: Version 5.4.1.0 and prior does not properly sanitize input while processing a specific project file, allowing a possible out-of-bounds read conditio… |
CVE-2022-27175 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in GetCalcTagList. This allows an attacker… |
CVE-2022-26887 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_loopmapHandler.ashx. This allows an atta… |
CVE-2022-26839 | High | 7.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) is vulnerable to an incorrect default permission in the DIAEnergie application, which may allow… |
CVE-2022-26836 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in HandlerExport.ashx/Calendar. This allows… |
CVE-2022-26667 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in GetDemandAnalysisData. This allows an at… |
CVE-2022-26666 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in HandlerECC.ashx. This allows an attacker to i… |
CVE-2022-26514 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in DIAE_tagHandler.ashx. This allows an att… |
CVE-2022-26349 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in DIAE_eccoefficientHandler.ashx. This all… |
CVE-2022-26338 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in HandlerPageP_KID.ashx. This allows an attacke… |
CVE-2022-26069 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in HandlerPage_KID.ashx. This allows an att… |
CVE-2022-26065 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in GetLatestDemandNode. This allows an attacker… |
CVE-2022-26059 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in GetQueryData. This allows an attacker to… |
CVE-2022-26013 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in DIAE_dmdsetHandler.ashx. This allows an… |
CVE-2022-25980 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in HandlerCommon.ashx. This allows an attac… |
CVE-2022-25880 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in HandlerTag_KID.ashx. This allows an attacker… |
CVE-2022-25347 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) is vulnerable to path traversal attacks, which may allow an attacker to write arbitrary files t… |
CVE-2022-0923 | Critical | 9.8 | 2022-03-29 | Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in HandlerDialog_KID.ashx. This allows an a… |
CVE-2022-0988 | High | 7.1 | 2022-03-25 | Delta Electronics DIAEnergie (Version 1.7.5 and prior) is vulnerable to cleartext transmission as the web application runs by default on HTTP. This could allow… |
CVE-2021-44768 | Medium | 6.1 | 2022-03-25 | Delta Electronics CNCSoft (Version 1.01.30) and prior) is vulnerable to an out-of-bounds read while processing a specific project file, which may allow an atta… |
CVE-2021-44544 | High | 7.5 | 2021-12-22 | DIAEnergie Version 1.7.5 and prior is vulnerable to multiple cross-site scripting vulnerabilities when arbitrary code is injected into the parameter “name” of… |
CVE-2021-44471 | High | 7.5 | 2021-12-22 | DIAEnergie Version 1.7.5 and prior is vulnerable to stored cross-site scripting when an unauthenticated user injects arbitrary code into the parameter “name” o… |
CVE-2021-31558 | Medium | 6.5 | 2021-12-22 | DIAEnergie Version 1.7.5 and prior is vulnerable to stored cross-site scripting when an unauthenticated user injects arbitrary code into the parameter “descr”… |
CVE-2021-23228 | High | 7.5 | 2021-12-22 | DIAEnergie Version 1.7.5 and prior is vulnerable to a reflected cross-site scripting attack through error pages that are returned by “.NET Request.QueryString”. |
CVE-2021-43982 | High | 7.8 | 2021-12-09 | Delta Electronics CNCSoft Versions 1.01.30 and prior are vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code. |
CVE-2021-38488 | Medium | 5.5 | 2021-11-03 | Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript co… |
CVE-2021-38428 | Medium | 5.5 | 2021-11-03 | Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript co… |
CVE-2021-38424 | Medium | 5.9 | 2021-11-03 | The tag interface of Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to an attacker injecting formulas into the tag data. Those formulas may… |