The "reportType" parameter in the product summary report feature within the balancing reports section is susceptible to a time-based blind SQL injection vulner…
The application accepts user-supplied session identifiers and does not regenerate the session ID after authentication. This allows an attacker to predefine a s…
An attacker can construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user…
The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web ser…
The RCU II+ and Multiload II+ are vulnerable to an unauthenticated
service that exposes a debug interface granting full root-level access
to the embedded sys…