Deltaww Diaenergie vulnerabilities

CVE-2022-43452 [HIGH] CWE-89 CVE-2022-43452: SQL Injection in FtyInfoSetting.aspx in Delta Electronics DIAEnergie versions prior to SQL Injection in FtyInfoSetting.aspx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Network

CVE-2022-40967 [HIGH] CWE-89 CVE-2022-40967: The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection tha The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in CheckIoTHubNameExisted. A low-privileged authenticated attacker could exploit this issue to inject arbitrary SQL queries.

CVE-2024-34032 [HIGH] CWE-89 CVE-2024-34032: Delta Electronics DIAEnergie is vulnerable to an SQL injection vulnerability that exists in the Get Delta Electronics DIAEnergie is vulnerable to an SQL injection vulnerability that exists in the GetDIACloudList endpoint. An authenticated attacker can exploit this issue to potentially compromise the system on which DIAEnergie is deployed.

CVE-2024-28040 [HIGH] CWE-89 CVE-2024-28040: SQL injection vulnerability exists in GetDIAE_astListParameters. SQL injection vulnerability exists in GetDIAE_astListParameters.

CVE-2024-23494 [HIGH] CWE-89 CVE-2024-23494: SQL injection vulnerability exists in GetDIAE_unListParameters. SQL injection vulnerability exists in GetDIAE_unListParameters.

CVE-2024-23975 [HIGH] CWE-89 CVE-2024-23975: SQL injection vulnerability exists in GetDIAE_slogListParameters. SQL injection vulnerability exists in GetDIAE_slogListParameters.

CVE-2024-42417 [HIGH] CWE-89 CVE-2024-42417: Delta Electronics DIAEnergie is vulnerable to an SQL injection in the script Handler_CFG.ashx. An au Delta Electronics DIAEnergie is vulnerable to an SQL injection in the script Handler_CFG.ashx. An authenticated attacker may be able to exploit this issue to cause delay in the targeted product.

CVE-2022-25347 [HIGH] CWE-37 CVE-2022-25347: Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) is vulnerable to path traversal atta Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) is vulnerable to path traversal attacks, which may allow an attacker to write arbitrary files to locations on the file system.

CVE-2024-28029 [HIGH] CWE-602 CVE-2024-28029: Privileges are not fully verified server-side, which can be abused by a user with limited privileges Privileges are not fully verified server-side, which can be abused by a user with limited privileges to bypass authorization and access privileged functionality.

CVE-2021-32967 [CRITICAL] CWE-288 CVE-2021-32967: Delta Electronics DIAEnergie Version 1.7.5 and prior may allow an attacker to add a new administrati Delta Electronics DIAEnergie Version 1.7.5 and prior may allow an attacker to add a new administrative user without being authenticated or authorized, which may allow the attacker to log in and use the device with administrative privileges.

CVE-2024-43699 [CRITICAL] CWE-89 CVE-2024-43699: Delta Electronics DIAEnergie is vulnerable to an SQL injection in the script AM_RegReport.aspx. An u Delta Electronics DIAEnergie is vulnerable to an SQL injection in the script AM_RegReport.aspx. An unauthenticated attacker may be able to exploit this issue to obtain records contained in the targeted product.

CVE-2024-34033 [HIGH] CWE-22 CVE-2024-34033: Delta Electronics DIAEnergie has insufficient input validation which makes it possible to perform a Delta Electronics DIAEnergie has insufficient input validation which makes it possible to perform a path traversal attack and write outside of the intended directory. If a file name is specified that already exists on the file system, then the original file will be overwritten.

CVE-2023-0822 [HIGH] CWE-285 CVE-2023-0822: The affected product DIAEnergie (versions prior to v1.9.03.001) contains improper authorization, wh The affected product DIAEnergie (versions prior to v1.9.03.001) contains improper authorization, which could allow an unauthorized user to bypass authorization and access privileged functionality.

CVE-2022-43774 [CRITICAL] CWE-89 CVE-2022-43774: The HandlerPageP_KID class in Delta Electronics DIAEnergy v1.9 contains a SQL Injection flaw that co The HandlerPageP_KID class in Delta Electronics DIAEnergy v1.9 contains a SQL Injection flaw that could allow an attacker to gain code execution on a remote system.

CVE-2022-43506 [HIGH] CWE-89 CVE-2022-43506: SQL Injection in HandlerTag_KID.ashx in Delta Electronics DIAEnergie versions prior to v1.9.0 SQL Injection in HandlerTag_KID.ashx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Network

CVE-2022-43447 [HIGH] CWE-89 CVE-2022-43447: SQL Injection in AM_EBillAnalysis.aspx in Delta Electronics DIAEnergie versions prior to v SQL Injection in AM_EBillAnalysis.aspx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Network

CVE-2022-43457 [HIGH] CWE-89 CVE-2022-43457: SQL Injection in HandlerPage_KID.ashx in Delta Electronics DIAEnergie versions prior to SQL Injection in HandlerPage_KID.ashx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Network

CVE-2022-41775 [HIGH] CWE-89 CVE-2022-41775: SQL Injection in Handler_CFG.ashx in Delta Electronics DIAEnergie versions prior to v1.9.02. SQL Injection in Handler_CFG.ashx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Network

CVE-2024-34031 [HIGH] CWE-89 CVE-2024-34031: Delta Electronics DIAEnergie is vulnerable to an SQL injection vulnerability that exists in the scr Delta Electronics DIAEnergie is vulnerable to an SQL injection vulnerability that exists in the script Handler_CFG.ashx. An authenticated attacker can exploit this issue to potentially compromise the system on which DIAEnergie is deployed.

CVE-2024-25567 [HIGH] CWE-22 CVE-2024-25567: Path traversal attack is possible and write outside of the intended directory and may access sensit Path traversal attack is possible and write outside of the intended directory and may access sensitive information. If a file name is specified that already exists on the file system, then the original file will be overwritten.