Carel pCOWeb HVAC BACnet Gateway 2.1.0 Unauthenticated Directory Traversal | allinfosecnews.com

July 1, 2022, 3:17 p.m. |

Packet Storm packetstormsecurity.com

Carel pCOWeb HVAC BACnet Gateway version 2.1.0 suffers from an unauthenticated arbitrary file disclosure vulnerability. Input passed through the file GET parameter through the logdownload.cgi bash script is not properly verified before being used to download log files. This can be exploited to disclose the contents of arbitrary and sensitive files via directory traversal attacks.

directory directory traversal gateway hvac

More from packetstormsecurity.com / Packet Storm

The Not-So-Silent Type 11 hours ago | packetstormsecurity.com

apps called keyboard keystrokes +6

Ubuntu Security Notice USN-6754-1 11 hours ago | packetstormsecurity.com

attacker denial of service http implementation +11

Ubuntu Security Notice USN-6753-1 11 hours ago | packetstormsecurity.com

attacker configuration cryptographic default +14

Debian Security Advisory 5674-1 11 hours ago | packetstormsecurity.com

advisory debian debian linux security denial of service +9

Ubuntu Security Notice USN-6751-1 11 hours ago | packetstormsecurity.com

attacker attacks cross-site data +11

Ubuntu Security Notice USN-6752-1 11 hours ago | packetstormsecurity.com

attacker crash denial of service issue +10

Red Hat Security Advisory 2024-2066-03 12 hours ago | packetstormsecurity.com

advisory enterprise linux red hat +5

Red Hat Security Advisory 2024-2064-03 12 hours ago | packetstormsecurity.com

advisory enterprise linux red hat +5

Red Hat Security Advisory 2024-2063-03 12 hours ago | packetstormsecurity.com

advisory buffer buffer overflow enterprise +13

SOC 2 Manager, Audit and Certification

@ Deloitte | US and CA Multiple Locations

View on infosec-jobs.com

Security Engineer 2

@ Oracle | BENGALURU, KARNATAKA, India

View on infosec-jobs.com

Oracle EBS DevSecOps Developer

@ Accenture Federal Services | Arlington, VA

View on infosec-jobs.com

Information Security GRC Specialist - Risk Program Lead

@ Western Digital | Irvine, CA, United States

View on infosec-jobs.com

Senior Cyber Operations Planner (15.09)

@ OCT Consulting, LLC | Washington, District of Columbia, United States

View on infosec-jobs.com

AI Cybersecurity Architect

@ FactSet | India, Hyderabad, DVS, SEZ-1 – Orion B4; FL 7,8,9,11 (Hyderabad - Divyasree 3)

View on infosec-jobs.com