VendorsInfinite Automation Systemsmango_automationall versions
Vulnerabilities

Infinite Automation Systems Mango Automation

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

8CVEs
CVE-2015-6493
Cross-site request forgery (CSRF) vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x through 2.6.0 build 430 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.
Published 2015-10-28 · Modified
6.81 PoCEPSS 0.013
CVE-2015-7901
Infinite Automation Mango Automation 2.5.x and 2.6.x through 2.6.0 build 430 allows remote authenticated users to execute arbitrary OS commands via unspecified vectors.
Published 2015-10-28 · Modified
6.52 PoCEPSS 0.033
CVE-2015-7904
Unrestricted file upload vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote authenticated users to execute arbitrary JSP code via vectors involving an upload of an image file.
Published 2015-10-28 · Modified
6.51 PoCEPSS 0.028
CVE-2015-7903
SQL injection vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Published 2015-10-28 · Modified
6.51 PoCEPSS 0.013
CVE-2015-7902
Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 provides different error messages for failed login attempts in unspecified circumstances, which allows remote attackers to obtain sensitive information via a series of requests.
Published 2015-10-28 · Modified
5.01 PoCEPSS 0.035
CVE-2015-7900
Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote attackers to obtain sensitive debugging information by entering a crafted URL to trigger an exception, and then visiting a certain status page.
Published 2015-10-28 · Modified
4.31 PoCEPSS 0.029
CVE-2015-1179
Multiple cross-site scripting (XSS) vulnerabilities in data_point_details.shtm in Mango Automation 2.4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dpid, (2) dpxid, or (3) pid parameter.
Published 2015-01-26 · Modified
4.3EPSS 0.015
CVE-2015-6494
Cross-site scripting (XSS) vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Published 2015-10-28 · Modified
3.51 PoCEPSS 0.017