SadFud

16 exploits Active since Apr 2018
CVE-2018-12634 WRITEUP CRITICAL WORKING POC
CirCarLife Scada <4.3 - Info Disclosure
CirCarLife Scada before 4.3 allows remote attackers to obtain sensitive information via a direct request for the html/log or services/system/info.html URI.
CVSS 9.8
CVE-2018-16668 WRITEUP MEDIUM WORKING POC
CIRCONTROL CirCarLife <4.3 - Info Disclosure
An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is internal installation path disclosure due to the lack of authentication for /html/repository.
CVSS 5.3
CVE-2018-16669 WRITEUP CRITICAL WORKING POC
CIRCONTROL OCPP <1.5.0 - Info Disclosure
An issue was discovered in CIRCONTROL Open Charge Point Protocol (OCPP) before 1.5.0, as used in CirCarLife, PowerStudio, and other products. Due to storage of credentials in XML files, an unprivileged user can look at /services/config/config.xml for the admin credentials of the ocpp and circarlife panels.
CVSS 9.8
CVE-2018-16670 WRITEUP MEDIUM WORKING POC
CIRCONTROL CirCarLife <4.3 - Info Disclosure
An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is PLC status disclosure due to lack of authentication for /html/devstat.html.
CVSS 5.3
CVE-2018-16671 WRITEUP MEDIUM WORKING POC
CIRCONTROL CirCarLife <4.3 - Info Disclosure
An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is system software information disclosure due to lack of authentication for /html/device-id.
CVSS 5.3
CVE-2018-16672 WRITEUP MEDIUM WORKING POC
CIRCONTROL CirCarLife <4.3 - Info Disclosure
An issue was discovered in CIRCONTROL CirCarLife before 4.3. Due to the storage of multiple sensitive information elements in a JSON format at /services/system/setup.json, an authenticated but unprivileged user can exfiltrate critical setup information.
CVSS 6.5
CVE-2018-11653 WRITEUP CRITICAL WORKING POC
Netwave IP Camera - Unauthenticated Sensitive Information Exposure via RT2870STA.dat
Information disclosure in Netwave IP camera at //etc/RT2870STA.dat (via HTTP on port 8000) allows an unauthenticated attacker to exfiltrate sensitive information about the network configuration like the network SSID and password.
CVSS 9.8
CVE-2018-11654 WRITEUP HIGH WORKING POC
Netwave IP Camera Firmware - Unauthenticated Sensitive Information Exposure via get_status.cgi
Information disclosure in Netwave IP camera at get_status.cgi (via HTTP on port 8000) allows an unauthenticated attacker to exfiltrate sensitive information from the device.
CVSS 7.5
CVE-2018-7812 WRITEUP HIGH WORKING POC
Modicon M340-Quantum - Info Disclosure
An Information Exposure through Discrepancy vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where the web server sends different responses in a way that exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
CVSS 7.5
CVE-2018-16672 EXPLOITDB MEDIUM python WORKING POC
CIRCONTROL CirCarLife <4.3 - Info Disclosure
An issue was discovered in CIRCONTROL CirCarLife before 4.3. Due to the storage of multiple sensitive information elements in a JSON format at /services/system/setup.json, an authenticated but unprivileged user can exfiltrate critical setup information.
CVSS 6.5
CVE-2018-16671 EXPLOITDB MEDIUM python WORKING POC
CIRCONTROL CirCarLife <4.3 - Info Disclosure
An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is system software information disclosure due to lack of authentication for /html/device-id.
CVSS 5.3
CVE-2018-16670 EXPLOITDB MEDIUM python WORKING POC
CIRCONTROL CirCarLife <4.3 - Info Disclosure
An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is PLC status disclosure due to lack of authentication for /html/devstat.html.
CVSS 5.3
CVE-2018-16669 EXPLOITDB CRITICAL python WORKING POC
CIRCONTROL OCPP <1.5.0 - Info Disclosure
An issue was discovered in CIRCONTROL Open Charge Point Protocol (OCPP) before 1.5.0, as used in CirCarLife, PowerStudio, and other products. Due to storage of credentials in XML files, an unprivileged user can look at /services/config/config.xml for the admin credentials of the ocpp and circarlife panels.
CVSS 9.8
CVE-2018-16668 EXPLOITDB MEDIUM python WORKING POC
CIRCONTROL CirCarLife <4.3 - Info Disclosure
An issue was discovered in CIRCONTROL CirCarLife before 4.3. There is internal installation path disclosure due to the lack of authentication for /html/repository.
CVSS 5.3
CVE-2018-8880 EXPLOITDB HIGH python WORKING POC
Lutron Quantum BACnet Integration <3.2.243 - Info Disclosure
Lutron Quantum BACnet Integration 2.0 (firmware 3.2.243) doesn't check for correct user authentication before showing the /deviceIP information, which leads to internal network information disclosure.
CVSS 7.5
CVE-2018-12634 EXPLOITDB CRITICAL python WORKING POC
CirCarLife Scada <4.3 - Info Disclosure
CirCarLife Scada before 4.3 allows remote attackers to obtain sensitive information via a direct request for the html/log or services/system/info.html URI.
CVSS 9.8