Semaine du 1 septembre au 7 septembre 2025

gavias Indutri

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Indutri indutri allows PHP Local File Inclusion.This issue affects Indutri: from n/a through < 1.3.0.

Copeland LP E3 Supervisory Control · Copeland e3 supervisory controller firmware

E3 Site Supervisor Control (firmware version < 2.31F01) MGW contains an API call that lacks input validation. An attacker can use this command to continuously crash the application services.

Copeland LP E3 Supervisory Control · Copeland e3 supervisory controller firmware

E3 Site Supervisor Control (firmware version < 2.31F01) RCI service contains an API call to read users info, which returns all usernames and password hashes for the application services.

Copeland LP E3 Supervisory Control · Copeland e3 supervisory controller firmware

E3 Site Supervisor Control (firmware version < 2.31F01) has a floor plan feature that allows for an unauthenticated attacker to upload floor plan files. By uploading a specially crafted floor plan file, an attacker can access any file from the E3 file system.

Copeland LP E3 Supervisory Control · Copeland e3 supervisory controller firmware

E3 Site Supervisor Control (firmware version < 2.31F01) application services (MGW and RCI) uses client side hashing for authentication. An attacker can authenticate by obtaining only the password hash.