| CVE-2024-28029 | ÉLEVÉE8.8 | Privileges are not fully verified server-side, which can be abused by a user with limited privileges to bypass authorization and access privileged functionality. | 21/03/2024 |
| CVE-2024-25937 | ÉLEVÉE8.8 |
SQL injection vulnerability exists in the script DIAE_tagHandler.ashx.
| 21/03/2024 |
| CVE-2023-0822 | ÉLEVÉE8.8 |
The affected product DIAEnergie (versions prior to v1.9.03.001) contains improper authorization, which could allow an unauthorized user to bypass authorization and access privileged functionality.
| 17/02/2023 |
| CVE-2022-43506 | ÉLEVÉE8.8 | SQL Injection in
HandlerTag_KID.ashx
in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Network | 17/11/2022 |
| CVE-2022-43457 | ÉLEVÉE8.8 | SQL Injection in
HandlerPage_KID.ashx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Network | 17/11/2022 |
| CVE-2022-43452 | ÉLEVÉE8.8 | SQL Injection in
FtyInfoSetting.aspx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Network | 17/11/2022 |
| CVE-2022-43447 | ÉLEVÉE8.8 | SQL Injection in
AM_EBillAnalysis.aspx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Network | 17/11/2022 |
| CVE-2022-41775 | ÉLEVÉE8.8 | SQL Injection in
Handler_CFG.ashx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Network | 17/11/2022 |
| CVE-2022-41773 | ÉLEVÉE8.8 | The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in CheckDIACloud. A low-privileged authenticated attacker could exploit this issue to inject arbitrary SQL queries. | 27/10/2022 |
| CVE-2022-41702 | MOYENNE5.4 | The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the InsertReg API. | 27/10/2022 |
| CVE-2022-41701 | MOYENNE5.4 | The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the PutShift API. | 27/10/2022 |
| CVE-2022-41651 | MOYENNE5.4 | The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the SetPF API. | 27/10/2022 |
| CVE-2022-41555 | MOYENNE5.4 | The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the PutLineMessageSetting API. | 27/10/2022 |
| CVE-2022-41133 | ÉLEVÉE8.8 | The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in GetDIAE_line_message_settingsListParameters. A low-privileged authenticated attacker could exploit this issue to inject arbitrary SQL queries. | 27/10/2022 |
| CVE-2022-40967 | ÉLEVÉE8.8 | The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in CheckIoTHubNameExisted. A low-privileged authenticated attacker could exploit this issue to inject arbitrary SQL queries. | 27/10/2022 |
| CVE-2022-40965 | MOYENNE5.4 | The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the PostEnergyType API. | 27/10/2022 |
| CVE-2022-43775 | CRITIQUE9.8 | The HICT_Loop class in Delta Electronics DIAEnergy v1.9 contains a SQL Injection flaw that could allow an attacker to gain code execution on a remote system. | 26/10/2022 |
| CVE-2022-43774 | CRITIQUE9.8 | The HandlerPageP_KID class in Delta Electronics DIAEnergy v1.9 contains a SQL Injection flaw that could allow an attacker to gain code execution on a remote system. | 26/10/2022 |
| CVE-2022-3214 | CRITIQUE9.8 | Delta Industrial Automation's DIAEnergy, an industrial energy management system, is vulnerable to CWE-798, Use of Hard-coded Credentials. Versions prior to
1.9.03.009
have this vulnerability. Executable files could be uploaded to certain directories using hard-coded bearer authorization, allowing remote code execut | 16/09/2022 |
| CVE-2022-33005 | MOYENNE6.1 | A cross-site scripting (XSS) vulnerability in the System Settings/IOT Settings module of Delta Electronics DIAEnergie v1.08.00 allows attackers to execute arbitrary web scripts via a crafted payload injected into the Name text field. | 27/06/2022 |