Marco Manieri

An unrestricted upload of files with dangerous type vulnerability in the Microchip TimePictra platform allows functionality not properly constrained by access control lists, potentially resulting in remote code execution.

A stored cross-site scripting vulnerability in Microchip the TimePictra platform could allow an authenticated, low-privileged attacker to store malicious script content that executes when another user views the affected page

A hard-coded root password in Microchip TimePictra platform installation files could allow an attacker with access to those files to obtain privileged credentials

The use of hard-coded credentials allows for a malicious manual software update.

An improper neutralization of special elements used in an SQL command ('SQL Injection') issue exists in Microchip Time Provider 4100. This allows for SQL Injection. The vulnerability is present in the web resource. The `SQL` command is not properly sanitized, potentially allowing an attacker to inject malicious code.

An improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Microchip Time Provider 4100. This allows for OS Command Injection. The issue relates to restoring the configuration password.

An improper neutralization of special elements used in an OS command vulnerability exists in Microchip Time Provider 4100, allowing for OS command injection. This issue relates to remote code execution through the backup configuration password.

A flaw exists in Microchip Time Provider 4100 that permits malicious manual software updates due to a missing integrity check during code download.