Advantech R-SeeNet application multiple SQL injection vulnerabilities in the 'user_list' page

Summary Multiple exploitable SQL injection vulnerabilities exist in the ‘userlist’ page of the Advantech R-SeeNet 2.4.15 30.07.2021. A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger these vulnerabilities with the administrativ...

Advantech R-SeeNet ssh_form.php Cross-Site Scripting (CVE-2021-21800)

A cross-site scripting vulnerability exists in Advantech R-SeeNet. The vulnerability is due to improper input validation in sshform.php...

PT-2021-6938

Name of the Vulnerable Software and Affected Versions Advantech R-SeeNet version 2.4.15 Description A privilege escalation issue exists due to insufficient access restrictions to the C:R-SeeNet directory. This can be exploited by an attacker using a specially crafted malicious file to elevate...

PT-2021-4939 · Advantech +1 · Advantech R-Seenet +1

Name of the Vulnerable Software and Affected Versions: Advantech R-SeeNet version 2.4.15 Description: A privilege escalation issue exists in the Windows version of Advantech R-SeeNet, related to insufficient access control to the directory C:R-SeeNet. This can allow an attacker to elevate their...

PT-2021-4938

Name of the Vulnerable Software and Affected Versions Advantech R-SeeNet affected versions not specified Description The issue is related to the incorrect handling of the desc filter parameter in the device list component, which can lead to SQL injection. An attacker can exploit this by making...

PT-2021-5148

Name of the Vulnerable Software and Affected Versions Advantech R-SeeNet affected versions not specified Description The issue is related to the incorrect handling of the esn filter parameter in the device list component of the Advantech R-SeeNet monitoring software. This can allow a remote...

PT-2021-5155

Name of the Vulnerable Software and Affected Versions Advantech R-SeeNet affected versions not specified Description A specially-crafted HTTP request can lead to SQL injection, allowing an attacker to make authenticated HTTP requests at the stat filter parameter to trigger this issue. This can be...

PT-2021-5371

Name of the Vulnerable Software and Affected Versions Advantech R-SeeNet affected versions not specified Description The issue is related to the incorrect handling of the mac filter parameter in the device list component, which can lead to SQL injection. An attacker can exploit this by making...

PT-2021-5149

Name of the Vulnerable Software and Affected Versions Advantech R-SeeNet affected versions not specified Description The issue is related to the incorrect handling of the name filter parameter in the device list component of the Advantech R-SeeNet monitoring software. This can allow a remote...

PT-2021-5296

Name of the Vulnerable Software and Affected Versions Advantech R-SeeNet affected versions not specified Description The issue is related to the incorrect handling of the loc filter parameter in the device list component of the Advantech R-SeeNet monitoring software. This can allow a remote...

PT-2021-5444

Name of the Vulnerable Software and Affected Versions Advantech R-SeeNet affected versions not specified Description A specially-crafted HTTP request can lead to SQL injection, allowing an attacker to make authenticated HTTP requests at the prod filter parameter. This vulnerability can be trigger...

PT-2021-5443

Name of the Vulnerable Software and Affected Versions Advantech R-SeeNet affected versions not specified Description The issue is related to the incorrect handling of the firm filter parameter in the device list component, which can lead to SQL injection. An attacker can exploit this by making...

PT-2021-5496

Name of the Vulnerable Software and Affected Versions Advantech R-SeeNet version 2.4.15 Description The issue is related to a lack of protection against SQL injection attacks in the company filter parameter of the group list page. This can be exploited by sending specially crafted SQL queries,...

PT-2021-5489

Name of the Vulnerable Software and Affected Versions Advantech R-SeeNet affected versions not specified Description A specially-crafted HTTP request can lead to SQL injection, allowing an attacker to execute arbitrary SQL queries. This can be triggered by making authenticated HTTP requests,...

PT-2021-5481

Name of the Vulnerable Software and Affected Versions Advantech R-SeeNet version 2.4.15 Description An exploitable SQL injection vulnerability exists in the 'group list' page. A specially-crafted HTTP request at the description filter parameter can trigger this issue. An attacker can make...

PT-2021-5480

Name of the Vulnerable Software and Affected Versions Advantech R-SeeNet affected versions not specified Description The issue is related to a SQL injection vulnerability. It can be triggered by making authenticated HTTP requests to the company filter parameter, potentially through cross-site...

PT-2021-5442

Name of the Vulnerable Software and Affected Versions Advantech R-SeeNet affected versions not specified Description The issue is related to the incorrect handling of the health filter parameter in the device list component, which can lead to SQL injection. An attacker can exploit this by making...

PT-2021-5494

Name of the Vulnerable Software and Affected Versions Advantech R-SeeNet affected versions not specified Description The issue is related to incorrect input validation, which can be exploited by a remote attacker to conduct SQL injection attacks by sending specially crafted SQL queries. This can...

PT-2021-6947

Name of the Vulnerable Software and Affected Versions Advantech R-SeeNet version 2.4.15 Description The issue is related to a SQL injection vulnerability in the 'group list' page. It is caused by the lack of protection against SQL query structure manipulation through the ord parameter. An attacke...

PT-2021-5445

Name of the Vulnerable Software and Affected Versions Advantech R-SeeNet affected versions not specified Description The issue is related to the incorrect handling of the sn filter parameter in the device list component, allowing an attacker to conduct SQL injection attacks. This can be triggered...