Directory traversal

A directory traversal vulnerability exists in the Web Manager FsCopyFile functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HTTP request can lead to local file inclusion. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2021-21937

CVE-2021-21937 affects Advantech R-SeeNet (industrial monitoring software) with multiple SQL injection flaws on the device_list page (notably in host_alt_filter and related filters). Root cause: improper neutralization of user-supplied data leading to SQL injection (CWE-89). Exploitation requires...

CVE-2021-21937

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘hostaltfilter’ parameter. This can be done as any authenticated user or through cross-site request forgery...

CVE-2021-21936

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘healthaltfilter’ parameter. This can be done as any authenticated user or through cross-site request forgery...

CVE-2021-21936

CVE-2021-21936 describes multiple SQL injection vulnerabilities in Advantech R-SeeNet driven by insecure SQL construction in device_list.php. The issues arise from using session-scoped filters (e.g., health_filter, desc_filter, loc_filter, prod_filter, sn_filter, mac_filter, name_filter, imei_fil...

CVE-2021-21935

CVE-2021-21935 maps to multiple SQL-injection vulnerabilities in Advantech R-SeeNet (device_list and related filters). Root cause is improper input handling (dynamic SQL via various filter parameters such as host_alt_filter2, desc_filter, prod_filter, etc.), allowing authenticated users (or CSRF ...

CVE-2021-21935

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘hostaltfilter2’ parameter. This can be done as any authenticated user or through cross-site request forgery...

CVE-2021-21934

CVE-2021-21934 affects Advantech R-SeeNet (industrial monitoring software). The issue arises from SQL injection vulnerabilities in the device_list page, exploitable through multiple filter parameters (notably imei_filter) due to improper handling of user-supplied input, enabling authenticated use...

CVE-2021-21934

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this at ‘imeifilter’ parameter. This can be done as any authenticated user or through cross-site request forgery...

CVE-2021-21933

Summary (CVE-2021-21933): The Advantech R-SeeNet application contains SQL injection vulnerabilities on the device_list page (multiple filters such as esn_filter, descr, host, etc.). An authenticated attacker can trigger injections via crafted HTTP requests (including CSRF). The exploits stem from...

CVE-2021-21933

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this at ‘esnfilter’ parameter. This can be done as any authenticated user or through cross-site request forgery...

CVE-2021-21932

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this at ‘namefilter’ parameter. This can be done as any authenticated user or through cross-site request forgery...

CVE-2021-21931

CVE-2021-21931 affects Advantech R-SeeNet web interface. Multiple SQL injection paths exist in device_list.php (notably via stat_filter and related filters like host/prod/desc/etc.), allowing authenticated users (or CSRF-tied actions) to inject SQL through crafted HTTP requests. TALOS and related...

CVE-2021-21931

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests at‘ statfilter’ parameter to trigger this vulnerability. This can be done as any authenticated user or through cross-site request forgery...

CVE-2021-21930

CVE-2021-21930 affects Advantech R-SeeNet 2.4.15 (and related entries) with multiple SQL injection vulnerabilities in the device_list page, including filters such as sn_filter, prod_filter, mac_filter, host_filter, name_filter, esn_filter, imei_filter and others. The root cause is improper neutra...

CVE-2021-21930

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests at ‘snfilter’ parameter to trigger this vulnerability. This can be done as any authenticated user or through cross-site request forgery...

CVE-2021-21929

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests at ‘prodfilter’ parameter to trigger this vulnerability. This can be done as any authenticated user or through cross-site request forgery...

CVE-2021-21929

CVE-2021-21929 affects Advantech R-SeeNet. Multiple SQL injection vulnerabilities exist in the device_list page via numerous filters (e.g., prod_filter), due to how user/session inputs are incorporated into dynamic SQL. Exploitation can be performed by authenticated users (and may be CSRF-enabled...

CVE-2021-21928

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests at ‘macfilter’ parameter to trigger this vulnerability. This can be done as any authenticated user or through cross-site request forgery...

CVE-2021-21928

CVE-2021-21928 affects Advantech R-SeeNet (2.4.x and prior) with multiple SQL injection flaws in the web UI (e.g., device_list.php: mac_filter, desc_filter, loc_filter, prod_filter, sn_filter, etc.). An authenticated user or CSRF can trigger crafted HTTP requests to inject SQL via interpolated qu...