CVE-2020-10584: Improper Limitation of a Pathname to a Restricted Directory

A directory traversal on the /admin/searchby.php script of Invigo Automatic Device Management ADM through 5.0 allows remote attackers to read arbitrary server files accessible to the user running the application...

CVE-2020-10581: Exposure of Resource to Wrong Sphere

Multiple session validity check issues in several administration functionalities of Invigo Automatic Device Management ADM through 5.0 allow remote attackers to read potentially sensitive data hosted by the application...

CVE-2020-10579: Improper Limitation of a Pathname to a Restricted Directory

A directory traversal on the /admin/sysmon.php script of Invigo Automatic Device Management ADM through 5.0 allows remote attackers to list the content of arbitrary server directories accessible to the user running the application...

CVE-2020-10583: Improper Neutralization of Special Elements used in an OS Command

The /admin/admapi.php script of Invigo Automatic Device Management ADM through 5.0 allows remote authenticated attackers to execute arbitrary OS commands on the server as the user running the application...

CVE-2020-10580: Improper Neutralization of Special Elements used in a Command

A command injection on the /admin/broadcast.php script of Invigo Automatic Device Management ADM through 5.0 allows remote authenticated attackers to execute arbitrary PHP code on the server as the user running the application...

CVE-2020-10582: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection on the /admin/displayerrors.php script of Invigo Automatic Device Management ADM through 5.0 allows remote attackers to execute arbitrary SQL requests including data reading and modification on the database...