CVE-2021-32933 MDT AutoSave Command Injection

An attacker could leverage an API to pass along a malicious file that could then manipulate the process creation command line in MDT AutoSave versions prior to v6.02.06 and run a command line argument. This could then be leveraged to run a malicious process...

CVE-2021-32933

MDT AutoSave (MDT Software) prior to v6.02.06 is affected by a command-injection vulnerability in the API that fails to validate input, enabling an attacker to pass a malicious file and manipulate the process creation command line to execute a malicious process. The issue is documented across mul...

CVE-2021-32933 MDT AutoSave Command Injection

An attacker could leverage an API to pass along a malicious file that could then manipulate the process creation command line in MDT AutoSave versions prior to v6.02.06 and run a command line argument. This could then be leveraged to run a malicious process...

CVE-2021-32953 MDT AutoSave SQL Injection

An attacker could utilize SQL commands to create a new user MDT AutoSave versions prior to v6.02.06 and update the user’s permissions, granting the attacker the ability to login...

CVE-2021-32953 MDT AutoSave SQL Injection

An attacker could utilize SQL commands to create a new user MDT AutoSave versions prior to v6.02.06 and update the user’s permissions, granting the attacker the ability to login...

CVE-2021-32953

MDT AutoSave is affected by CVE-2021-32953 (SQL Injection). The vulnerability allows an attacker to execute SQL commands to create a new user and update permissions, enabling login. Affected: MDT AutoSave versions prior to 6.02.06 (and related AutoSave for System Platform entries in the family). ...

CVE-2021-32961 MDT AutoSave Unrestricted Upload of File with Dangerous Type

A getfile function in MDT AutoSave versions prior to v6.02.06 enables a user to supply an optional parameter, resulting in the processing of a request in a special manner. This can result in the execution of an unzip command and place a malicious .exe file in one of the locations the function loo...

CVE-2021-32961 MDT AutoSave Unrestricted Upload of File with Dangerous Type

A getfile function in MDT AutoSave versions prior to v6.02.06 enables a user to supply an optional parameter, resulting in the processing of a request in a special manner. This can result in the execution of an unzip command and place a malicious .exe file in one of the locations the function loo...

CVE-2021-32961

MDT AutoSave (before v6.02.06) contains a vulnerability in the getfile function that lets an attacker supply an optional parameter to trigger special request handling, enabling an unzip operation and placement of a malicious .exe in searched locations, yielding execution capabilities. Affected pr...

CVE-2021-32957: Improper Neutralization of Special Elements used in an SQL Command

A function in MDT AutoSave versions prior to v6.02.06 is used to retrieve system information for a specific process, and this information collection executes multiple commands and summarizes the information into an XML. This function and subsequent process gives full path to the executable and is...

CVE-2021-32949: Relative Path Traversal

An attacker could utilize a function in MDT AutoSave versions prior to v6.02.06 that permits changing a designated path to another path and traversing the directory, allowing the replacement of an existing file with a malicious file...

CVE-2021-32933: Improper Neutralization of Special Elements used in a Command

An attacker could leverage an API to pass along a malicious file that could then manipulate the process creation command line in MDT AutoSave versions prior to v6.02.06 and run a command line argument. This could then be leveraged to run a malicious process...

PT-2022-10157

Name of the Vulnerable Software and Affected Versions MDT AutoSave versions prior to 6.02.06 Description An issue allows an attacker to decipher the encryption, potentially gaining access to sensitive information. Recommendations For versions prior to 6.02.06, update to version 6.02.06 or later t...

CVE-2021-32937: Generation of Error Message Containing Sensitive Information

An attacker can gain knowledge of a session temporary working folder where the getfile and putfile commands are used in MDT AutoSave versions prior to v6.02.06. An attacker can leverage this knowledge to provide a malicious command to the working directory where the read and write activity can be...

CVE-2021-32945: Inadequate Encryption Strength

An attacker could decipher the encryption and gain access to MDT AutoSave versions prior to v6.02.06...

PT-2022-10163

Name of the Vulnerable Software and Affected Versions MDT AutoSave versions prior to v6.02.06 Description The issue concerns a getfile function that allows a user to supply an optional parameter. This parameter can cause the function to process a request in a special manner, potentially leading t...

PT-2022-10160

Name of the Vulnerable Software and Affected Versions MDT AutoSave versions prior to v6.02.06 Description A function in the software is used to retrieve system information for a specific process, executing multiple commands and summarizing the information into an XML. This process gives the full...

PT-2022-10156

Name of the Vulnerable Software and Affected Versions MDT AutoSave versions prior to v6.02.06 Description An issue exists where an attacker can gain knowledge of a session's temporary working folder when the getfile and putfile commands are used. This knowledge can be leveraged to provide a...

CVE-2021-32961: Unrestricted Upload of File with Dangerous Type

A getfile function in MDT AutoSave versions prior to v6.02.06 enables a user to supply an optional parameter, resulting in the processing of a request in a special manner. This can result in the execution of an unzip command and place a malicious .exe file in one of the locations the function loo...

PT-2022-10159

Name of the Vulnerable Software and Affected Versions MDT AutoSave versions prior to v6.02.06 Description An attacker could utilize SQL commands to create a new user and update the user’s permissions, granting the attacker the ability to login. Recommendations For versions prior to v6.02.06, upda...