CVE-2021-27233

An issue was discovered in Mutare Voice EVM 3.x before 3.3.8. On the admin portal of the web application, password information for external systems is visible in cleartext. The Settings.asp page is affected by this issue...

CVE-2021-27235: Undefined Security Weakness

An issue was discovered in Mutare Voice EVM 3.x before 3.3.8. On the admin portal of the web application, there is a functionality at diagzip.asp that allows anyone to export tables of a database...

CVE-2021-27236: Exposure of Resource to Wrong Sphere

An issue was discovered in Mutare Voice EVM 3.x before 3.3.8. getfile.asp allows Unauthenticated Local File Inclusion, which can be leveraged to achieve Remote Code Execution...

PT-2021-17342

Name of the Vulnerable Software and Affected Versions: Mutare Voice EVM versions 3.x before 3.3.8 Description: An issue was discovered in the admin portal of the web application, where a functionality at "diagzip.asp" allows anyone to export tables of a database. Recommendations: For Mutare Voice...

PT-2021-17340

Name of the Vulnerable Software and Affected Versions: Mutare Voice EVM versions 3.x before 3.3.8 Description: An issue was discovered in the admin portal of the web application where password information for external systems is visible in cleartext. The Settings.asp page is affected by this issu...

CVE-2021-27233: Cleartext Storage of Sensitive Information

An issue was discovered in Mutare Voice EVM 3.x before 3.3.8. On the admin portal of the web application, password information for external systems is visible in cleartext. The Settings.asp page is affected by this issue...

PT-2021-17343

Name of the Vulnerable Software and Affected Versions: Mutare Voice EVM versions 3.x before 3.3.8 Description: An issue was discovered in Mutare Voice EVM that allows Unauthenticated Local File Inclusion via the getfile.asp endpoint, which can be leveraged to achieve Remote Code Execution...

PT-2021-17341

Name of the Vulnerable Software and Affected Versions: Mutare Voice EVM versions 3.x before 3.3.8 Description: The web application of Mutare Voice EVM suffers from SQL injection on several pages, including "Adminlog.asp", "Archivemsgs.asp", "Deletelog.asp", "Eventlog.asp", and "Evmlog.asp"...

CVE-2021-27234: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in Mutare Voice EVM 3.x before 3.3.8. The web application suffers from SQL injection on Adminlog.asp, Archivemsgs.asp, Deletelog.asp, Eventlog.asp, and Evmlog.asp...