CVE-2020-10631

An attacker could use a specially crafted URL to delete or read files outside the WebAccess/NMS's versions prior to 3.0.2 control...

CVE-2020-10631

Advantech WebAccess/NMS (prior to version 3.0.2) is affected by CVE-2020-10631, a Relative Path Traversal vulnerability. A specially crafted URL can cause the application to delete or read files outside its intended directory, impacting confidentiality, integrity, and availability. The issue is d...

CVE-2020-10625

WebAccess/NMS versions prior to 3.0.2 allows an unauthenticated remote user to create a new admin account...

CVE-2020-10625

The CVE-2020-10625 entry affects Advantech WebAccess/NMS prior to 3.0.2, where an unauthenticated remote attacker can create a new administrator account due to Missing Authentication for Critical Function. This is confirmed by multiple connected sources (Red Hat advisory, ZDI, CISA ICSA, CVE reco...

CVE-2020-10617

There are multiple ways an unauthenticated attacker could perform SQL injection on WebAccess/NMS versions prior to 3.0.2 to gain access to sensitive information...

CVE-2020-10617

This CVE affects Advantech WebAccess/NMS, with SQL injection vulnerabilities in versions prior to 3.0.2. The root cause involves unauthenticated input handling that allows constructing SQL queries (e.g., Login.view, searchDevice.action, EMSgroupAction.action, mibBrowserSetAction) and disclosing s...

CVE-2020-10623

CVE-2020-10623 describes a SQL injection vulnerability in Advantech WebAccess/NMS versions prior to 3.0.2 that can be exploited by a user with low privileges to disclose sensitive information. The CVE is part of a set of SQL injection issues affecting WebAccess/NMS (e.g., getSyslogUiList, getFWUp...

CVE-2020-10623

Multiple vulnerabilities could allow an attacker with low privileges to perform SQL injection on WebAccess/NMS versions prior to 3.0.2 to gain access to sensitive information...

CVE-2020-10621

Multiple issues exist that allow files to be uploaded and executed on the WebAccess/NMS versions prior to 3.0.2...

CVE-2020-10621

An arbitrary file upload vulnerability exists in Advantech WebAccess and WebAccess/NMS (versions prior to 3.0.2 ). The root cause is insufficient input validation on file paths within the ConfigRestoreAction servlet . Successful exploitation by a remote attacker allows for the uploading and execu...

CVE-2020-10621: Unrestricted Upload of File with Dangerous Type

Multiple issues exist that allow files to be uploaded and executed on the WebAccess/NMS versions prior to 3.0.2...

CVE-2020-10603: Improper Neutralization of Special Elements used in an OS Command

WebAccess/NMS versions prior to 3.0.2 does not properly sanitize user input and may allow an attacker to inject system commands remotely...

CVE-2020-10629: Improper Restriction of XML External Entity Reference

WebAccess/NMS versions prior to 3.0.2 does not sanitize XML input. Specially crafted XML input could allow an attacker to read sensitive files...

CVE-2020-10631: Relative Path Traversal

An attacker could use a specially crafted URL to delete or read files outside the WebAccess/NMS's versions prior to 3.0.2 control...

CVE-2020-10625: Missing Authentication for Critical Function

WebAccess/NMS versions prior to 3.0.2 allows an unauthenticated remote user to create a new admin account...

CVE-2020-10617: Improper Neutralization of Special Elements used in an SQL Command

There are multiple ways an unauthenticated attacker could perform SQL injection on WebAccess/NMS versions prior to 3.0.2 to gain access to sensitive information...

CVE-2020-10623: Improper Neutralization of Special Elements used in an SQL Command

Multiple vulnerabilities could allow an attacker with low privileges to perform SQL injection on WebAccess/NMS versions prior to 3.0.2 to gain access to sensitive information...

CVE-2020-10619: Relative Path Traversal

An attacker could use a specially crafted URL to delete files outside the WebAccess/NMS's versions prior to 3.0.2 control...

Advantech WebAccess/NMS DBUtil SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/NMS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of calls to the getSupportedDeviceByModel method of the...

Advantech WebAccess/NMS ConfigRestoreAction Unrestricted File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech WebAccess/NMS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of calls to the ConfigRestoreAction.action endpoint. When parsing...