Sql injection

An exploitable SQL injection vulnerability exist in the ‘grouplist’ page of the Advantech R-SeeNet 2.4.15 30.07.2021. A specially-crafted HTTP request at ‘companyfilter’ parameter. An attacker can make authenticated HTTP requests to trigger this vulnerability. This can be done as any authenticate...

Sql injection

An exploitable SQL injection vulnerability exist in the ‘grouplist’ page of the Advantech R-SeeNet 2.4.15 30.07.2021. A specially-crafted HTTP request at 'descriptionfilter’ parameter. An attacker can make authenticated HTTP requests to trigger this vulnerability. This can be done as any...

CVE-2021-21916

An exploitable SQL injection vulnerability exist in the ‘grouplist’ page of the Advantech R-SeeNet 2.4.15 30.07.2021. A specially-crafted HTTP request at 'descriptionfilter’ parameter. An attacker can make authenticated HTTP requests to trigger this vulnerability. This can be done as any...

CVE-2021-21917

CVE-2021-21917 highlights multiple SQL injection vulnerabilities in Advantech R-SeeNet, specifically in the group_list page of version 2.4.15 (and prior). The root cause is improper neutralization/handling of user-supplied input in several parameters used to build SQL queries (ord, company_filter...

CVE-2021-21917

An exploitable SQL injection vulnerability exist in the ‘grouplist’ page of the Advantech R-SeeNet 2.4.15 30.07.2021. A specially-crafted HTTP request at '‘ord’ parameter. An attacker can make authenticated HTTP requests to trigger this vulnerability. This can be done as any authenticated user or...

CVE-2021-21916

Advantech R-SeeNet 2.4.15 (and prior) contains SQL injection vulnerabilities on the group_list page, including the description_filter parameter. The TALOS advisory documents multiple SQLi flaws in group_list with authenticated user or CSRF-enabled attack paths, and provides concrete proof-of-conc...

CVE-2021-21915

An exploitable SQL injection vulnerability exist in the ‘grouplist’ page of the Advantech R-SeeNet 2.4.15 30.07.2021. A specially-crafted HTTP request at ‘companyfilter’ parameter. An attacker can make authenticated HTTP requests to trigger this vulnerability. This can be done as any authenticate...

CVE-2021-21915

Advantech R-SeeNet (2.4.15, affected) contains SQL injection vulnerabilities in the group_list flow, notably via the company_filter parameter (and related filters like description_filter, ord). The issues arise from improper handling of user-supplied session-based filters that are used to assembl...

CVE-2021-21911

Advantech R-SeeNet on Windows is affected by CVE-2021-21911 (Privilege escalation via SnmpMonSvs service executable) affecting 2.4.15. The vulnerability is caused by insufficient protection of the C:\R-SeeNet installation files, allowing an authenticated user to replace the SnmpMonSvs service bin...

CVE-2021-21912

A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 30.07.2021. A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM authority. An attacker can provide a malicious file to trigger...

CVE-2021-21912

Advantech R-SeeNet for Windows (Version 2.4.15) has a privilege escalation vulnerability (CVE-2021-21912) allowing an authenticated user to replace specific executable files in C:\R-SeeNet and related services to gain NT SYSTEM privileges. The TALOS report details multiple components (mysqld.exe,...

CVE-2021-21911

A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 30.07.2021. A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM authority. An attacker can provide a malicious file to trigger...

CVE-2021-21910

A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 30.07.2021. A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM authority. An attacker can provide a malicious file to trigger...

CVE-2021-21910

CVE-2021-21910 affects Advantech R-SeeNet on Windows (2.4.15). The vulnerability arises from improper default permissions allowing an authenticated user to replace certain executables (e.g., mysql service, SnmpMonSvs, Apache2.2) in C:\R-SeeNet and trigger privilege escalation to NT SYSTEM when th...

The vulnerability of the prod_filter parameter in the “device_list” component of the monitoring software for Advantech R-SeeNet routers allows a perpetrator to carry out cross-site scripting attacks.

The vulnerability of the prodfilter parameter in the “devicelist” component of the Advantech R-SeeNet monitoring software relates to the improper handling of the prodfilter parameter. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks by sending special...

The vulnerability of the imei_filter parameter in the device_list.php file of the monitoring software for Advantech R-SeeNet’s router functions allows a hacker to disclose protected information.

The vulnerability of the imeifilter parameter in the devicelist.php script of the Advantech R-SeeNet monitoring software relates to the lack of protection for the SQL query structure. Exploiting this vulnerability allows a malicious actor to disclose sensitive information through a specially...

The vulnerability of the “device_list” component of the monitoring software for Advantech R-SeeNet routers allows a perpetrator to carry out cross-site scripting attacks.

The vulnerability of the “devicelist” component of the monitoring software for Advantech R-SeeNet routers involves incorrect processing of the macfilter parameter. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks by sending specially crafted SQL queri...

The vulnerability of the host_alt_filter2 parameter in the device_list.php script of the Advantech R-SeeNet router monitoring software allows a hacker to disclose protected information.

The vulnerability of the hostaltfilter2 parameter in the devicelist.php script of the Advantech R-SeeNet monitoring software relates to the lack of protection for the SQL query structure. Exploiting this vulnerability allows a malicious actor to disclose sensitive information through a specially...

Advantech R-SeeNet

1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Low attack complexity Vendor: Advantech Equipment: R-SeeNet Vulnerabilities: SQL Injection, Improper Privilege Management 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow authenticated users to perform a local privilege...

The vulnerability of the “device_list” component of the monitoring software for Advantech R-SeeNet routers allows a perpetrator to carry out cross-site scripting attacks.

The vulnerability of the “devicelist” component of the monitoring software for Advantech R-SeeNet routers involves incorrect processing of the esnfilter parameter. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks by sending specially crafted SQL queri...