PT-2020-10313

Name of the Vulnerable Software and Affected Versions Selesta Visual Access Manager VAM versions 4.15.0 through 4.29 Description An issue in Selesta Visual Access Manager allows blind Command Injection, enabling an attacker without authentication to execute arbitrary operating system commands. Th...

PT-2020-10310

Name of the Vulnerable Software and Affected Versions Selesta Visual Access Manager VAM versions 4.15.0 through 4.29 Description An issue was discovered that allows remote authenticated users to inject arbitrary web script or HTML via certain web pages, including /vam/vam anagraphic.php, /vam/vam...

PT-2020-10307

Name of the Vulnerable Software and Affected Versions Selesta Visual Access Manager VAM versions 4.15.0 through 4.29 Description An issue allows a user with valid credentials to create and write XML files on the filesystem via the "/common/vam editXml.php" API endpoint in the web interface. The...

PT-2020-10309

Name of the Vulnerable Software and Affected Versions Selesta Visual Access Manager VAM versions 4.15.0 through 4.29. Description An issue was discovered that allows remote authenticated users to inject arbitrary web script or HTML via the web pages "/monitor/s headmodel.php" and "/vam/vam...

PT-2020-10311

Name of the Vulnerable Software and Affected Versions Selesta Visual Access Manager VAM versions 4.15.0 through 4.29 Description An issue allows a user with valid credentials to read XML files on the filesystem via the web interface. The PHP page /common/vam editXml.php does not check the paramet...

CVE-2019-19987: Cross-Site Request Forgery (CSRF)

An issue was discovered in Selesta Visual Access Manager VAM 4.15.0 through 4.29. It allows Cross-Site Request Forgery CSRF on any HTML form. An attacker can exploit the vulnerability to abuse functionalities such as change password, add user, add privilege, and so on...

PT-2020-10306

Name of the Vulnerable Software and Affected Versions Selesta Visual Access Manager VAM versions 4.15.0 through 4.29 Description The issue allows Cross-Site Request Forgery CSRF on any HTML form, enabling an attacker to abuse functionalities such as changing passwords, adding users, adding...

CVE-2019-19991: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Selesta Visual Access Manager VAM 4.15.0 through 4.29. Multiple Reflected Cross-site scripting XSS vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML via the web pages /vam/vamanagraphic.php, /vam/vamvamuser.php, /common/vampmain.php...

PT-2020-10305

Name of the Vulnerable Software and Affected Versions Selesta Visual Access Manager VAM versions 4.15.0 through 4.29 Description An issue allows an attacker without authentication to execute arbitrary SQL SELECT statements by injecting the HTTP parameter persoid into the "/tools/VamPersonPhoto.ph...

CVE-2019-19994: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered in Selesta Visual Access Manager VAM 4.15.0 through 4.29. It allows blind Command Injection. An attacker without authentication is able to execute arbitrary operating system command by injecting the vulnerable parameter in the PHP Web page /common/vammonitorsap.php...

CVE-2019-19993: Generation of Error Message Containing Sensitive Information

An issue was discovered in Selesta Visual Access Manager VAM 4.15.0 through 4.29. Several full path disclosure vulnerability were discovered. A user, even with no authentication, may simply send arbitrary content to the vulnerable pages to generate error messages that expose some full paths...

CVE-2019-19992: Improper Input Validation

An issue was discovered in Selesta Visual Access Manager VAM 4.15.0 through 4.29. A user with valid credentials is able to read XML files on the filesystem via the web interface. The PHP page /common/vameditXml.php doesn't check the parameter that identifies the file name to be read. Thus, an...

CVE-2019-19986: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in Selesta Visual Access Manager VAM 4.15.0 through 4.29. An attacker without authentication is able to execute arbitrary SQL SELECT statements by injecting the HTTP POST or GET parameter persoid into /tools/VamPersonPhoto.php. The SQL Injection type is Error-based this...

CVE-2019-19990: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Selesta Visual Access Manager VAM 4.15.0 through 4.29. Multiple Stored Cross-site scripting XSS vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML via the web pages /monitor/sheadmodel.php and /vam/vamuser.php...

CVE-2019-19988: Out-of-bounds Write

An issue was discovered in Selesta Visual Access Manager VAM 4.15.0 through 4.29. A user with valid credentials is able to create and write XML files on the filesystem via /common/vameditXml.php in the web interface. The vulnerable PHP page checks none of these: the parameter that identifies the...