CVE-2020-10619

An attacker could use a specially crafted URL to delete files outside the WebAccess/NMS's versions prior to 3.0.2 control...

CVE-2020-10631

An attacker could use a specially crafted URL to delete or read files outside the WebAccess/NMS's versions prior to 3.0.2 control...

CVE-2020-10623

Multiple vulnerabilities could allow an attacker with low privileges to perform SQL injection on WebAccess/NMS versions prior to 3.0.2 to gain access to sensitive information...

CVE-2020-10629

WebAccess/NMS versions prior to 3.0.2 does not sanitize XML input. Specially crafted XML input could allow an attacker to read sensitive files...

CVE-2020-10623

Multiple vulnerabilities could allow an attacker with low privileges to perform SQL injection on WebAccess/NMS versions prior to 3.0.2 to gain access to sensitive information...

CVE-2020-10617

There are multiple ways an unauthenticated attacker could perform SQL injection on WebAccess/NMS versions prior to 3.0.2 to gain access to sensitive information...

Code injection

WebAccess/NMS versions prior to 3.0.2 allows an unauthenticated remote user to create a new admin account...

Sql injection

Multiple vulnerabilities could allow an attacker with low privileges to perform SQL injection on WebAccess/NMS versions prior to 3.0.2 to gain access to sensitive information...

Design/Logic Flaw

An attacker could use a specially crafted URL to delete or read files outside the WebAccess/NMS's versions prior to 3.0.2 control...

Design/Logic Flaw

WebAccess/NMS versions prior to 3.0.2 does not properly sanitize user input and may allow an attacker to inject system commands remotely...

CVE-2020-10621

Multiple issues exist that allow files to be uploaded and executed on the WebAccess/NMS versions prior to 3.0.2...

CVE-2020-10621

Multiple issues exist that allow files to be uploaded and executed on the WebAccess/NMS versions prior to 3.0.2...

CVE-2020-10619

An attacker could use a specially crafted URL to delete files outside the WebAccess/NMS's versions prior to 3.0.2 control...

CVE-2020-10629

The CVE-2020-10629 entry concerns Advantech WebAccess/NMS before 3.0.2. The vulnerability is an XML External Entity (XXE) processing flaw in XML input handling, enabling reading of sensitive files. Affected component: input processing/XML parsing inside WebAccess/NMS; root cause: improper restric...

CVE-2020-10603

WebAccess/NMS versions prior to 3.0.2 does not properly sanitize user input and may allow an attacker to inject system commands remotely...

CVE-2020-10631

An attacker could use a specially crafted URL to delete or read files outside the WebAccess/NMS's versions prior to 3.0.2 control...

CVE-2020-10625

WebAccess/NMS versions prior to 3.0.2 allows an unauthenticated remote user to create a new admin account...

CVE-2020-10625

The CVE-2020-10625 entry affects Advantech WebAccess/NMS prior to 3.0.2, where an unauthenticated remote attacker can create a new administrator account due to Missing Authentication for Critical Function. This is confirmed by multiple connected sources (Red Hat advisory, ZDI, CISA ICSA, CVE reco...

CVE-2020-10617

There are multiple ways an unauthenticated attacker could perform SQL injection on WebAccess/NMS versions prior to 3.0.2 to gain access to sensitive information...

CVE-2020-10623

Multiple vulnerabilities could allow an attacker with low privileges to perform SQL injection on WebAccess/NMS versions prior to 3.0.2 to gain access to sensitive information...