CVE-2020-10617

There are multiple ways an unauthenticated attacker could perform SQL injection on WebAccess/NMS versions prior to 3.0.2 to gain access to sensitive information...

CVE-2020-10617

This CVE affects Advantech WebAccess/NMS, with SQL injection vulnerabilities in versions prior to 3.0.2. The root cause involves unauthenticated input handling that allows constructing SQL queries (e.g., Login.view, searchDevice.action, EMSgroupAction.action, mibBrowserSetAction) and disclosing s...

CVE-2020-10623

CVE-2020-10623 describes a SQL injection vulnerability in Advantech WebAccess/NMS versions prior to 3.0.2 that can be exploited by a user with low privileges to disclose sensitive information. The CVE is part of a set of SQL injection issues affecting WebAccess/NMS (e.g., getSyslogUiList, getFWUp...

CVE-2020-10623

Multiple vulnerabilities could allow an attacker with low privileges to perform SQL injection on WebAccess/NMS versions prior to 3.0.2 to gain access to sensitive information...

CVE-2020-10621

Multiple issues exist that allow files to be uploaded and executed on the WebAccess/NMS versions prior to 3.0.2...

CVE-2020-10621

CVE-2020-10621 affects Advantech WebAccess/NMS prior to 3.0.2. The core issue is improper validation during file handling, enabling arbitrary file uploads via multiple endpoints (FwUpgradeAction, saveBackground.action, ConfigRestoreAction) and resulting in remote code execution. Several sources s...

Advantech WebAccess/NMS Login SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/NMS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of calls to the Login.view endpoint. When parsing the...

Advantech WebAccess/NMS Input Validation Error Vulnerability

Advantech WebAccess/NMS is a web browser based software suite for Network Management Systems NMS. An input validation error vulnerability exists in Advantech WebAccess/NMS, which can be exploited by an attacker to obtain sensitive information via specially crafted XML input...

Advantech WebAccess/NMS DBUtil SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/NMS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of calls to the getDeviceEvent method of the DBUtil class...

Advantech WebAccess/NMS FwStatusReportAction SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/NMS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of calls to the FwStatusReportAction.action endpoint. Whe...

Advantech WebAccess/NMS DBBackupResource Unrestricted File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech WebAccess/NMS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of calls to the DBBackup endpoint. The issue results from the lac...

Advantech WebAccess/NMS DBUtil SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/NMS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of calls to the getDevices method of the DBUtil class. Wh...

Advantech WebAccess/NMS ConfigRestoreAction Unrestricted File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech WebAccess/NMS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of calls to the ConfigRestoreAction.action endpoint. When parsing...

Advantech WebAccess/NMS ProfileResource Unrestricted File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech WebAccess/NMS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of calls to the importprofile endpoint. The issue results from th...

Advantech WebAccess/NMS getSyslogUiList SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/NMS. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processi...

(0Day) Advantech WebAccess IOCTL 0x2711 BwPFile Arbitrary File Deletion Vulnerability

This vulnerability allows remote attackers to delete arbitrary files on affected installations of Advantech WebAccess. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of IOCTL 0x2711, which can be used to invoke BwPFile.exe. The issue...

Advantech WebAccess/NMS TopogroupeditAction SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/NMS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of calls to the TopogroupeditAction.action endpoint. When...

Advantech WebAccess/NMS SQL Injection Vulnerability (CNVD-2020-22315)

Advantech WebAccess/NMS is a web browser based software suite for Network Management Systems NMS. A SQL injection vulnerability exists in Advantech WebAccess/NMS versions prior to 3.0.2, which can be exploited by attackers to obtain sensitive information...

Advantech WebAccess/NMS searchDevice SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/NMS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of calls to the searchDevice.action endpoint. When parsin...

Advantech WebAccess/NMS DBUtil SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/NMS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of calls to the getManagedDeviceByIP method of the DBUtil...