Critical Sage X3 RCE Bug Allows Full System Takeovers

Four vulnerabilities afflict the popular Sage X3 enterprise resource planning ERP platform, researchers found – including one critical bug that rates 10 out of 10 on the CVSS vulnerability-severity scale. Two of the bugs could be chained together to allow complete system takeovers, with potential...

CVE-2020-7387..7390: Multiple Sage X3 Vulnerabilities

Four vulnerabilities involving Sage X3 were identified by Rapid7 researchers Jonathan Peterson, Aaron Herndon, Cale Black, Ryan Villarreal, and William Vu. These vulnerabilities were reported to Sage according to Rapid7's usual vulnerability disclosure process and were fixed in recent releases fo...

CVE-2020-7388

Sage X3 Unauthenticated Remote Command Execution RCE as SYSTEM in AdxDSrv.exe component. By editing the client side authentication request, an attacker can bypass credential validation. While exploiting this does require knowledge of the installation path, that information can be learned by...

CVE-2020-7389

Sage X3 System CHAINE Variable Script Command Injection. An authenticated user with developer access can pass OS commands via this variable used by the web application. Note, this developer configuration should not be deployed in production...

CVE-2020-7387

Sage X3 Installation Pathname Disclosure. A specially crafted packet can elicit a response from the AdxDSrv.exe component that reveals the installation directory of the product. Note that this vulnerability can be combined with CVE-2020-7388 to achieve full RCE. This issue was fixed in AdxAdmin...

Sage X3 Administration Service Authentication Bypass Command Execution

This module leverages an authentication bypass exploit within Sage X3 AdxSrv's administration protocol to execute arbitrary commands as SYSTEM against a Sage X3 Server running an available AdxAdmin service. Module Options msf use exploit/windows/sage/x3/adxsrvauthbypasscmdexec msf...

Weak Password Vulnerability in Huawei Technologies Co.'s Eudemon 1000E-X3 Management Platform

Eudemon 1000E-X3 is a firewall product from Huawei Technologies Co. A weak password vulnerability exists in the Eudemon1000E-X3 management platform of Huawei Technologies Co. that can be exploited by attackers to obtain sensitive information...

CVE-2020-16228

In Patient Information Center iX PICiX Versions C.02 and C.03, PerformanceBridge Focal Point Version A.01, IntelliVue patient monitors MX100, MX400-MX550, MX750, MX850, and IntelliVue X3 Versions N and prior, the software does not check or incorrectly checks the revocation status of a certificate...

CVE-2020-16228: Improper Check for Certificate Revocation

In Patient Information Center iX PICiX Versions C.02 and C.03, PerformanceBridge Focal Point Version A.01, IntelliVue patient monitors MX100, MX400-MX550, MX750, MX850, and IntelliVue X3 Versions N and prior, the software does not check or incorrectly checks the revocation status of a certificate...

PT-2020-7290

Name of the Vulnerable Software and Affected Versions: cPanel & WHM version 11.34.0 build 8 Description: The issue concerns a XSS vulnerability found in the clientconf.html and detailbw.html pages in x3. Recommendations: For cPanel & WHM version 11.34.0 build 8, consider restricting access to the...

cPanel cross-site scripting vulnerability (CNVD-2019-29016)

cPanel is a set of Web-based automated colocation platforms from the American company cPanel. The platform is primarily used to automate the management of websites and servers. A cross-site scripting vulnerability exists in X3 Reseller Branding Images in versions prior to cPanel 55.9999.141. The...

Design/Logic Flaw

cPanel before 55.9999.141 allows self XSS in X3 Reseller Branding Images SEC-88...

Design/Logic Flaw

cPanel before 11.54.0.4 allows self XSS in the X3 Entropy Banner interface SEC-87...

CVE-2016-10854

CVE-2016-10854 affects cPanel prior to 11.54.0.4, where the X3 Entropy Banner interface is vulnerable to a self XSS. The description is corroborated across multiple feeds (e.g., NVD and RH advisories) as a self-XSS in the X3 Entropy Banner. The available sources do not provide exploit details or ...

CVE-2016-10854

cPanel before 11.54.0.4 allows self XSS in the X3 Entropy Banner interface SEC-87...

PT-2019-7618

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 55.9999.141 Description The issue allows self XSS in X3 Reseller Branding Images. Recommendations For versions prior to 55.9999.141, update to version 55.9999.141 or later to resolve the issue...

CVE-2016-10854: Improper Neutralization of Input During Web Page Generation

cPanel before 11.54.0.4 allows self XSS in the X3 Entropy Banner interface SEC-87...

PT-2019-7650

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 11.54.0.4 Description The issue allows self XSS in the X3 Entropy Banner interface. Recommendations For versions prior to 11.54.0.4, update to version 11.54.0.4 or later to resolve the issue...

CVE-2016-10822: Improper Neutralization of Input During Web Page Generation

cPanel before 55.9999.141 allows self XSS in X3 Reseller Branding Images SEC-88...

DEWESoft X3 SP1 Arbitrary Code Execution Vulnerability

DEWESoft X3 SP1 is a device for industrial measurements. A security vulnerability exists in the RunExeFile.exe file in the DEWESoft X3 SP1 64-bit device, which originates when the program requires authentication for a session on TCP port 1999. A remote attacker could exploit the vulnerability to...