CVE-2019-14481

AdRem NetCrunch 10.6.0.4587 has a Cross-Site Request Forgery CSRF vulnerability in the NetCrunch web client. Successful exploitation requires a logged-in user to open a malicious page and leads to account takeover...

CVE-2019-14476

AdRem NetCrunch 10.6.0.4587 has a Server-Side Request Forgery SSRF vulnerability in the NetCrunch server. Every user can trick the server into performing SMB requests to other systems...

CVE-2019-14476

AdRem NetCrunch 10.6.0.4587 has a Server-Side Request Forgery SSRF vulnerability in the NetCrunch server. Every user can trick the server into performing SMB requests to other systems...

CVE-2019-14478

AdRem NetCrunch 10.6.0.4587 has a stored Cross-Site Scripting XSS vulnerability in the NetCrunch web client. The user's input data is not properly encoded when being echoed back to the user. This data can be interpreted as executable code by the browser and allows an attacker to execute JavaScrip...

Remote code execution

AdRem NetCrunch 10.6.0.4587 allows Remote Code Execution. In the NetCrunch web client, a read-only administrator can execute arbitrary code on the server running the NetCrunch server software...

Cross site scripting

AdRem NetCrunch 10.6.0.4587 has a stored Cross-Site Scripting XSS vulnerability in the NetCrunch web client. The user's input data is not properly encoded when being echoed back to the user. This data can be interpreted as executable code by the browser and allows an attacker to execute JavaScrip...

CVE-2019-14478

AdRem NetCrunch 10.6.0.4587 is affected by a stored XSS in the NetCrunch web client. User input echoed back without proper encoding can be interpreted as executable code by the browser when a node’s Display Name contains an XSS payload, enabling JavaScript execution in the victim’s browser. Docum...

CVE-2019-14481

AdRem NetCrunch 10.6.0.4587 has a Cross-Site Request Forgery CSRF vulnerability in the NetCrunch web client. Successful exploitation requires a logged-in user to open a malicious page and leads to account takeover...

CVE-2019-14481

CVE-2019-14481 affects AdRem NetCrunch 10.6.0.4587 via the NetCrunch web client. The vulnerability is a Cross-Site Request Forgery (CSRF) flaw that can be exploited when a logged-in user opens a malicious page, potentially resulting in account takeover. The available connected documents confirm t...

CVE-2019-14476

AdRem NetCrunch 10.6.0.4587 has a Server-Side Request Forgery SSRF vulnerability in the NetCrunch server. Every user can trick the server into performing SMB requests to other systems...

CVE-2019-14476

CVE-2019-14476 describes a Server-Side Request Forgery (SSRF) in the NetCrunch server of AdRem NetCrunch 10.6.0.4587. The vulnerability allows any user to induce the server to perform SMB requests to external systems, i.e., it can be tricked into contacting other hosts via SMB from the NetCrunch ...

CVE-2019-14479

CVE-2019-14479 affects AdRem NetCrunch 10.6.0.4587. The vulnerability allows remote code execution via the NetCrunch web client, enabling a read-only administrator to run arbitrary code on the NetCrunch server software. The available connected documents confirm the affected product and the high-s...

CVE-2019-14479

AdRem NetCrunch 10.6.0.4587 allows Remote Code Execution. In the NetCrunch web client, a read-only administrator can execute arbitrary code on the server running the NetCrunch server software...

CVE-2019-14482

AdRem NetCrunch 10.6.0.4587 has a hardcoded SSL private key vulnerability in the NetCrunch web client. The same hardcoded SSL private key is used across different customers' installations when no other SSL certificate is installed, which allows remote attackers to defeat cryptographic protection...

CVE-2019-14480

AdRem NetCrunch 10.6.0.4587 has an Improper Session Handling vulnerability in the NetCrunch web client, which can lead to an authentication bypass or escalation of privileges...

CVE-2019-14477

AdRem NetCrunch 10.6.0.4587 has Improper Credential Storage since the internal user database is readable by low-privileged users and passwords in the database are weakly encoded or encrypted...

CVE-2019-14477

AdRem NetCrunch 10.6.0.4587 has Improper Credential Storage since the internal user database is readable by low-privileged users and passwords in the database are weakly encoded or encrypted...

CVE-2019-14480

AdRem NetCrunch 10.6.0.4587 has an Improper Session Handling vulnerability in the NetCrunch web client, which can lead to an authentication bypass or escalation of privileges...

Authentication flaw

AdRem NetCrunch 10.6.0.4587 has an Improper Session Handling vulnerability in the NetCrunch web client, which can lead to an authentication bypass or escalation of privileges...

Design/Logic Flaw

AdRem NetCrunch 10.6.0.4587 allows Credentials Disclosure. Every user can read the BSD, Linux, MacOS and Solaris private keys, private keys' passwords, and root passwords stored in the credential manager. Every administrator can read the ESX and Windows passwords stored in the credential manager...