Path traversal

Advantech iView, versions 5.6 and prior, is vulnerable to multiple path traversal vulnerabilities that could allow an attacker to create/download arbitrary files, limit system availability, and remotely execute code...

Command injection

Advantech iView, versions 5.6 and prior, has an improper neutralization of special elements used in a command “command injection” vulnerability. Successful exploitation of this vulnerability may allow an attacker to send a HTTP GET or POST request that creates a command string without any...

Sql injection

Advantech iView, versions 5.6 and prior, contains multiple SQL injection vulnerabilities that are vulnerable to the use of an attacker-controlled string in the construction of SQL queries. An attacker could extract user credentials, read or modify information, and remotely execute code...

CVE-2020-14499

Advantech iView (versions 5.6 and prior) is affected by an improper access control vulnerability (CVE-2020-14499) that could allow an attacker to obtain all user account credentials. Connected sources confirm the issue stems from inadequate access control in the application, enabling credential d...

CVE-2020-14499

Advantech iView, versions 5.6 and prior, has an improper access control vulnerability. Successful exploitation of this vulnerability may allow an attacker to obtain all user accounts credentials...

CVE-2020-14505

Advantech iView, versions 5.6 and prior, has an improper neutralization of special elements used in a command “command injection” vulnerability. Successful exploitation of this vulnerability may allow an attacker to send a HTTP GET or POST request that creates a command string without any...

CVE-2020-14505

CVE-2020-14505 affects Advantech iView (versions 5.6 and prior). The vulnerability is an improper neutralization of special elements used in a command (command injection) that could allow an attacker to compose a command string via HTTP GET/POST without proper validation, enabling remote code exe...

CVE-2020-14497

Advantech iView, versions 5.6 and prior, contains multiple SQL injection vulnerabilities that are vulnerable to the use of an attacker-controlled string in the construction of SQL queries. An attacker could extract user credentials, read or modify information, and remotely execute code...

CVE-2020-14497

CVE-2020-14497 affects Advantech iView (versions ≤5.6). Connected documents reveal multiple SQL Injection vulnerabilities across iView components (NetworkServlet, LinksTable, DeviceTreeTable, SystemTable) that allow attacker-controlled input to be used in SQL queries. Root cause: lack of proper v...

CVE-2020-14507

Advantech iView, versions 5.6 and prior, is vulnerable to multiple path traversal vulnerabilities that could allow an attacker to create/download arbitrary files, limit system availability, and remotely execute code...

CVE-2020-14507

Advantech iView (versions 5.6 and earlier) is affected by multiple path traversal vulnerabilities in various components (MenuServlet, NetworkServlet, ZTPConfig, LinksTable) enabling creation/download of arbitrary files, disruption of availability, and remote code execution. Root cause across advi...

PT-2020-14044

Name of the Vulnerable Software and Affected Versions Advantech iView versions 5.6 and prior Description The issue concerns multiple SQL injection vulnerabilities that allow an attacker to use an attacker-controlled string in the construction of SQL queries. This could enable the extraction of us...

CVE-2020-14507: Improper Limitation of a Pathname to a Restricted Directory

Advantech iView, versions 5.6 and prior, is vulnerable to multiple path traversal vulnerabilities that could allow an attacker to create/download arbitrary files, limit system availability, and remotely execute code...

CVE-2020-14501: Missing Authentication for Critical Function

Advantech iView, versions 5.6 and prior, has an improper authentication for critical function CWE-306 issue. Successful exploitation of this vulnerability may allow an attacker to obtain the information of the user table, including the administrator credentials in plain text. An attacker may also...

CVE-2020-14497: Improper Neutralization of Special Elements used in an SQL Command

Advantech iView, versions 5.6 and prior, contains multiple SQL injection vulnerabilities that are vulnerable to the use of an attacker-controlled string in the construction of SQL queries. An attacker could extract user credentials, read or modify information, and remotely execute code...

PT-2020-14045

Name of the Vulnerable Software and Affected Versions Advantech iView versions 5.6 and prior Description The issue is related to improper access control, which may allow an attacker to obtain all user account credentials. Successful exploitation of this issue can lead to information disclosure...

PT-2020-14047

Name of the Vulnerable Software and Affected Versions Advantech iView versions 5.6 and prior Description The issue is related to improper input validation, which could allow an attacker to remotely execute arbitrary code. Successful exploitation of this issue could lead to remote code execution...

PT-2020-14046

Name of the Vulnerable Software and Affected Versions Advantech iView versions 5.6 and prior Description The issue is related to improper authentication for a critical function, allowing an attacker to obtain user table information, including administrator credentials in plain text. An attacker m...

PT-2020-14048

Name of the Vulnerable Software and Affected Versions Advantech iView versions 5.6 and prior Description The issue is related to an improper neutralization of special elements used in a command, also known as a command injection vulnerability. This vulnerability allows an attacker to send an HTTP...

CVE-2020-14503: Improper Input Validation

Advantech iView, versions 5.6 and prior, has an improper input validation vulnerability. Successful exploitation of this vulnerability could allow an attacker to remotely execute arbitrary code...