CVE-2020-15336

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has no authentication for /cnr requests...

CVE-2020-15335

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has no authentication for /registerCpe requests...

Authentication flaw

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has no authentication for /cnr requests...

Authentication flaw

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has no authentication for /registerCpe requests...

CVE-2020-15332

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak /opt/axess/etc/default/axess permissions...

CVE-2020-15332

Zyxel CloudCNM SecuManager (versions 3.1.0–3.1.1) is affected by weak permissions on /opt/axess/etc/default/axess. The underlying issue is insecure permissioning that can enable unauthorized access to stored credentials. Some sources describe potential remote access consequences, emphasizing unen...

CVE-2020-15333

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows attackers to discover accounts via MySQL "select from Administratorusers" and "select from Usersusers" requests...

CVE-2020-15333

Zyxel CloudCNM SecuManager (versions 3.1.0 and 3.1.1) is impacted by an SQL injection vulnerability that allows an attacker to discover accounts via MySQL queries such as “select * from Administrator_users” and “select * from Users_users.” Root cause is insufficient protection of the SQL query st...

CVE-2020-15334

Zyxel CloudCNM SecuManager is affected in versions 3.1.0–3.1.1 by an escape-sequence injection into the /var/log/axxmpp.log file. The issue relates to the API endpoint handling that log file; the exact vulnerable parameters are not specified in the documents. No explicit exploit details or in-the...

CVE-2020-15334

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows escape-sequence injection into the /var/log/axxmpp.log file...

CVE-2020-15335

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has no authentication for /registerCpe requests...

CVE-2020-15335

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 are affected by an authentication bypass in /registerCpe requests, enabling likely unauthorized access. The CVE entry (CVE-2020-15335) is rated with CVSS v3.1 base score 7.5 (HIGH) and CVSS v2 base score 5.0 (MEDIUM). Documented impact indicates no authe...

CVE-2020-15336

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has no authentication for /cnr requests...

CVE-2020-15336

Zyxel CloudCNM SecuManager (3.1.0 and 3.1.1) exposes /cnr endpoints without authentication, enabling unauthorized access. Red Hat and CNVD/CVE listings concur on an authentication bypass affecting these versions. The CVSS details indicate network-accessible, unauthenticated access with high integ...

CVE-2020-15337

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a "Use of GET Request Method With Sensitive Query Strings" issue for /registerCpe requests...

CVE-2020-15337

Zyxel CloudCNM SecuManager versions 3.1.0–3.1.1 have a vulnerability where the GET method is used with sensitive query strings to the /registerCpe endpoint. This could expose sensitive information via the query string. Affected product: Zyxel CloudCNM SecuManager (versions 3.1.0 and 3.1.1). Root ...

CVE-2020-15338

CVE-2020-15338 affects Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1. The issue is “Use of GET Request Method With Sensitive Query Strings” on /cnr, exposing sensitive information via GET parameters. The CVE lists a MEDIUM base score (CVSS 3.1: AV Network, AC Low, PR None, UI None, C I Low). Practic...

CVE-2020-15338

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a "Use of GET Request Method With Sensitive Query Strings" issue for /cnr requests...

CVE-2020-15339

Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 allows live/CPEManager/AXCampaignManager/handlecampaignscriptlink?scriptname= XSS...

CVE-2020-15339

CVE-2020-15339 affects Zyxel CloudCNM SecuManager, specifically versions 3.1.0–3.1.1. Multiple connected sources corroborate a cross-site scripting (XSS) vulnerability in the endpoint /CPEManager/AXCampaignManager/handle_campaign_script_link?script_name=, arising from the handle_campaign_script_l...