CVE-2021-21933

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this at ‘esnfilter’ parameter. This can be done as any authenticated user or through cross-site request forgery...

CVE-2021-21933

Summary (CVE-2021-21933): The Advantech R-SeeNet application contains SQL injection vulnerabilities on the device_list page (multiple filters such as esn_filter, descr, host, etc.). An authenticated attacker can trigger injections via crafted HTTP requests (including CSRF). The exploits stem from...

Advantech R-SeeNet

1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Low attack complexity Vendor: Advantech Equipment: R-SeeNet Vulnerabilities: SQL Injection, Improper Privilege Management 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow authenticated users to perform a local privilege...