CVE-2021-21936

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘healthaltfilter’ parameter. This can be done as any authenticated user or through cross-site request forgery...

CVE-2021-21936

CVE-2021-21936 describes multiple SQL injection vulnerabilities in Advantech R-SeeNet driven by insecure SQL construction in device_list.php. The issues arise from using session-scoped filters (e.g., health_filter, desc_filter, loc_filter, prod_filter, sn_filter, mac_filter, name_filter, imei_fil...

Advantech R-SeeNet

1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Low attack complexity Vendor: Advantech Equipment: R-SeeNet Vulnerabilities: SQL Injection, Improper Privilege Management 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow authenticated users to perform a local privilege...