CVE-2021-22656

Advantech iView versions prior to v5.7.03.6112 are vulnerable to directory traversal, which may allow an attacker to read sensitive files...

CVE-2021-22654

Advantech iView versions prior to v5.7.03.6112 are vulnerable to a SQL injection, which may allow an unauthorized attacker to disclose information...

Sql injection

Advantech iView versions prior to v5.7.03.6112 are vulnerable to a SQL injection, which may allow an unauthorized attacker to disclose information...

Directory traversal

Advantech iView versions prior to v5.7.03.6112 are vulnerable to directory traversal, which may allow an attacker to read sensitive files...

CVE-2021-22652

Access to the Advantech iView versions prior to v5.7.03.6112 configuration are missing authentication, which may allow an unauthorized attacker to change the configuration and obtain code execution...

Sql injection

Advantech iView versions prior to v5.7.03.6112 are vulnerable to a SQL injection, which may allow an attacker to escalate privileges to 'Administrator'...

CVE-2021-22652

Access to the Advantech iView versions prior to v5.7.03.6112 configuration are missing authentication, which may allow an unauthorized attacker to change the configuration and obtain code execution...

CVE-2021-22652

CVE-2021-22652 concerns Advantech iView prior to v5.7.03.6112. A missing authentication vulnerability on configuration access may allow an unauthenticated attacker to modify settings and achieve code execution. Public sources in the connected set corroborate an unauthenticated remote code executi...

CVE-2021-22656

Advantech iView versions prior to v5.7.03.6112 are vulnerable to directory traversal, which may allow an attacker to read sensitive files...

CVE-2021-22656

Advantech iView vulnerable in versions prior to 5.7.03.6112 due to a directory traversal flaw in the CommandServlet class caused by improper validation of a user-supplied path, potentially allowing an attacker to read sensitive files. Remediation: upgrade to iView 5.7.03.6112 or later. Public adv...

CVE-2021-22658

Advantech iView versions prior to v5.7.03.6112 are vulnerable to a SQL injection, which may allow an attacker to escalate privileges to 'Administrator'...

CVE-2021-22658

Advantech iView is affected by CVE-2021-22658 (SQL Injection) on versions prior to 5.7.03.6112. The vulnerability arises in UserServlet processing, enabling an attacker to escalate to Administrator. Multiple connected sources confirm the issue and link it to privilege escalation via unsafely cons...

CVE-2021-22654

Advantech iView versions prior to v5.7.03.6112 are vulnerable to a SQL injection, which may allow an unauthorized attacker to disclose information...

CVE-2021-22654

Advantech iView before version 5.7.03.6112 is vulnerable to SQL injection (CVE-2021-22654). The flaw allows an unauthenticated, network-accessing attacker to disclose information via insecure SQL query construction in the UserServlet/NetworkServlet components, per ZDI advisories and CVE records. ...

Advantech iView UserServlet SQL Injection Privilege Escalation Vulnerability

This vulnerability allows remote attackers to escalate privileges on affected installations of Advantech iView. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the UserServlet class. The issu...

Advantech iView CommandServlet Directory Traversal Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech iView. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CommandServlet class. The issue results from the lack of proper validation o...

Advantech iView NetworkServlet ztp_config_name SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech iView. Authentication is not required to exploit this vulnerability. The specific flaw exists within the NetworkServlet class. When parsing the ztpconfigname parameter, the process...

Advantech iView UserServlet SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech iView. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UserServlet class. The issue results from the lack of proper validation of a...

Advantech iView SQL Injection Vulnerability (CNVD-2021-13242)

Advantech iView is a device management application for the energy, water and wastewater industries. A SQL injection vulnerability exists in Advantech iView versions prior to 5.7.03.6112. An attacker can exploit this vulnerability to elevate privileges to "Administrator"...

Advantech iView SQL Injection Vulnerability (CNVD-2021-13243)

Advantech iView is a device management application for the energy, water and wastewater industries. A SQL injection vulnerability exists in versions prior to Advantech iView 5.7.03.6112. An attacker can exploit this vulnerability to disclose information...