CVE-2023-1779

Exposure of Sensitive Information to an unauthorized actor vulnerability in MB Connect Lines mbCONNECT24, mymbCONNECT24 and Helmholz' myREX24 and myREX24.virtual in versions =2.13.3 allow an authorized remote attacker with low privileges to view a limited amount of another accounts contact...

Authorization

An Authorization Bypass vulnerability was found in MB Connect Lines mbCONNECT24, mymbCONNECT24 and Helmholz' myREX24 and myREX24.virtual version = 2.13.3. An authenticated remote user with low privileges can change the password of any user in the same account. This allows to take over the admin...

Information disclosure

Exposure of Sensitive Information to an unauthorized actor vulnerability in MB Connect Lines mbCONNECT24, mymbCONNECT24 and Helmholz' myREX24 and myREX24.virtual in versions =2.13.3 allow an authorized remote attacker with low privileges to view a limited amount of another accounts contact...

CVE-2023-1779 Helmholz and MB Connect Line: Account takeover via password reset in multiple products

Exposure of Sensitive Information to an unauthorized actor vulnerability in MB Connect Lines mbCONNECT24, mymbCONNECT24 and Helmholz' myREX24 and myREX24.virtual in versions =2.13.3 allow an authorized remote attacker with low privileges to view a limited amount of another accounts contact...

CVE-2023-1779

CVE-2023-1779 affects MB Connect Line products mbCONNECT24, mymbCONNECT24, Helmholz’ myREX24 and myREX24.virtual (versions

CVE-2023-1779 Helmholz and MB Connect Line: Account takeover via password reset in multiple products

Exposure of Sensitive Information to an unauthorized actor vulnerability in MB Connect Lines mbCONNECT24, mymbCONNECT24 and Helmholz' myREX24 and myREX24.virtual in versions =2.13.3 allow an authorized remote attacker with low privileges to view a limited amount of another accounts contact...

CVE-2023-0985 Helmholz and MB Connect Line: Account takeover via password reset in multiple products

An Authorization Bypass vulnerability was found in MB Connect Lines mbCONNECT24, mymbCONNECT24 and Helmholz' myREX24 and myREX24.virtual version = 2.13.3. An authenticated remote user with low privileges can change the password of any user in the same account. This allows to take over the admin...

CVE-2023-0985

The CVE-2023-0985 entry concerns an Authorization Bypass in MB Connect Line mbCONNECT24, mymbCONNECT24 and Helmholz’ myREX24 and myREX24.virtual (versions ≤ 2.13.3). The root cause is an authenticated, low-privilege user being able to change the password of any user in the same account, enabling ...

PT-2023-16666 · Helmholz +1 · Myrex24 +2

Name of the Vulnerable Software and Affected Versions: MB Connect Lines mbCONNECT24 versions = 2.13.3 mymbCONNECT24 versions = 2.13.3 Helmholz' myREX24 versions = 2.13.3 Helmholz' myREX24.virtual versions = 2.13.3 Description: An Authorization Bypass issue allows an authenticated remote user with...

CVE-2023-1779: Incorrect Authorization

Exposure of Sensitive Information to an unauthorized actor vulnerability in MB Connect Lines mbCONNECT24, mymbCONNECT24 and Helmholz' myREX24 and myREX24.virtual in versions =2.13.3 allow an authorized remote attacker with low privileges to view a limited amount of another accounts contact...

CVE-2023-0985: Authorization Bypass Through User-Controlled Key

An Authorization Bypass vulnerability was found in MB Connect Lines mbCONNECT24, mymbCONNECT24 and Helmholz' myREX24 and myREX24.virtual version = 2.13.3. An authenticated remote user with low privileges can change the password of any user in the same account. This allows to take over the admin...

docs.mbsecurities.ca Cross Site Scripting vulnerability OBB-3341915

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-25072

Use of weak credentials exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier, which may allow a remote unauthenticated attacker to decrypt password for the WebUI of the product...

CVE-2023-25072

Use of weak credentials exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier, which may allow a remote unauthenticated attacker to decrypt password for the WebUI of the product...

CVE-2023-25070

Cleartext transmission of sensitive information exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier. If the telnet connection is enabled, a remote unauthenticated attacker may eavesdrop on or alter the administrator's communication to the product...

CVE-2023-23906

Missing authentication for critical function exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier, which may allow a remote unauthenticated attacker to execute some critical functions without authentication, e.g., rebooting the product...

CVE-2023-24586

Cleartext storage of sensitive information exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier, which may allow a remote authenticated attacker to obtain an APN credential for the product...

CVE-2023-24586

Cleartext storage of sensitive information exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier, which may allow a remote authenticated attacker to obtain an APN credential for the product...

CVE-2023-25070

Cleartext transmission of sensitive information exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier. If the telnet connection is enabled, a remote unauthenticated attacker may eavesdrop on or alter the administrator's communication to the product...

CVE-2023-23906

Missing authentication for critical function exists in SkyBridge MB-A100/110 firmware Ver. 4.2.0 and earlier, which may allow a remote unauthenticated attacker to execute some critical functions without authentication, e.g., rebooting the product...