CVE-2020-25237

CVE-2020-25237 affects Siemens SINEC NMS (all versions < v1.0 SP1 Update 1) and SINEMA Server (all versions

CVE-2020-25237

A vulnerability has been identified in SINEC NMS All versions V1.0 SP1 Update 1, SINEMA Server All versions V14.0 SP2 Update 2. When uploading files to an affected system using a zip container, the system does not correctly check if the relative file path of the extracted files is still within th...

nms-app.netw.fr Cross Site Scripting vulnerability OBB-1382447

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Advantech WebAccess NMS ConfigRestoreAction Arbitrary File Upload (CVE-2020-10621)

An arbitrary file upload vulnerability exists in Advantech WebAccess NMS. The vulnerability is due to insufficient input validation on file paths in the ConfigRestoreAction servlet...

CVE-2020-7580

A vulnerability has been identified in SIMATIC Automation Tool All versions V4 SP2, SIMATIC NET PC Software V14 All versions V14 SP1 Update 14, SIMATIC NET PC Software V15 All versions, SIMATIC NET PC Software V16 All versions V16 Upd3, SIMATIC PCS neo All versions V3.0 SP1, SIMATIC ProSave All...

CVE-2020-10619

An attacker could use a specially crafted URL to delete files outside the WebAccess/NMS's versions prior to 3.0.2 control...

CVE-2020-10623

Multiple vulnerabilities could allow an attacker with low privileges to perform SQL injection on WebAccess/NMS versions prior to 3.0.2 to gain access to sensitive information...

CVE-2020-10619

An attacker could use a specially crafted URL to delete files outside the WebAccess/NMS's versions prior to 3.0.2 control...

CVE-2020-10603

WebAccess/NMS versions prior to 3.0.2 does not properly sanitize user input and may allow an attacker to inject system commands remotely...

CVE-2020-10625

WebAccess/NMS versions prior to 3.0.2 allows an unauthenticated remote user to create a new admin account...

CVE-2020-10623

Multiple vulnerabilities could allow an attacker with low privileges to perform SQL injection on WebAccess/NMS versions prior to 3.0.2 to gain access to sensitive information...

CVE-2020-10629

WebAccess/NMS versions prior to 3.0.2 does not sanitize XML input. Specially crafted XML input could allow an attacker to read sensitive files...

CVE-2020-10631

An attacker could use a specially crafted URL to delete or read files outside the WebAccess/NMS's versions prior to 3.0.2 control...

CVE-2020-10617

There are multiple ways an unauthenticated attacker could perform SQL injection on WebAccess/NMS versions prior to 3.0.2 to gain access to sensitive information...

CVE-2020-10617

There are multiple ways an unauthenticated attacker could perform SQL injection on WebAccess/NMS versions prior to 3.0.2 to gain access to sensitive information...

CVE-2020-10631

An attacker could use a specially crafted URL to delete or read files outside the WebAccess/NMS's versions prior to 3.0.2 control...

Code injection

WebAccess/NMS versions prior to 3.0.2 allows an unauthenticated remote user to create a new admin account...

Design/Logic Flaw

An attacker could use a specially crafted URL to delete or read files outside the WebAccess/NMS's versions prior to 3.0.2 control...

Design/Logic Flaw

An attacker could use a specially crafted URL to delete files outside the WebAccess/NMS's versions prior to 3.0.2 control...

Sql injection

Multiple vulnerabilities could allow an attacker with low privileges to perform SQL injection on WebAccess/NMS versions prior to 3.0.2 to gain access to sensitive information...