887 matches found
Design/Logic Flaw
WebAccess/NMS versions prior to 3.0.2 does not sanitize XML input. Specially crafted XML input could allow an attacker to read sensitive files...
Design/Logic Flaw
WebAccess/NMS versions prior to 3.0.2 does not properly sanitize user input and may allow an attacker to inject system commands remotely...
Sql injection
There are multiple ways an unauthenticated attacker could perform SQL injection on WebAccess/NMS versions prior to 3.0.2 to gain access to sensitive information...
CVE-2020-10621
Multiple issues exist that allow files to be uploaded and executed on the WebAccess/NMS versions prior to 3.0.2...
CVE-2020-10621
Multiple issues exist that allow files to be uploaded and executed on the WebAccess/NMS versions prior to 3.0.2...
CVE-2020-10619
An attacker could use a specially crafted URL to delete files outside the WebAccess/NMS's versions prior to 3.0.2 control...
CVE-2020-10619
CVE-2020-10619 is a relative path traversal vulnerability in Advantech WebAccess/NMS prior to 3.0.2 that lets unauthenticated attackers use a specially crafted URL to delete (and read) files outside the application's control. Multiple sources in the connected documents describe the issue as a pat...
CVE-2020-10629
WebAccess/NMS versions prior to 3.0.2 does not sanitize XML input. Specially crafted XML input could allow an attacker to read sensitive files...
CVE-2020-10629
The CVE-2020-10629 entry concerns Advantech WebAccess/NMS before 3.0.2. The vulnerability is an XML External Entity (XXE) processing flaw in XML input handling, enabling reading of sensitive files. Affected component: input processing/XML parsing inside WebAccess/NMS; root cause: improper restric...
CVE-2020-10603
WebAccess/NMS versions prior to 3.0.2 does not properly sanitize user input and may allow an attacker to inject system commands remotely...
CVE-2020-10603
Advantech WebAccess/NMS prior to version 3.0.2 is vulnerable to CVE-2020-10603 (OS command injection) due to improper sanitization of user input, enabling remote command execution. ZDI notes exploitation via the ManualDBBackup endpoint filename parameter, potentially with authentication bypass; c...
CVE-2020-10631
An attacker could use a specially crafted URL to delete or read files outside the WebAccess/NMS's versions prior to 3.0.2 control...
CVE-2020-10631
Advantech WebAccess/NMS (prior to version 3.0.2) is affected by CVE-2020-10631, a Relative Path Traversal vulnerability. A specially crafted URL can cause the application to delete or read files outside its intended directory, impacting confidentiality, integrity, and availability. The issue is d...
CVE-2020-10625
WebAccess/NMS versions prior to 3.0.2 allows an unauthenticated remote user to create a new admin account...
CVE-2020-10625
The CVE-2020-10625 entry affects Advantech WebAccess/NMS prior to 3.0.2, where an unauthenticated remote attacker can create a new administrator account due to Missing Authentication for Critical Function. This is confirmed by multiple connected sources (Red Hat advisory, ZDI, CISA ICSA, CVE reco...
CVE-2020-10617
There are multiple ways an unauthenticated attacker could perform SQL injection on WebAccess/NMS versions prior to 3.0.2 to gain access to sensitive information...
CVE-2020-10617
This CVE affects Advantech WebAccess/NMS, with SQL injection vulnerabilities in versions prior to 3.0.2. The root cause involves unauthenticated input handling that allows constructing SQL queries (e.g., Login.view, searchDevice.action, EMSgroupAction.action, mibBrowserSetAction) and disclosing s...
CVE-2020-10623
CVE-2020-10623 describes a SQL injection vulnerability in Advantech WebAccess/NMS versions prior to 3.0.2 that can be exploited by a user with low privileges to disclose sensitive information. The CVE is part of a set of SQL injection issues affecting WebAccess/NMS (e.g., getSyslogUiList, getFWUp...