PT-2020-13848

Name of the Vulnerable Software and Affected Versions Ozeki NG SMS Gateway versions prior to 4.17.7 Description The issue affects the Ozeki NG SMS Gateway, where multiple authenticated stored and/or reflected XSS vulnerabilities have been identified. These vulnerabilities can be exploited via...

CVE-2020-14025: Cross-Site Request Forgery (CSRF)

Ozeki NG SMS Gateway through 4.17.6 has multiple CSRF vulnerabilities. For example, an administrator, by following a link, can be tricked into making unwanted changes such as installing new modules or changing a password...

CVE-2020-14021

An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The ASP.net SMS module can be used to read and validate the source code of ASP files. By altering the path, it can be made to read any file on the Operating System, usually with NT AUTHORITY\SYSTEM privileges...

CVE-2020-14029

An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The RSS To SMS module processes XML files in an unsafe manner. This opens the application to an XML External Entity attack that can be used to perform SSRF or read arbitrary local files...

CVE-2020-14029

An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The RSS To SMS module processes XML files in an unsafe manner. This opens the application to an XML External Entity attack that can be used to perform SSRF or read arbitrary local files...

CVE-2020-14021

An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The ASP.net SMS module can be used to read and validate the source code of ASP files. By altering the path, it can be made to read any file on the Operating System, usually with NT AUTHORITY\SYSTEM privileges...

Design/Logic Flaw

An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The ASP.net SMS module can be used to read and validate the source code of ASP files. By altering the path, it can be made to read any file on the Operating System, usually with NT AUTHORITY\SYSTEM privileges...

Xxe

An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The RSS To SMS module processes XML files in an unsafe manner. This opens the application to an XML External Entity attack that can be used to perform SSRF or read arbitrary local files...

CVE-2020-14021

An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The ASP.net SMS module can be used to read and validate the source code of ASP files. By altering the path, it can be made to read any file on the Operating System, usually with NT AUTHORITY\SYSTEM privileges...

CVE-2020-14021

The CVE-2020-14021 entry concerns Ozeki NG SMS Gateway (up to version 4.17.6). The ASP.NET SMS module can be coerced via path manipulation to read arbitrary files on the operating system, typically with NT AUTHORITY\SYSTEM privileges. This is a file-read vulnerability stemming from the module han...

CVE-2020-14029

An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The RSS To SMS module processes XML files in an unsafe manner. This opens the application to an XML External Entity attack that can be used to perform SSRF or read arbitrary local files...

CVE-2020-14029

CVE-2020-14029 affects Ozeki NG SMS Gateway up to version 4.17.6. The RSS To SMS module processes XML files in an unsafe manner, enabling an XML External Entity (XXE) attack that can be used to perform SSRF or read arbitrary local files. The available documents provide CVSS2/3.1 metrics (MEDIUM/H...

CVE-2020-14029: Improper Restriction of XML External Entity Reference

An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The RSS To SMS module processes XML files in an unsafe manner. This opens the application to an XML External Entity attack that can be used to perform SSRF or read arbitrary local files...

CVE-2020-14021: Undefined Security Weakness

An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The ASP.net SMS module can be used to read and validate the source code of ASP files. By altering the path, it can be made to read any file on the Operating System, usually with NT AUTHORITY\SYSTEM privileges...

PT-2020-13845

Name of the Vulnerable Software and Affected Versions Ozeki NG SMS Gateway versions through 4.17.6 Description An issue in the ASP.net SMS module allows it to read and validate the source code of ASP files. By altering the path, it can be made to read any file on the Operating System, usually wit...

PT-2020-13853

Name of the Vulnerable Software and Affected Versions Ozeki NG SMS Gateway versions prior to 4.17.7 Description The issue is related to the RSS To SMS module processing XML files in an unsafe manner, making the application susceptible to an XML External Entity attack. This can be exploited to...

CVE-2006-6674

Ozeki HTTP-SMS Gateway 1.0, and possibly earlier, stores usernames and passwords in plaintext in the HKLM\Software\Ozeki\SMSServer\CurrentVersion\Plugins\httpsmsgate registry key, which allows local users to obtain sensitive information...

CVE-2006-6674

The CVE concerns Ozeki HTTP-SMS Gateway 1.0 (and possibly earlier) where credentials are stored in plaintext in the registry key HKLM\Software\Ozeki\SMSServer\CurrentVersion\Plugins\httpsmsgate. This plaintext storage enables local users to obtain usernames and passwords, yielding partial confide...

CVE-2006-6674: Undefined Security Weakness

Ozeki HTTP-SMS Gateway 1.0, and possibly earlier, stores usernames and passwords in plaintext in the HKLM\Software\Ozeki\SMSServer\CurrentVersion\Plugins\httpsmsgate registry key, which allows local users to obtain sensitive information...