Ozeki NG SMS Gateway Arbitrary File Deletion Vulnerability

Ozeki NG SMS Gateway is a powerful, reliable and flexible SMS gateway application. An arbitrary file deletion vulnerability exists in the Outbox feature of the TXT File module in Ozeki NG SMS Gateway 4.17.6 and earlier versions. An attacker can exploit this vulnerability to delete all/most files ...

Ozeki NG SMS Gateway CSV Injection Vulnerability

Ozeki NG SMS Gateway is a powerful, reliable and flexible SMS gateway application. A CSV injection vulnerability exists in the "Contact Export" feature in Ozeki NG SMS Gateway 4.17.6 and earlier versions. The vulnerability can be exploited to run commands on the victim computer on behalf of the...

Ozeki NG SMS Gateway Path Traversal Vulnerability

Ozeki NG SMS Gateway is a powerful, reliable and flexible SMS gateway application. A path traversal vulnerability exists in the "Script Name" of the "Autoresponder" module in Ozeki NG SMS Gateway 4.17.6 and earlier. The vulnerability can be exploited to write or overwrite arbitrary files with...

Ozeki NG SMS Gateway Server-Side Request Forgery Vulnerability

Ozeki NG SMS Gateway is a powerful, reliable and flexible SMS gateway application. A server-side request forgery vulnerability exists in Ozeki NG SMS Gateway 4.17.6 and earlier versions. The vulnerability can be exploited to conduct server-side request forgery attacks via SMS WCF or RSS To SMS...

Ozeki NG SMS Gateway Cross-Site Request Forgery Vulnerability

Ozeki NG SMS Gateway is a powerful, reliable and flexible SMS gateway application. A cross-site request forgery vulnerability exists in Ozeki NG SMS Gateway 4.17.6 and earlier versions. An attacker can use this vulnerability to trick an administrator into installing a new module or changing a...

Ozeki NG SMS Gateway Cross-Site Scripting Vulnerability

Ozeki NG SMS Gateway is a powerful, reliable and flexible SMS gateway application. A cross-site scripting vulnerability exists in Ozeki NG SMS Gateway 4.17.6 and earlier versions. The vulnerability can be exploited via the Receiver or Recipient field in the mailbox function, the OZFORMGROUPNAME...

CVE-2020-14023

Ozeki NG SMS Gateway through 4.17.6 allows SSRF via SMS WCF or RSS To SMS...

CVE-2020-14027

An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The database connection strings accept custom unsafe arguments, such as ENABLELOCALINFILE, that can be leveraged by attackers to enable MySQL Load Data Local rogue MySQL server attacks...

CVE-2020-14028

An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. By leveraging a path traversal vulnerability in the Autoreply module's Script Name, an attacker may write to or overwrite arbitrary files, with arbitrary content, usually with NT AUTHORITY\SYSTEM privileges...

CVE-2020-14031

An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The outbox functionality of the TXT File module can be used to delete all/most files in a folder. Because the product usually runs as NT AUTHORITY\SYSTEM, the only files that will not be deleted are those currently being run by the...

CVE-2020-14027

An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The database connection strings accept custom unsafe arguments, such as ENABLELOCALINFILE, that can be leveraged by attackers to enable MySQL Load Data Local rogue MySQL server attacks...

CVE-2020-14022

Ozeki NG SMS Gateway 4.17.1 through 4.17.6 does not check the file type when bulk importing new contacts "Import Contacts" functionality from a file. It is possible to upload an executable or .bat file that can be executed with the help of a functionality E.g. the "Application Starter" module...

CVE-2020-14025

Ozeki NG SMS Gateway through 4.17.6 has multiple CSRF vulnerabilities. For example, an administrator, by following a link, can be tricked into making unwanted changes such as installing new modules or changing a password...

CVE-2020-14023

Ozeki NG SMS Gateway through 4.17.6 allows SSRF via SMS WCF or RSS To SMS...

CVE-2020-14024

Ozeki NG SMS Gateway through 4.17.6 has multiple authenticated stored and/or reflected XSS vulnerabilities via the 1 Receiver or Recipient field in the Mailbox feature, 2 OZFORMGROUPNAME field in the Group configuration of addresses, 3 listname field in the Defining address lists configuration, o...

CVE-2020-14031

An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. The outbox functionality of the TXT File module can be used to delete all/most files in a folder. Because the product usually runs as NT AUTHORITY\SYSTEM, the only files that will not be deleted are those currently being run by the...

CVE-2020-14026

CSV Injection aka Excel Macro Injection or Formula Injection exists in the Export Of Contacts feature in Ozeki NG SMS Gateway through 4.17.6 via a value that is mishandled in a CSV export...

CVE-2020-14022

Ozeki NG SMS Gateway 4.17.1 through 4.17.6 does not check the file type when bulk importing new contacts "Import Contacts" functionality from a file. It is possible to upload an executable or .bat file that can be executed with the help of a functionality E.g. the "Application Starter" module...

CVE-2020-14025

Ozeki NG SMS Gateway through 4.17.6 has multiple CSRF vulnerabilities. For example, an administrator, by following a link, can be tricked into making unwanted changes such as installing new modules or changing a password...

CVE-2020-14026

CSV Injection aka Excel Macro Injection or Formula Injection exists in the Export Of Contacts feature in Ozeki NG SMS Gateway through 4.17.6 via a value that is mishandled in a CSV export...