CVE-2024-39871

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.2 SP1. Affected applications do not properly separate the rights to edit device settings and to edit settings for communication relations. This could allow an authenticated attacker with the permission to manage...

CVE-2024-39875

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.2 SP1. The affected application allows authenticated, low privilege users with the 'Manage own remote connections' permission to retrieve details about other users and group memberships...

CVE-2024-39569

A vulnerability has been identified in SINEMA Remote Connect Client All versions V3.2 HF1. The system service of affected applications is vulnerable to command injection due to missing server side input sanitation when loading VPN configurations. This could allow an administrative remote attacker...

CVE-2023-35796

A vulnerability has been identified in SINEMA Server V14 All versions. The affected application improperly sanitizes certain SNMP configuration data retrieved from monitored devices. An attacker with access to a monitored device could perform a stored cross-site scripting XSS attack that may lead...

CVE-2022-32259

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. The system images for installation or update of the affected application contain unit test scripts with sensitive information. An attacker could gain information about testing architecture and also tamper with...

CVE-2022-32260

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.2 SP1. The affected application creates temporary user credentials for UMC User Management Component users. An attacker could use these temporary credentials for authentication bypass in certain scenarios...

CVE-2022-29034

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. An error message pop up window in the web interface of the affected application does not prevent injection of JavaScript code. This could allow attackers to perform reflected cross-site scripting XSS attacks...

CVE-2022-32252

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. The application does not perform the integrity check of the update packages. Without validation, an admin user might be tricked to install a malicious package, granting root privileges to an attacker...

CVE-2022-32254

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. A customized HTTP POST request could force the application to write the status of a given user to a log file, exposing sensitive user information that could provide valuable guidance to an attacker...

CVE-2022-32255

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. The affected application consists of a web service that lacks proper access control for some of the endpoints. This could lead to unauthorized access to limited information...

CVE-2022-32261

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. The affected application contains a misconfiguration in the APT update. This could allow an attacker to add insecure packages to the application...

CVE-2022-32256

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. The affected application consists of a web service that lacks proper access control for some of the endpoints. This could lead to low privileged users accessing privileged information...

CVE-2022-32253

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. Due to improper input validation, the OpenSSL certificate's password could be printed to a file reachable by an attacker...

CVE-2022-32258

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. The affected application contains an older feature that allows to import device configurations via a specific endpoint. An attacker could use this vulnerability for information disclosure...

CVE-2022-27219

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.0 SP2. Affected application is missing general HTTP security headers in the web server configured on port 443. This could aid attackers by making the servers more prone to clickjacking, channel downgrade attacks a...

CVE-2022-27221

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. An attacker in machine-in-the-middle could obtain plaintext secret values by observing length differences during a series of guesses in which a string in an HTTP request URL potentially matches an unknown strin...

CVE-2021-37192

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.0 SP2. The affected software has an information disclosure vulnerability that could allow an attacker to retrieve a list of network devices a known user can manage...

CVE-2021-37190

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.0 SP2. The affected software has an information disclosure vulnerability that could allow an attacker to retrieve VPN connection for a known user...

CVE-2021-37191

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.0 SP2. An unauthenticated attacker in the same network of the affected system could brute force the usernames from the affected software...

CVE-2021-37193

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.0 SP2. An unauthenticated attacker in the same network of the affected system could manipulate certain parameters and set a valid user of the affected software as invalid or vice-versa...