CVE-2022-2420

CVE-2022-2420 concerns URVE Web Manager. The issue affects the file handling in _internal/uploader.php, enabling unrestricted file upload. The vulnerability is described as requiring access from within the local network, with the exploit disclosed publicly and potentially usable. Several connecte...

CVE-2022-2420 URVE Web Manager uploader.php unrestricted upload

A vulnerability was found in URVE Web Manager. It has been rated as critical. This issue affects some unknown processing of the file internal/uploader.php. The manipulation leads to unrestricted upload. The attack needs to be approached within the local network. The exploit has been disclosed to...

CVE-2022-2419

CVE-2022-2419 concerns URVE Web Manager where the unrestricted upload vulnerability lies in the _internal/collector/upload.php file. The public details indicate an impact allowing arbitrary file uploads, enabling access to the local network. The base score is high (8.0, CVSS 3.1) with Attack Vect...

CVE-2022-2419 URVE Web Manager upload.php unrestricted upload

A vulnerability was found in URVE Web Manager. It has been declared as critical. This vulnerability affects unknown code of the file internal/collector/upload.php. The manipulation leads to unrestricted upload. Access to the local network is required for this attack to succeed. The exploit has be...

CVE-2022-2419 URVE Web Manager upload.php unrestricted upload

A vulnerability was found in URVE Web Manager. It has been declared as critical. This vulnerability affects unknown code of the file internal/collector/upload.php. The manipulation leads to unrestricted upload. Access to the local network is required for this attack to succeed. The exploit has be...

CVE-2022-2418

The CVE-2022-2418 entry concerns URVE Web Manager. Affects the file kreator.html5/img_upload.php, where an unrestricted file upload is possible. Underlying cause is unsafe file upload handling in that component, enabling potentially malicious code or data to be uploaded. The vulnerability is clas...

CVE-2022-2418 URVE Web Manager img_upload.php unrestricted upload

A vulnerability was found in URVE Web Manager. It has been classified as critical. This affects an unknown part of the file kreator.html5/imgupload.php. The manipulation leads to unrestricted upload. Access to the local network is required for this attack. The exploit has been disclosed to the...

CVE-2022-2418 URVE Web Manager img_upload.php unrestricted upload

A vulnerability was found in URVE Web Manager. It has been classified as critical. This affects an unknown part of the file kreator.html5/imgupload.php. The manipulation leads to unrestricted upload. Access to the local network is required for this attack. The exploit has been disclosed to the...

URVE Web Manager 代码问题漏洞

URVE Web Manager is a website manager from URVE. A security vulnerability exists in URVE Web Manager that can be exploited by attackers to upload files without restriction...

URVE Web Manager 代码问题漏洞

URVE Web Manager is a website manager from URVE. A security vulnerability exists in URVE Web Manager that can be exploited by attackers to upload files without restriction...

URVE Web Manager 代码问题漏洞

URVE Web Manager is a website manager from URVE. A security vulnerability exists in URVE Web Manager that can be exploited by attackers to upload files without restriction...

Command Execution Vulnerability in Urve

Urve is a device for booking meeting rooms/guest rooms. A command execution vulnerability exists in Urve. An attacker could exploit this vulnerability to gain server privileges...

URVE Remote Code Execution (CVE-2020-29552)

A remote code execution vulnerability exists in URVE. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

URVE Software Build 24.03.2020 Information Disclosure

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2020-042 Product: URVE Software Manufacturer: Eveo Sp. z o.o. Affected Versions: Build "24.03.2020" Tested Versions: Build "24.03.2020" Vulnerability Type: Cleartext Storage of Sensitive Information CWE-312 Exposure of Sensitive...

URVE Software Build 24.03.2020 Missing Authorization

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2020-041 Product: URVE Software Manufacturer: Eveo Sp. z o.o. Affected Versions: Build "24.03.2020" Tested Versions: Build "24.03.2020" Vulnerability Type: Missing Authorization CWE-862 Risk Level: High Solution Status: Open...

URVE Software Build 24.03.2020 Authentication Bypass / Remote Code Execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2020-040 Product: URVE Software Manufacturer: Eveo Sp. z o.o. Affected Versions: Build "24.03.2020" Tested Versions: Build "24.03.2020" Vulnerability Type: Missing Authentication for Critical Function CWE-306 Risk Level: High...

CVE-2020-29552

An issue was discovered in URVE Build 24.03.2020. By using the internal/pc/vpro.php?mac=0&ip=0&operation=0&usr=0&pass=0%3bpowershell+-c+" substring, it is possible to execute a Powershell command and redirect its output to a file under the web root...

CVE-2020-29551

An issue was discovered in URVE Build 24.03.2020. Using the internal/pc/shutdown.php path, it is possible to shutdown the system. Among others, the following files and scripts are also accessible: internal/pc/abort.php, internal/pc/restart.php, internal/pc/vpro.php, internal/pc/wake.php,...

CVE-2020-29550

An issue was discovered in URVE Build 24.03.2020. The password of an integration user account used for the connection of the MS Office 365 Integration Service is stored in cleartext in configuration files as well as in the database. The following files contain the password in cleartext:...

CVE-2020-29552

An issue was discovered in URVE Build 24.03.2020. By using the internal/pc/vpro.php?mac=0&ip=0&operation=0&usr=0&pass=0%3bpowershell+-c+" substring, it is possible to execute a Powershell command and redirect its output to a file under the web root...