CVE-2020-9024

Iteris Vantage Velocity Field Unit 2.3.1 and 2.4.2 devices have world-writable permissions for the /root/cleardata.pl executed as root by crond and /root/loadperl.sh executed as root at boot time scripts...

CVE-2020-9020

Iteris Vantage Velocity Field Unit 2.3.1, 2.4.2, and 3.0 devices allow the injection of OS commands into cgi-bin/timeconfig.py via shell metacharacters in the NTP Server field...

CVE-2020-9020

The Iteris Vantage Velocity Field Unit (versions 2.3.1 , 2.4.2 , and 3.0 ) is susceptible to an OS command injection vulnerability. The root cause is the improper neutralization of shell metacharacters within the NTP Server field, which allows an attacker to inject and execute arbitrary OS comman...

CVE-2020-9020

Iteris Vantage Velocity Field Unit 2.3.1, 2.4.2, and 3.0 devices allow the injection of OS commands into cgi-bin/timeconfig.py via shell metacharacters in the NTP Server field...

CVE-2020-9023

Affected product: Iteris Vantage Velocity Field Unit, firmware versions 2.3.1 and 2.4.2. Vulnerability: two undocumented accounts configured with weak credentials (bluetooth:bluetooth; eclipse:eclipse); the Bluetooth account is stated as the root password. Implication: configuration weakness that...

CVE-2020-9023

Iteris Vantage Velocity Field Unit 2.3.1 and 2.4.2 devices have two users that are not documented and are configured with weak passwords User bluetooth, password bluetooth; User eclipse, password eclipse. Also, bluetooth is the root password...

CVE-2020-9024

Iteris Vantage Velocity Field Unit 2.3.1 and 2.4.2 devices have world-writable permissions for the /root/cleardata.pl executed as root by crond and /root/loadperl.sh executed as root at boot time scripts...

CVE-2020-9024

The CVE concerns Iteris Vantage Velocity Field Unit, versions 2.3.1 and 2.4.2. The underlying issue is world-writable permissions on two scripts: /root/cleardata.pl (executed as root by crond) and /root/loadperl.sh (executed as root at boot). This improper permissions setup can allow unauthorized...

CVE-2020-9025

Iteris Vantage Velocity Field Unit 2.4.2 devices have multiple stored XSS issues in all parameters of the Start Data Viewer feature of the /cgi-bin/loaddata.py script...

CVE-2020-9025

CVE-2020-9025 affects Iteris Vantage Velocity Field Unit, version 2.4.2. The vulnerability is a class of stored XSS occurring in all parameters of the Start Data Viewer feature implemented by the /cgi-bin/loaddata.py script. The root cause is stated as a lack of proper validation of client-side d...

CVE-2020-9024: Incorrect Permission Assignment for Critical Resource

Iteris Vantage Velocity Field Unit 2.3.1 and 2.4.2 devices have world-writable permissions for the /root/cleardata.pl executed as root by crond and /root/loadperl.sh executed as root at boot time scripts...

CVE-2020-9020: Improper Neutralization of Special Elements used in an OS Command

Iteris Vantage Velocity Field Unit 2.3.1, 2.4.2, and 3.0 devices allow the injection of OS commands into cgi-bin/timeconfig.py via shell metacharacters in the NTP Server field...

PT-2020-20440

Name of the Vulnerable Software and Affected Versions Iteris Vantage Velocity Field Unit version 2.4.2 Description The issue concerns multiple stored XSS problems in all parameters of the Start Data Viewer feature, specifically within the /cgi-bin/loaddata.py script. Recommendations For Iteris...

PT-2020-20438

Name of the Vulnerable Software and Affected Versions Iteris Vantage Velocity Field Unit versions 2.3.1 through 2.4.2 Description The issue concerns undocumented users with weak passwords in the Iteris Vantage Velocity Field Unit. Specifically, there are two users: bluetooth with password...

PT-2020-20435

Name of the Vulnerable Software and Affected Versions Iteris Vantage Velocity Field Unit versions 2.3.1, 2.4.2, and 3.0 Description The issue allows the injection of OS commands into "cgi-bin/timeconfig.py" via shell metacharacters in the NTP Server field. Recommendations For Iteris Vantage...

PT-2020-20439

Name of the Vulnerable Software and Affected Versions Iteris Vantage Velocity Field Unit versions 2.3.1 through 2.4.2 Description The issue concerns world-writable permissions for certain scripts. Specifically, the /root/cleardata.pl script, which is executed as root by crond, and the...

CVE-2020-9025: Improper Neutralization of Input During Web Page Generation

Iteris Vantage Velocity Field Unit 2.4.2 devices have multiple stored XSS issues in all parameters of the Start Data Viewer feature of the /cgi-bin/loaddata.py script...

CVE-2020-9023: Weak Password Requirements

Iteris Vantage Velocity Field Unit 2.3.1 and 2.4.2 devices have two users that are not documented and are configured with weak passwords User bluetooth, password bluetooth; User eclipse, password eclipse. Also, bluetooth is the root password...

DEBIAN-CVE-2019-17558

Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset velocity/ directory or as a parameter. A user defined configset could contain renderable, potentially...

UBUNTU-CVE-2019-17558

Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset velocity/ directory or as a parameter. A user defined configset could contain renderable, potentially...