CVE-2020-10625

WebAccess/NMS versions prior to 3.0.2 allows an unauthenticated remote user to create a new admin account...

CVE-2020-10617

There are multiple ways an unauthenticated attacker could perform SQL injection on WebAccess/NMS versions prior to 3.0.2 to gain access to sensitive information...

CVE-2020-10623

Multiple vulnerabilities could allow an attacker with low privileges to perform SQL injection on WebAccess/NMS versions prior to 3.0.2 to gain access to sensitive information...

CVE-2020-10631: Relative Path Traversal

An attacker could use a specially crafted URL to delete or read files outside the WebAccess/NMS's versions prior to 3.0.2 control...

CVE-2020-10603: Improper Neutralization of Special Elements used in an OS Command

WebAccess/NMS versions prior to 3.0.2 does not properly sanitize user input and may allow an attacker to inject system commands remotely...

CVE-2020-10619: Relative Path Traversal

An attacker could use a specially crafted URL to delete files outside the WebAccess/NMS's versions prior to 3.0.2 control...

CVE-2020-10621: Unrestricted Upload of File with Dangerous Type

Multiple issues exist that allow files to be uploaded and executed on the WebAccess/NMS versions prior to 3.0.2...

CVE-2020-10617: Improper Neutralization of Special Elements used in an SQL Command

There are multiple ways an unauthenticated attacker could perform SQL injection on WebAccess/NMS versions prior to 3.0.2 to gain access to sensitive information...

CVE-2020-10625: Missing Authentication for Critical Function

WebAccess/NMS versions prior to 3.0.2 allows an unauthenticated remote user to create a new admin account...

CVE-2020-10623: Improper Neutralization of Special Elements used in an SQL Command

Multiple vulnerabilities could allow an attacker with low privileges to perform SQL injection on WebAccess/NMS versions prior to 3.0.2 to gain access to sensitive information...

CVE-2020-10629: Improper Restriction of XML External Entity Reference

WebAccess/NMS versions prior to 3.0.2 does not sanitize XML input. Specially crafted XML input could allow an attacker to read sensitive files...

Advantech WebAccess/NMS Path Traversal Vulnerability

Advantech WebAccess/NMS is a web browser based software suite for Network Management Systems NMS. A path traversal vulnerability exists in Advantech WebAccess/NMS versions prior to 3.0.2, which can be exploited by an attacker with a specially crafted URL to delete files beyond the control of the...

PT-2020-12253

Name of the Vulnerable Software and Affected Versions Advantech WebAccess/NMS versions prior to 3.0.2 Description The issue allows an unauthenticated remote user to create a new admin account. This can be exploited by sending a request to a vulnerable endpoint, potentially allowing attackers to...

PT-2020-12249

Name of the Vulnerable Software and Affected Versions Advantech WebAccess/NMS versions prior to 3.0.2 Description The issue allows files to be uploaded and executed on the WebAccess/NMS, potentially leading to remote code execution. This is due to multiple unrestricted file upload vulnerabilities...

Advantech WebAccess/NMS addLinkMonitor SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/NMS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of calls to the addLinkMonitor method of the...

Advantech WebAccess/NMS getTrunkNumber SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/NMS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of calls to the getTrunkNumber method of the DBUtil class...

Advantech WebAccess/NMS DBUtil SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/NMS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of calls to the getDevices method of the DBUtil class. Wh...

Advantech WebAccess/NMS DBUtil SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/NMS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of calls to the getModelIdByModelName method of the DBUti...

Advantech WebAccess/NMS DBUtil SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/NMS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of calls to the getEmsgroupIndex method of the DBUtil...

Advantech WebAccess/NMS getFWUpgradeInfo SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/NMS. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processi...