CVE-2020-10623

Multiple vulnerabilities could allow an attacker with low privileges to perform SQL injection on WebAccess/NMS versions prior to 3.0.2 to gain access to sensitive information...

CVE-2020-10623

CVE-2020-10623 describes a SQL injection vulnerability in Advantech WebAccess/NMS versions prior to 3.0.2 that can be exploited by a user with low privileges to disclose sensitive information. The CVE is part of a set of SQL injection issues affecting WebAccess/NMS (e.g., getSyslogUiList, getFWUp...

CVE-2020-10621

Multiple issues exist that allow files to be uploaded and executed on the WebAccess/NMS versions prior to 3.0.2...

CVE-2020-10621

An arbitrary file upload vulnerability exists in Advantech WebAccess and WebAccess/NMS (versions prior to 3.0.2 ). The root cause is insufficient input validation on file paths within the ConfigRestoreAction servlet . Successful exploitation by a remote attacker allows for the uploading and execu...

CVE-2020-10603: Improper Neutralization of Special Elements used in an OS Command

WebAccess/NMS versions prior to 3.0.2 does not properly sanitize user input and may allow an attacker to inject system commands remotely...

CVE-2020-10619: Relative Path Traversal

An attacker could use a specially crafted URL to delete files outside the WebAccess/NMS's versions prior to 3.0.2 control...

CVE-2020-10621: Unrestricted Upload of File with Dangerous Type

Multiple issues exist that allow files to be uploaded and executed on the WebAccess/NMS versions prior to 3.0.2...

CVE-2020-10617: Improper Neutralization of Special Elements used in an SQL Command

There are multiple ways an unauthenticated attacker could perform SQL injection on WebAccess/NMS versions prior to 3.0.2 to gain access to sensitive information...

CVE-2020-10625: Missing Authentication for Critical Function

WebAccess/NMS versions prior to 3.0.2 allows an unauthenticated remote user to create a new admin account...

CVE-2020-10623: Improper Neutralization of Special Elements used in an SQL Command

Multiple vulnerabilities could allow an attacker with low privileges to perform SQL injection on WebAccess/NMS versions prior to 3.0.2 to gain access to sensitive information...

CVE-2020-10629: Improper Restriction of XML External Entity Reference

WebAccess/NMS versions prior to 3.0.2 does not sanitize XML input. Specially crafted XML input could allow an attacker to read sensitive files...

CVE-2020-10631: Relative Path Traversal

An attacker could use a specially crafted URL to delete or read files outside the WebAccess/NMS's versions prior to 3.0.2 control...

Advantech WebAccess/NMS SQL Injection Vulnerability (CNVD-2020-22315)

Advantech WebAccess/NMS is a web browser based software suite for Network Management Systems NMS. A SQL injection vulnerability exists in Advantech WebAccess/NMS versions prior to 3.0.2, which can be exploited by attackers to obtain sensitive information...

Advantech WebAccess/NMS Path Traversal Vulnerability

Advantech WebAccess/NMS is a web browser based software suite for Network Management Systems NMS. A path traversal vulnerability exists in Advantech WebAccess/NMS versions prior to 3.0.2, which can be exploited by an attacker with a specially crafted URL to delete files beyond the control of the...

Advantech WebAccess/NMS Path Traversal Vulnerability (CNVD-2020-22313)

Advantech WebAccess/NMS is a web browser based software suite for Network Management Systems NMS. A path traversal vulnerability exists in Advantech WebAccess/NMS versions prior to 3.0.2, which can be exploited by an attacker with a specially crafted URL to delete files beyond the control of the...

Advantech WebAccess/NMS Operating System Command Injection Vulnerability

Advantech WebAccess/NMS is a Web browser-based Network Management System NMS software package from Advantech, Taiwan, China. An operating system command injection vulnerability exists in Advantech WebAccess/NMS versions prior to 3.0.2, which stems from the program failing to clean up user input. ...

PT-2020-12253

Name of the Vulnerable Software and Affected Versions Advantech WebAccess/NMS versions prior to 3.0.2 Description The issue allows an unauthenticated remote user to create a new admin account. This can be exploited by sending a request to a vulnerable endpoint, potentially allowing attackers to...

PT-2020-12981

Name of the Vulnerable Software and Affected Versions Advantech WebAccess Node versions 8.4.4 and prior Advantech WebAccess Node version 9.0.0 Description Multiple relative path traversal vulnerabilities exist that may allow an authenticated user to use a specially crafted file to delete files...

PT-2020-12249

Name of the Vulnerable Software and Affected Versions Advantech WebAccess/NMS versions prior to 3.0.2 Description The issue allows files to be uploaded and executed on the WebAccess/NMS, potentially leading to remote code execution. This is due to multiple unrestricted file upload vulnerabilities...

(0Day) Advantech WebAccess webvrpc IOCTL 0x2715 Arbitrary File Deletion Vulnerability

This vulnerability allows remote attackers to delete arbitrary files on affected installations of Advantech WebAccess Node. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of IOCTL 0x2715 in the webvrpcs process. The issue results...