CVE-2020-10617

There are multiple ways an unauthenticated attacker could perform SQL injection on WebAccess/NMS versions prior to 3.0.2 to gain access to sensitive information...

Code injection

WebAccess/NMS versions prior to 3.0.2 allows an unauthenticated remote user to create a new admin account...

Sql injection

Multiple vulnerabilities could allow an attacker with low privileges to perform SQL injection on WebAccess/NMS versions prior to 3.0.2 to gain access to sensitive information...

Design/Logic Flaw

An attacker could use a specially crafted URL to delete or read files outside the WebAccess/NMS's versions prior to 3.0.2 control...

Design/Logic Flaw

An attacker could use a specially crafted URL to delete files outside the WebAccess/NMS's versions prior to 3.0.2 control...

Design/Logic Flaw

WebAccess/NMS versions prior to 3.0.2 does not properly sanitize user input and may allow an attacker to inject system commands remotely...

Design/Logic Flaw

WebAccess/NMS versions prior to 3.0.2 does not sanitize XML input. Specially crafted XML input could allow an attacker to read sensitive files...

Sql injection

There are multiple ways an unauthenticated attacker could perform SQL injection on WebAccess/NMS versions prior to 3.0.2 to gain access to sensitive information...

CVE-2020-10621

Multiple issues exist that allow files to be uploaded and executed on the WebAccess/NMS versions prior to 3.0.2...

CVE-2020-10621

Multiple issues exist that allow files to be uploaded and executed on the WebAccess/NMS versions prior to 3.0.2...

CVE-2020-10619

An attacker could use a specially crafted URL to delete files outside the WebAccess/NMS's versions prior to 3.0.2 control...

CVE-2020-10619

CVE-2020-10619 is a relative path traversal vulnerability in Advantech WebAccess/NMS prior to 3.0.2 that lets unauthenticated attackers use a specially crafted URL to delete (and read) files outside the application's control. Multiple sources in the connected documents describe the issue as a pat...

CVE-2020-10629

WebAccess/NMS versions prior to 3.0.2 does not sanitize XML input. Specially crafted XML input could allow an attacker to read sensitive files...

CVE-2020-10629

The CVE-2020-10629 entry concerns Advantech WebAccess/NMS before 3.0.2. The vulnerability is an XML External Entity (XXE) processing flaw in XML input handling, enabling reading of sensitive files. Affected component: input processing/XML parsing inside WebAccess/NMS; root cause: improper restric...

CVE-2020-10603

WebAccess/NMS versions prior to 3.0.2 does not properly sanitize user input and may allow an attacker to inject system commands remotely...

CVE-2020-10603

Advantech WebAccess/NMS prior to version 3.0.2 is vulnerable to CVE-2020-10603 (OS command injection) due to improper sanitization of user input, enabling remote command execution. ZDI notes exploitation via the ManualDBBackup endpoint filename parameter, potentially with authentication bypass; c...

CVE-2020-10631

An attacker could use a specially crafted URL to delete or read files outside the WebAccess/NMS's versions prior to 3.0.2 control...

CVE-2020-10631

Advantech WebAccess/NMS (prior to version 3.0.2) is affected by CVE-2020-10631, a Relative Path Traversal vulnerability. A specially crafted URL can cause the application to delete or read files outside its intended directory, impacting confidentiality, integrity, and availability. The issue is d...

CVE-2020-10625

WebAccess/NMS versions prior to 3.0.2 allows an unauthenticated remote user to create a new admin account...

CVE-2020-10625

The CVE-2020-10625 entry affects Advantech WebAccess/NMS prior to 3.0.2, where an unauthenticated remote attacker can create a new administrator account due to Missing Authentication for Critical Function. This is confirmed by multiple connected sources (Red Hat advisory, ZDI, CISA ICSA, CVE reco...