CVE-2020-10623

Multiple vulnerabilities could allow an attacker with low privileges to perform SQL injection on WebAccess/NMS versions prior to 3.0.2 to gain access to sensitive information...

CVE-2020-10623

CVE-2020-10623 describes a SQL injection vulnerability in Advantech WebAccess/NMS versions prior to 3.0.2 that can be exploited by a user with low privileges to disclose sensitive information. The CVE is part of a set of SQL injection issues affecting WebAccess/NMS (e.g., getSyslogUiList, getFWUp...

CVE-2020-10621

An arbitrary file upload vulnerability exists in Advantech WebAccess and WebAccess/NMS (versions prior to 3.0.2 ). The root cause is insufficient input validation on file paths within the ConfigRestoreAction servlet . Successful exploitation by a remote attacker allows for the uploading and execu...

CVE-2020-10621

Multiple issues exist that allow files to be uploaded and executed on the WebAccess/NMS versions prior to 3.0.2...

CVE-2020-10621: Unrestricted Upload of File with Dangerous Type

Multiple issues exist that allow files to be uploaded and executed on the WebAccess/NMS versions prior to 3.0.2...

CVE-2020-10629: Improper Restriction of XML External Entity Reference

WebAccess/NMS versions prior to 3.0.2 does not sanitize XML input. Specially crafted XML input could allow an attacker to read sensitive files...

CVE-2020-10631: Relative Path Traversal

An attacker could use a specially crafted URL to delete or read files outside the WebAccess/NMS's versions prior to 3.0.2 control...

CVE-2020-10617: Improper Neutralization of Special Elements used in an SQL Command

There are multiple ways an unauthenticated attacker could perform SQL injection on WebAccess/NMS versions prior to 3.0.2 to gain access to sensitive information...

CVE-2020-10619: Relative Path Traversal

An attacker could use a specially crafted URL to delete files outside the WebAccess/NMS's versions prior to 3.0.2 control...

CVE-2020-10603: Improper Neutralization of Special Elements used in an OS Command

WebAccess/NMS versions prior to 3.0.2 does not properly sanitize user input and may allow an attacker to inject system commands remotely...

CVE-2020-10623: Improper Neutralization of Special Elements used in an SQL Command

Multiple vulnerabilities could allow an attacker with low privileges to perform SQL injection on WebAccess/NMS versions prior to 3.0.2 to gain access to sensitive information...

CVE-2020-10625: Missing Authentication for Critical Function

WebAccess/NMS versions prior to 3.0.2 allows an unauthenticated remote user to create a new admin account...

PT-2020-12232

Name of the Vulnerable Software and Affected Versions Advantech WebAccess/NMS versions prior to 3.0.2 Description The issue is related to the improper sanitization of user input, which may allow an attacker to inject system commands remotely. This could potentially lead to remote code execution...

PT-2020-12981

Name of the Vulnerable Software and Affected Versions Advantech WebAccess Node versions 8.4.4 and prior Advantech WebAccess Node version 9.0.0 Description Multiple relative path traversal vulnerabilities exist that may allow an authenticated user to use a specially crafted file to delete files...

PT-2020-12256

Name of the Vulnerable Software and Affected Versions Advantech WebAccess/NMS versions prior to 3.0.2 Description The issue is related to the lack of sanitization of XML input, which could allow an attacker to read sensitive files by providing specially crafted XML input. Recommendations For...

PT-2020-12258

Name of the Vulnerable Software and Affected Versions Advantech WebAccess/NMS versions prior to 3.0.2 Description An attacker could use a specially crafted URL to delete or read files outside the WebAccess/NMS's control. This issue allows for directory traversal, potentially leading to informatio...

Advantech WebAccess/NMS Authentication Missing Vulnerability

Advantech WebAccess/NMS is a web browser based software suite for Network Management Systems NMS. An authentication missing vulnerability exists in Advantech WebAccess/NMS, which can be exploited by an attacker to create a new administrator account...

PT-2020-12249

Name of the Vulnerable Software and Affected Versions Advantech WebAccess/NMS versions prior to 3.0.2 Description The issue allows files to be uploaded and executed on the WebAccess/NMS, potentially leading to remote code execution. This is due to multiple unrestricted file upload vulnerabilities...

PT-2020-12247

Name of the Vulnerable Software and Affected Versions Advantech WebAccess/NMS versions prior to 3.0.2 Description An attacker could use a specially crafted URL to delete files outside the WebAccess/NMS's control. This issue allows for a directory traversal denial-of-service attack. Recommendation...

PT-2020-12251

Name of the Vulnerable Software and Affected Versions Advantech WebAccess/NMS versions prior to 3.0.2 Description The issue allows an attacker with low privileges to perform SQL injection on Advantech WebAccess/NMS, potentially gaining access to sensitive information. This is made possible throug...