PT-2020-12251

Name of the Vulnerable Software and Affected Versions Advantech WebAccess/NMS versions prior to 3.0.2 Description The issue allows an attacker with low privileges to perform SQL injection on Advantech WebAccess/NMS, potentially gaining access to sensitive information. This is made possible throug...

PT-2020-12245

Name of the Vulnerable Software and Affected Versions Advantech WebAccess/NMS versions prior to 3.0.2 Description The issue allows an unauthenticated attacker to perform SQL injection, potentially gaining access to sensitive information. This can be achieved through multiple methods...

Advantech WebAccess/NMS File Upload Vulnerability

Advantech WebAccess/NMS is a web browser based software suite for Network Management Systems NMS. A file upload vulnerability exists in Advantech WebAccess/NMS versions prior to 3.0.2, which can be exploited by an attacker to upload arbitrary files...

Advantech WebAccess/NMS Path Traversal Vulnerability

Advantech WebAccess/NMS is a web browser based software suite for Network Management Systems NMS. A path traversal vulnerability exists in Advantech WebAccess/NMS versions prior to 3.0.2, which can be exploited by an attacker with a specially crafted URL to delete files beyond the control of the...

Advantech WebAccess/NMS Operating System Command Injection Vulnerability

Advantech WebAccess/NMS is a Web browser-based Network Management System NMS software package from Advantech, Taiwan, China. An operating system command injection vulnerability exists in Advantech WebAccess/NMS versions prior to 3.0.2, which stems from the program failing to clean up user input. ...

Advantech WebAccess/NMS Input Validation Error Vulnerability

Advantech WebAccess/NMS is a web browser based software suite for Network Management Systems NMS. An input validation error vulnerability exists in Advantech WebAccess/NMS, which can be exploited by an attacker to obtain sensitive information via specially crafted XML input...

Advantech WebAccess/NMS SQL Injection Vulnerability (CNVD-2020-22315)

Advantech WebAccess/NMS is a web browser based software suite for Network Management Systems NMS. A SQL injection vulnerability exists in Advantech WebAccess/NMS versions prior to 3.0.2, which can be exploited by attackers to obtain sensitive information...

PT-2020-12253

Name of the Vulnerable Software and Affected Versions Advantech WebAccess/NMS versions prior to 3.0.2 Description The issue allows an unauthenticated remote user to create a new admin account. This can be exploited by sending a request to a vulnerable endpoint, potentially allowing attackers to...

Advantech WebAccess/NMS Path Traversal Vulnerability (CNVD-2020-22313)

Advantech WebAccess/NMS is a web browser based software suite for Network Management Systems NMS. A path traversal vulnerability exists in Advantech WebAccess/NMS versions prior to 3.0.2, which can be exploited by an attacker with a specially crafted URL to delete files beyond the control of the...

Advantech WebAccess/NMS DBUtil SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/NMS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of calls to the getDeviceName method of the DBUtil class...

Advantech WebAccess/NMS ProfileResource Unrestricted File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech WebAccess/NMS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of calls to the importprofile endpoint. The issue results from th...

Advantech WebAccess/NMS DBUtil SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/NMS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of calls to the getLinkMonitor method of the DBUtil class...

Advantech WebAccess/NMS DBUtil SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/NMS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of calls to the CheckManagedid method of the DBUtil class...

Advantech WebAccess/NMS getFWUpgradeInfo SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/NMS. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processi...

Advantech WebAccess/NMS setDevicechoose SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/NMS. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processi...

Advantech WebAccess/NMS DeviceData Performance SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/NMS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of calls to the DeviceData/Performance endpoint. When...

Advantech WebAccess/NMS getSyslogUiList SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/NMS. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processi...

Advantech WebAccess/NMS MibBrowser SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/NMS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of calls to the handleDeviceNameByIpAddress method of the...

Advantech WebAccess/NMS DBUtil SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/NMS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of calls to the getSeverByAlarm method of the DBUtil clas...

Advantech WebAccess/NMS DBUtil SQL Injection Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/NMS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of calls to the deleteLinkMonitor method of the DBUtil...