CVE-2019-14482

AdRem NetCrunch 10.6.0.4587 is affected by a hardcoded SSL private key vulnerability in the NetCrunch web client. The same hardcoded key is used across different customer installations when no other SSL certificate is installed, allowing remote attackers to defeat cryptographic protections by lev...

CVE-2019-14481

CVE-2019-14481 affects AdRem NetCrunch 10.6.0.4587 via the NetCrunch web client. The vulnerability is a Cross-Site Request Forgery (CSRF) flaw that can be exploited when a logged-in user opens a malicious page, potentially resulting in account takeover. The available connected documents confirm t...

CVE-2019-14479

CVE-2019-14479 affects AdRem NetCrunch 10.6.0.4587. The vulnerability allows remote code execution via the NetCrunch web client, enabling a read-only administrator to run arbitrary code on the NetCrunch server software. The available connected documents confirm the affected product and the high-s...

CVE-2019-14478

AdRem NetCrunch 10.6.0.4587 is affected by a stored XSS in the NetCrunch web client. User input echoed back without proper encoding can be interpreted as executable code by the browser when a node’s Display Name contains an XSS payload, enabling JavaScript execution in the victim’s browser. Docum...

CVE-2019-14476

CVE-2019-14476 describes a Server-Side Request Forgery (SSRF) in the NetCrunch server of AdRem NetCrunch 10.6.0.4587. The vulnerability allows any user to induce the server to perform SMB requests to external systems, i.e., it can be tricked into contacting other hosts via SMB from the NetCrunch ...

CVE-2019-14480

CVE-2019-14480 affects AdRem NetCrunch 10.6.0.4587 via the NetCrunch web client, described as an Improper Session Handling vulnerability that can lead to authentication bypass or privilege escalation. The connected Red Hat and NVD entries corroborate the issue and provide CVSS metrics (2.0/7.5; 3...

CVE-2019-14483

The CVE-2019-14483 entry concerns AdRem NetCrunch 10.6.0.4587, where the credential manager stores private keys and passwords (BSD/Linux/MacOS/Solaris keys, private keys and root passwords) readable by any user, and ESX/Windows passwords readable by any administrator. This is a credentials-disclo...

CVE-2019-14477

CVE-2019-14477 affects AdRem NetCrunch 10.6.0.4587. The issue is improper credential storage: the internal user database is readable by low-privileged users and passwords are weakly encoded or encrypted. No exploitation details are provided in the connected documents.