Page 15 of 301 results (0.008 seconds)

CVSS: 10.0EPSS: 96%CPEs: 1EXPL: 1

CVE-2021-21805

https://notcve.org/view.php?id=CVE-2021-21805

An OS Command Injection vulnerability exists in the ping.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). A specially crafted HTTP request can lead to arbitrary OS command execution. An attacker can send a crafted HTTP request to trigger this vulnerability. Se presenta una vulnerabilidad de inyección de comandos en el sistema operativo en la funcionalidad del script ping.php de Advantech R-SeeNet versión v2.4.12 (20.10.2020). Una petición HTTP especialmente diseñada puede conllevar a una ejecución de comandos arbitrario del sistema operativo. • https://talosintelligence.com/vulnerability_reports/TALOS-2021-1274 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •

CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0

CVE-2021-32951 – Advantech WebAccess/NMS Improper Authentication

https://notcve.org/view.php?id=CVE-2021-32951

WebAccess/NMS (Versions prior to v3.0.3_Build6299) has an improper authentication vulnerability, which may allow unauthorized users to view resources monitored and controlled by the WebAccess/NMS, as well as IP addresses and names of all the devices managed via WebAccess/NMS. WebAccess/NMS (versiones anteriores a v3.0.3_Build6299) presenta una vulnerabilidad de autenticación inapropiada, que puede permitir a usuarios no autorizados visualizar los recursos supervisados y controlados por WebAccess/NMS, así como las direcciones IP y los nombres de todos los dispositivos gestionados por medio de WebAccess/NMS This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/NMS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of the DashBoardAction endpoint of the web server. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose information from the application. • https://us-cert.cisa.gov/ics/advisories/icsa-21-229-02 • CWE-287: Improper Authentication •

CVSS: 9.6EPSS: 80%CPEs: 1EXPL: 1

CVE-2021-21803

https://notcve.org/view.php?id=CVE-2021-21803

This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially crafted URL by an attacker and visited by a victim can lead to arbitrary JavaScript code execution. Esta vulnerabilidad está presente en el script del archivo device_graph_page.php, que forma parte de las aplicaciones web de Advantech R-SeeNet. Una URL especialmente diseñada por un atacante y visitada por una víctima puede conllevar a una ejecución de código JavaScript arbitrario • https://talosintelligence.com/vulnerability_reports/TALOS-2021-1272 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 9.6EPSS: 80%CPEs: 1EXPL: 1

CVE-2021-21802

https://notcve.org/view.php?id=CVE-2021-21802

This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially crafted URL by an attacker and visited by a victim can lead to arbitrary JavaScript code execution. Esta vulnerabilidad está presente en el script del archivo device_graph_page.php, que forma parte de las aplicaciones web de Advantech R-SeeNet. Una URL especialmente diseñada por un atacante y visitada por una víctima puede conllevar a una ejecución de código JavaScript arbitrario • https://talosintelligence.com/vulnerability_reports/TALOS-2021-1272 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 9.6EPSS: 80%CPEs: 1EXPL: 1

CVE-2021-21801

https://notcve.org/view.php?id=CVE-2021-21801

This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially crafted URL by an attacker and visited by a victim can lead to arbitrary JavaScript code execution. Esta vulnerabilidad está presente en el script del archivo device_graph_page.php, que forma parte de las aplicaciones web de Advantech R-SeeNet. Una URL especialmente diseñada por un atacante y visitada por una víctima puede conllevar a una ejecución de código JavaScript arbitrario • https://talosintelligence.com/vulnerability_reports/TALOS-2021-1272 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •