CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 1CVE-2021-21804
https://notcve.org/view.php?id=CVE-2021-21804
A local file inclusion (LFI) vulnerability exists in the options.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). A specially crafted HTTP request can lead to arbitrary PHP code execution. An attacker can send a crafted HTTP request to trigger this vulnerability. Se presenta una vulnerabilidad de inclusión de archivos locales (LFI) en la funcionalidad del script del archivo options.php de Advantech R-SeeNet versión v 2.4.12 (20.10.2020). Una petición HTTP especialmente diseñada puede conllevar a una ejecución de código PHP arbitrario. • https://talosintelligence.com/vulnerability_reports/TALOS-2021-1273 • CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') CWE-829: Inclusion of Functionality from Untrusted Control Sphere •
CVSS: 9.6EPSS: 80%CPEs: 1EXPL: 1CVE-2021-21800
https://notcve.org/view.php?id=CVE-2021-21800
Cross-site scripting vulnerabilities exist in the ssh_form.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). If a user visits a specially crafted URL, it can lead to arbitrary JavaScript code execution in the context of the targeted user’s browser. An attacker can provide a crafted URL to trigger this vulnerability. Se presentan vulnerabilidades de tipo Cross-site scripting en la funcionalidad script del archivo ssh_form.php de Advantech R-SeeNet versión v 2.4.12 (20.10.2020). Si un usuario visita una URL especialmente diseñada, puede conllevar a una ejecución de código JavaScript arbitrario en el contexto del navegador del usuario objetivo. • https://talosintelligence.com/vulnerability_reports/TALOS-2021-1271 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.6EPSS: 80%CPEs: 1EXPL: 1CVE-2021-21799
https://notcve.org/view.php?id=CVE-2021-21799
Cross-site scripting vulnerabilities exist in the telnet_form.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). If a user visits a specially crafted URL, it can lead to arbitrary JavaScript code execution in the context of the targeted user’s browser. An attacker can provide a crafted URL to trigger this vulnerability. Se presentan vulnerabilidades de tipo Cross-site scripting en la funcionalidad script del archivo telnet_form.php de Advantech R-SeeNet versión v 2.4.12 (20.10.2020). Si un usuario visita una URL especialmente diseñada, puede conllevar a una ejecución de código JavaScript arbitrario en el contexto del navegador del usuario objetivo. • https://talosintelligence.com/vulnerability_reports/TALOS-2021-1270 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-33002 – Advantech WebAccess/HMI Designer PM3 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2021-33002
Opening a maliciously crafted project file may cause an out-of-bounds write, which may allow an attacker to execute arbitrary code. User interaction is require on the WebAccess HMI Designer (versions 2.1.9.95 and prior). Abriendo un archivo de proyecto diseñado maliciosamente puede causar una escritura fuera de límites, que puede permitir a un atacante ejecutar código arbitrario. Es requerida una interacción del usuario en el WebAccess HMI Designer (versiones 2.1.9.95 y anteriores) This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech WebAccess/HMI Designer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PM3 files. • https://us-cert.cisa.gov/ics/advisories/icsa-21-173-01 • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-33004 – Advantech WebAccess/HMI Designer PM3 File Parsing Memory Corruption Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2021-33004
The affected product is vulnerable to memory corruption condition due to lack of proper validation of user supplied files, which may allow an attacker to execute arbitrary code. User interaction is required on the WebAccess HMI Designer (versions 2.1.9.95 and prior). El producto afectado es vulnerable a una condición de corrupción de memoria debido a una falta de comprobación apropiada de los archivos suministrados por el usuario, que puede permitir a un atacante ejecutar código arbitrario. Es requerida una interacción del usuario en el WebAccess HMI Designer (versiones 2.1.9.95 y anteriores) This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech WebAccess/HMI Designer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PM3 files. • https://us-cert.cisa.gov/ics/advisories/icsa-21-173-01 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-787: Out-of-bounds Write •