CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2021-34574 – Password policy evasion in products of MB connect line and Helmholz
https://notcve.org/view.php?id=CVE-2021-34574
02 Aug 2021 — In MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2 an authenticated attacker can change the password of his account into a new password that violates the password policy by intercepting and modifying the request that is send to the server. En MB connect line mymbCONNECT24, mbCONNECT24 y Helmholz myREX24 y myREX24.virtual en todas las versiones hasta la v2.11.2 un atacante autenticado puede cambiar la contraseña de su cuenta por una nueva qu... • https://cert.vde.com/en/advisories/VDE-2021-030 • CWE-669: Incorrect Resource Transfer Between Spheres •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2020-12530
https://notcve.org/view.php?id=CVE-2020-12530
02 Mar 2021 — An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2. There is an XSS issue in the redirect.php allowing an attacker to inject code via a get parameter. Se detectó un problema en el software MB connect line mymbCONNECT24 y mbCONNECT24, en todas las versiones hasta la V2.6.2. Se presenta un problema de tipo XSS en el archivo redirect.php que permite a un atacante inyectar código por medio de un parámetro get • https://cert.vde.com/de-de/advisories/vde-2021-003 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-12529
https://notcve.org/view.php?id=CVE-2020-12529
02 Mar 2021 — An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2 There is a SSRF in the LDAP access check, allowing an attacker to scan for open ports. Se detectó un problema en el software MB connect line mymbCONNECT24 y mbCONNECT24 en todas las versiones hasta la versión V2.6.2. Se presenta un problema de tipo SSRF en la comprobación de acceso LDAP, lo que permite a un atacante escanear puertos abiertos • https://cert.vde.com/de-de/advisories/vde-2021-003 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.7EPSS: 0%CPEs: 2EXPL: 0CVE-2020-12528
https://notcve.org/view.php?id=CVE-2020-12528
02 Mar 2021 — An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2. Improper use of access validation allows a logged in user to kill web2go sessions in the account he should not have access to. Se detectó un problema en el software MB connect line mymbCONNECT24 y mbCONNECT24 en todas las versiones hasta la V2.6.2. El uso inapropiado de la comprobación de acceso permite que un usuario que haya iniciado sesión elimine las sesiones de web2go en la cuenta a la... • https://cert.vde.com/de-de/advisories/vde-2021-003 • CWE-269: Improper Privilege Management •
CVSS: 6.8EPSS: 0%CPEs: 4EXPL: 0CVE-2020-12527 – Improper Access Validation in products of MB connect line and Helmholz
https://notcve.org/view.php?id=CVE-2020-12527
02 Mar 2021 — An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. Improper access validation allows a logged in user to shutdown or reboot devices in his account without having corresponding permissions. Se ha descubierto un problema en la línea de conexión MB mymbCONNECT24, mbCONNECT24 y Helmholz myREX24 y myREX24.virtual en todas las versiones hasta la v2.11.2. Una validación de acceso inadecuada permite a un usuario conectado a... • https://cert.vde.com/en/advisories/VDE-2021-003 • CWE-269: Improper Privilege Management •
CVSS: 5.3EPSS: 1%CPEs: 4EXPL: 0CVE-2020-35561 – SSRF in variuos products of MB connect line and Helmholz
https://notcve.org/view.php?id=CVE-2020-35561
16 Feb 2021 — An issue was discovered MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. There is an SSRF in the HA module allowing an unauthenticated attacker to scan for open ports. Se detectó un problema en la línea de conexión MB mymbCONNECT24, mbCONNECT24 y Helmholz myREX24 y myREX24.virtual en todas las versiones hasta la v2.11.2. Existe un SSRF en el módulo HA que permite a un atacante no autentificado escanear puertos abiertos. • https://cert.vde.com/en/advisories/VDE-2021-003 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-35565
https://notcve.org/view.php?id=CVE-2020-35565
16 Feb 2021 — An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. The login pages bruteforce detection is disabled by default. Se detectó un problema en MB CONNECT LINE mymbCONNECT24 y mbCONNECT24 versiones hasta 2.6.2. La detección de fuerza bruta de las páginas de inicio de sesión está deshabilitada por defecto • https://cert.vde.com/de-de/advisories/vde-2021-003 • CWE-307: Improper Restriction of Excessive Authentication Attempts •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-35567
https://notcve.org/view.php?id=CVE-2020-35567
16 Feb 2021 — An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. The software uses a secure password for database access, but this password is shared across instances. Se detectó un problema en MB CONNECT LINE mymbCONNECT24 y mbCONNECT24 versiones hasta 2.6.2. El software usa una contraseña segura para el acceso a la base de datos, pero esta contraseña es compartida entre instancias • https://cert.vde.com/de-de/advisories/vde-2021-003 • CWE-798: Use of Hard-coded Credentials •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2020-35568 – Sensitive Information Exposure in products of MB connect line and Helmholz
https://notcve.org/view.php?id=CVE-2020-35568
16 Feb 2021 — An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. An incomplete filter applied to a database response allows an authenticated attacker to gain non-public information about other users and devices in the account. Se detectó un problema en la línea de conexión MB mymbCONNECT24, mbCONNECT24 y Helmholz myREX24 y myREX24.virtual en todas las versiones hasta la v2.11.2. Un filtro incompleto aplicado a una respuesta de la... • https://cert.vde.com/en/advisories/VDE-2021-003 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2020-35559
https://notcve.org/view.php?id=CVE-2020-35559
16 Feb 2021 — An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an unused function that allows an authenticated attacker to use up all available IPs of an account and thus not allow creation of new devices and users. Se detectó un problema en MB CONNECT LINE mymbCONNECT24 y mbCONNECT24 versiones hasta 2.6.2. Existe una función en desuso que permite a un atacante autenticado usar todas las direcciones IP disponibles de una cuenta y, por lo tanto, no permite la creación d... • https://cert.vde.com/de-de/advisories/vde-2021-003 • CWE-400: Uncontrolled Resource Consumption •