CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2020-35557 – Improper Access Validation in products of MB connect line and Helmholz
https://notcve.org/view.php?id=CVE-2020-35557
16 Feb 2021 — An issue in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2 allows a logged in user to see devices in the account he should not have access to due to improper use of access validation. Se detectó un problema en MB CONNECT LINE mymbCONNECT24, mbCONNECT24 y Helmholz myREX24 y myREX24.virtual en todas las versiones hasta la v2.11.2 permite a un usuario conectado ver dispositivos en la cuenta a la que no debería tener acceso debido al uso incor... • https://cert.vde.com/en/advisories/VDE-2021-003 • CWE-269: Improper Privilege Management •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2020-24568
https://notcve.org/view.php?id=CVE-2020-24568
02 Oct 2020 — An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.1. There is a blind SQL injection in the lancompenent component, allowing logged-in attackers to discover arbitrary information. Se detectó un problema en MB CONNECT LINE mymbCONNECT24 y mbCONNECT24 versiones hasta 2.6.1. Se presenta una inyección SQL ciega en el componente lancompenent, lo que permite a atacantes que han iniciado sesión detectar información arbitraria • https://mbconnectline.com/security-advice • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2020-24570
https://notcve.org/view.php?id=CVE-2020-24570
29 Sep 2020 — An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.1. There is a CSRF issue (with resultant SSRF) in the com_mb24proxy module, allowing attackers to steal session information from logged-in users with a crafted link. Se detectó un problema en MB CONNECT LINE mymbCONNECT24 y mbCONNECT24 versiones hasta 2.6.1. Se presenta un problema de tipo CSRF (con un SSRF resultante) en el módulo com_mb24proxy, permitiendo a atacantes robar información de la sesión de los usuarios qu... • https://mbconnectline.com/security-advice • CWE-352: Cross-Site Request Forgery (CSRF) CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2020-24569
https://notcve.org/view.php?id=CVE-2020-24569
29 Sep 2020 — An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.1. There is a blind SQL injection in the knximport component via an advanced attack vector, allowing logged in attackers to discover arbitrary information. Se detectó un problema en MB CONNECT LINE mymbCONNECT24 y mbCONNECT24 versiones hasta 2.6.1. Se presenta una inyección SQL ciega en el componente knximport por medio de un vector de ataque avanzado, permitiendo a atacantes registrados detectar información arbitraria • https://mbconnectline.com/security-advice • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-10384
https://notcve.org/view.php?id=CVE-2020-10384
14 Apr 2020 — An issue was discovered in the MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 software in all versions through 2.6.1. There is a local privilege escalation from the www-data account to the root account. Se detectó un problema en los software MB CONNECT LINE mymbCONNECT24 y mbCONNECT24 en todas las versiones hasta 2.6.1. Se presenta una escalada de privilegios locales de la cuenta www-data a la cuenta root • https://cert.vde.com/de-de/advisories/vde-2021-003 • CWE-269: Improper Privilege Management •
CVSS: 9.8EPSS: 2%CPEs: 2EXPL: 0CVE-2020-10383
https://notcve.org/view.php?id=CVE-2020-10383
14 Apr 2020 — An issue was discovered in the MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 software in all versions through 2.5.0. There is an unauthenticated remote code execution in the com_mb24sysapi module. Se detectó un problema en los software MB CONNECT LINE mymbCONNECT24 y mbCONNECT24 en todas las versiones hasta 2.5.0. Se presenta una ejecución de código remota no autenticada en el módulo com_mb24sysapi. • https://mbconnectline.com/security-advice •
CVSS: 8.8EPSS: 2%CPEs: 2EXPL: 0CVE-2020-10382
https://notcve.org/view.php?id=CVE-2020-10382
14 Apr 2020 — An issue was discovered in the MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 software in all versions through 2.5.0. There is an authenticated remote code execution in the backup-scheduler. Se detectó un problema en los software MB CONNECT LINE mymbCONNECT24 y mbCONNECT24 en todas las versiones hasta 2.5.0. Se presenta una ejecución de código remota autenticada en el planificador de copia de seguridad. • https://mbconnectline.com/security-advice •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2020-10381
https://notcve.org/view.php?id=CVE-2020-10381
14 Apr 2020 — An issue was discovered in the MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 software in all versions through 2.5.0. There is an unauthenticated SQL injection in DATA24, allowing attackers to discover database and table names. Se detectó un problema en los software MB CONNECT LINE mymbCONNECT24 y mbCONNECT24 en todas las versiones hasta 2.5.0. Se presenta una inyección SQL no autenticada en DATA24, permitiendo a atacantes detectar nombres de bases de datos y tablas. • https://mbconnectline.com/security-advice • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •