Most recent entries from all

cnvd-2021-17232

EUVD-2026-174299

fkie_cve-2020-35566

An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. An attacker can read arbitrary JSON files via Local File Inclusion.

GHSA-hf2f-4243-6465

An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. An attacker can read arbitrary JSON files via Local File Inclusion.

gsd-2020-35566

ICSA-21-061-03 — MB connect line mbCONNECT24, mymbCONNECT24

Improper access validation may allow a logged-in user to see devices in an account to which they should not have access.CVE-2020-12527 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Improper access validation may allow a logged-in user to kill web2go sessions in an account to which they should not have access.CVE-2020-12528 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). There is a SSRF issue in the LDAP access check, allowing an attacker to scan for open ports.CVE-2020-12529 has been assigned to this vulnerability. A CVSS v3 base score of 5.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N). There is an XSS issue in the redirect.php, allowing an attacker to inject code via a get parameter.CVE-2020-12530 has been assigned to this vulnerability. A CVSS v3 base score of 4.3 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). Improper access validation may allow a logged-in user to see devices in the account to which they should not have access.CVE-2020-35557 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). There is a SSRF issue in the MySQL access check, allowing an attacker to scan for open p…

VDE-2021-003 — MB connect line: Multiple vulnerabilites in mymbCONNECT24 and mbCONNECT24 (Update A)

Multiple vulnerabilities have been found in mymbCONNECT24 and mbCONNECT24. Update A, 2022-09-07:

Affected Products: updated affected versions due to incomplete fixes of some CVEs. See Solution for details. Solution: updated version information. Solution: Added Fix for CVE-2020-35561. Solution: Added MFA remark for CVE-2020-35565.

VDE-2022-039 — Helmholz: Multiple vulnerabilites in myREX24 and myREX24.virtual

Multiple vulnerabilities have been found in myREX24 and myREX24.virtual.