Most recent entries from all

bdu:2021-06328

cnvd-2021-90863

EUVD-2026-22567

fkie_cve-2021-21916

An exploitable SQL injection vulnerability exist in the ‘group_list’ page of the Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-crafted HTTP request at 'description_filter’ parameter. An attacker can make authenticated HTTP requests to trigger this vulnerability. This can be done as any authenticated user or through cross-site request forgery.

GHSA-p5g4-23jm-f3jq

gsd-2021-21916

ICSA-21-348-01 — Advantech R-SeeNet

Advantech is aware of multiple SQL injection vulnerabilities in the following pages: group_list, company_list, user_list, and device_list. An attacker could send a specially crafted HTTP request to trigger the vulnerabilities.CVE-2021-21915, CVE-2021-21916, CVE-2021-21917, CVE-2021-21918, CVE-2021-21919, CVE-2021-21920, CVE-2021-21921, CVE-2021-21922, CVE-2021-21923, CVE-2021-21924, CVE-2021-21925, CVE-2021-21926, CVE-2021-21927, CVE-2021-21928, CVE-2021-21929, CVE-2021-21930, CVE-2021-21931, CVE-2021-21932, CVE-2021-21933, CVE-2021-21934, CVE-2021-21935, CVE-2021-21936, and CVE-2021-21937 have been assigned to these vulnerabilities. A CVSS v3 base score of 7.7 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N). Advantech is aware of multiple privilege escalation vulnerabilities that could be triggered when an authenticated user replaces a specially crafted file in the system to escalate privileges to NT SYSTEM authority.CVE-2021-21910, CVE-2021-21911, and CVE-2021-21912 have been assigned to these vulnerabilities. A CVSS v3 base score of 8.8 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).