Most recent entries from csaf_mbconnectlinegmbh

VDE-2020-035 — MB connect line: Multiple Vulnerabilities in mymbCONNECT24 and mbCONNECT24 <= v2.6.1

Fri, 18 Sep 2020 12:30:00 +0000

Multiples issues exist in mymbCONNECT24 and mbCONNECT24

VDE-2021-012 — MB connect line: multiple products partially affected by DNSpooq

Mon, 26 Apr 2021 08:04:00 +0000

Multiple issues have been identified in dnsmasq < 2.83

VDE-2021-031 — MB connect line: Apache Guacamole related vulnerabilities in mbCONNECT24

Thu, 22 Jul 2021 11:33:00 +0000

Two vulnerabilities in mbCONNECT24 and mymbCONNECT24 can lead to information disclosure and arbitrary code execution.

Please consult the CVE entries for details.

VDE-2021-017 — MB connect line: Privilege escalation in mbDIALUP

Thu, 22 Jul 2021 11:35:00 +0000

Multiple Vulnerabilities in mbConnect24serv (a software service of mbDIALUP) can lead to arbitrary code execution due to improper privilege management.

Update A, 2021-11-24

corrected fixed version in solution from 3.9R0.4 to 3.9R0.5

Update B, 2022-03-28

Updated CVSS score from CVE-2021-33527 from 7.8 to 9.8 due to new information about the vulnerability

VDE-2021-037 — MB connect line: Remote user enumeration in mbCONNECT24/mymbCONNECT24

Wed, 27 Oct 2021 10:15:00 +0000

An issue was discovered in the mymbCONNECT24 and mbCONNECT24 software in all versions through V2.9.0.

VDE-2021-003 — MB connect line: Multiple vulnerabilites in mymbCONNECT24 and mbCONNECT24 (Update A)

Wed, 07 Sep 2022 10:46:00 +0000

Multiple vulnerabilities have been found in mymbCONNECT24 and mbCONNECT24. Update A, 2022-09-07:

Affected Products: updated affected versions due to incomplete fixes of some CVEs. See Solution for details. Solution: updated version information. Solution: Added Fix for CVE-2020-35561. Solution: Added MFA remark for CVE-2020-35565.

VDE-2021-030 — MB connect line: two vulnerabilities in mymbCONNECT24, mbCONNECT24 (Update A)

Wed, 07 Sep 2022 10:48:00 +0000

Two issues have been discovered in mymbCONNECT24 and mbCONNECT24 in all versionsincluding V2.8.0.

Updated affected versions (and solution) due to incomplete fixes in previous versions

VDE-2022-011 — MB connect line: Unauthenticated user enumeration in mbCONNECT24 and mymbCONNECT24

Wed, 07 Sep 2022 12:50:00 +0000

A remote, unauthenticated attacker can enumerate valid users by sending specific requests to the webservice of MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2.

vde-2023-002 — MB Connect Line: Multiple vulnerabilities in mbConnect24 and mymbConnect24

Mon, 15 May 2023 14:06:00 +0000

An Authorization Bypass vulnerability was found in MB Connect Lines mbCONNECT24, mymbCONNECT24 and Helmholz' myREX24 and myREX24.virtual version <= 2.13.3. An authenticated remote user with low privileges can change the password of any user in the same account. This allows to take over the admin user and therefore fully compromise the account. Exposure of Sensitive Information to an unauthorized actor vulnerability in MB Connect Lines mbCONNECT24, mymbCONNECT24 and Helmholz' myREX24 and myREX24.virtual in versions <=2.13.3 allow an authorized remote attacker with low privileges to view a limited amount of another accounts contact information.

VDE-2023-012 — MB connect line: Cross-site Scripting vulnerability in mbNET/mbNET.rokey

Thu, 17 Aug 2023 12:00:00 +0000

A stored XXS vulnerability has been found in mbNET and mbNET/.rokey in all versions before 7.3.2.