Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
70 results · page 1 of 2
Oct 15, 2026In Progress® Kendo® UI for jQuery prior to version 2026.3.1015, the Calendar and MultiViewCalendar month content templates render data.url and data.title withouCVE-2026-106153 · Other software · Progress Software · reported by security@progress.comMedium 5.4
In Progress® Kendo® UI for jQuery prior to version 2026.3.1015, the Calendar and MultiViewCalendar month content templates render data.url and data.title without proper URL sanitization and HTML attribute encoding. An attacker with low privileges who can control the URL option or culture-derived title values can supply a JavaScript URL or inject event-handler attributes. When a user interacts with an affected calendar, JavaScript can execute in the user's browser context and compromise the confidentiality and integrity of accessible data.
- Product
- Kendo UI for jQuery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026CopyAPIView (awx/awx/api/generics.py:873) sets permission_classes = (IsAuthenticated,), so DRF's get_object() performs no object-level RBAC.CVE-2026-76648 · Other software · Red Hat · reported by Red HatHigh 8.5
CopyAPIView (awx/awx/api/generics.py:873) sets permission_classes = (IsAuthenticated,), so DRF's get_object() performs no object-level RBAC. The get() handler (lines 988–991) explicitly guards with request.user.can_access(obj._class_, 'read', obj) — but post() (lines 1001–1010) does not. POST only checks: can_access(model, 'add', create_kwargs_check) can_access(model, 'copy_related', obj) For JobTemplate, can_add (awx/awx/main/access.py:1465–1520) gates on inventory.use_role + project.use_role + execution_environment.read_role — resource-level roles that do not imply read on the source JT — and can_copy_related (1522–1534) checks only credentials.use_role. None of these imply the caller can read the source JT.
- Product
- Red Hat Ansible Automation Platform 2.7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jan 13, 2026Data verification vulnerability in the HiView module.CVE-2025-68964 · Other software · Huawei · reported by psirt@huawei.comMedium 6.2
Data verification vulnerability in the HiView module. Impact: Successful exploitation of this vulnerability may affect availability.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comconsumer.huawei.com
Dec 4, 2025Advantech iView versions 5.7.05.7057 and prior do not properly sanitize SNMP v1 trap (Port 162) requests, which could allow an attacker to inject SQL commands.CVE-2025-13373 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 8.7
Advantech iView versions 5.7.05.7057 and prior do not properly sanitize SNMP v1 trap (Port 162) requests, which could allow an attacker to inject SQL commands.
- Product
- iView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comadvantech.com
Nov 6, 2025Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentiCVE-2022-50595 · Other software · Advantech · reported by VulnCheckCritical 9.3
Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection vulnerability within the ‘ztp_search_value’ parameter to the ‘NetworkServlet’ endpoint. Successful exploitation allows for remote code execution with administrator privileges.
- Product
- iView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.exodusintel.comadvantech.tw
Nov 6, 2025Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentiCVE-2022-50594 · Other software · Advantech · reported by VulnCheckHigh 8.8
Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection vulnerability within the ‘data’ parameter to the ‘NetworkServlet’ endpoint. Successful exploitation allows for the exfiltration of user data, included clear text passwords.
- Product
- iView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.exodusintel.comadvantech.tw
Nov 6, 2025Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentiCVE-2022-50593 · Other software · Advantech · reported by VulnCheckCritical 9.3
Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection vulnerability within the ‘search_term’ parameter to the ‘NetworkServlet’ endpoint. Successful exploitation allows for remote code execution with administrator privileges.
- Product
- iView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.exodusintel.comadvantech.tw
Nov 6, 2025Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentiCVE-2022-50592 · Other software · Advantech · reported by VulnCheckCritical 9.3
Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection vulnerability within the ‘getInventoryReportData’ parameter to the ‘NetworkServlet’ endpoint. Successful exploitation allows for remote code execution with administrator privileges.
- Product
- iView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.exodusintel.comadvantech.tw
Nov 6, 2025Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentiCVE-2022-50591 · Other software · Advantech · reported by VulnCheckHigh 8.8
Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection vulnerability within the ‘ztp_config_id’ parameter to the ‘NetworkServlet’ endpoint. Successful exploitation allows for the exfiltration of user data, included clear text passwords.
- Product
- iView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.exodusintel.comadvantech.tw
Sep 25, 2025A vulnerability was found in Changsha Developer Technology iView Editor up to 1.1.1.CVE-2025-10949 · Other software · Changsha Developer Technology · reported by VulDBLow 1.9
A vulnerability was found in Changsha Developer Technology iView Editor up to 1.1.1. This impacts an unknown function of the component Markdown Handler. The manipulation results in cross site scripting. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- iView Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2025A vulnerability exists in Advantech iView versions prior to 5.7.05 build 7057, which could allow a reflected cross-site scripting (XSS) attack.CVE-2025-53519 · Other software · Advantech · reported by ics-cert@hq.dhs.govMedium 5.1
A vulnerability exists in Advantech iView versions prior to 5.7.05 build 7057, which could allow a reflected cross-site scripting (XSS) attack. By manipulating specific parameters, an attacker could execute unauthorized scripts in the user's browser, potentially leading to information disclosure or other malicious activities.
- Product
- iView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2025A vulnerability exists in Advantech iView that allows for SQL injection and remote code execution through NetworkServlet.archiveTrap().CVE-2025-53515 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 8.7
A vulnerability exists in Advantech iView that allows for SQL injection and remote code execution through NetworkServlet.archiveTrap(). This issue requires an authenticated attacker with at least user-level privileges. Certain input parameters are not sanitized, allowing an attacker to perform SQL injection and potentially execute code in the context of the 'nt authority\local service' account.
- Product
- iView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2025A vulnerability exists in Advantech iView that allows for argument injection in the NetworkServlet.restoreDatabase().CVE-2025-53509 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 7.1
A vulnerability exists in Advantech iView that allows for argument injection in the NetworkServlet.restoreDatabase(). This issue requires an authenticated attacker with at least user-level privileges. An input parameter can be used directly in a command without proper sanitization, allowing arbitrary arguments to be injected. This can result in information disclosure, including sensitive database credentials.
- Product
- iView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2025A vulnerability exists in Advantech iView that could allow for SQL injection and remote code execution through NetworkServlet.getNextTrapPage().CVE-2025-53475 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 8.7
A vulnerability exists in Advantech iView that could allow for SQL injection and remote code execution through NetworkServlet.getNextTrapPage(). This issue requires an authenticated attacker with at least user-level privileges. Certain parameters in this function are not properly sanitized, allowing an attacker to perform SQL injection and potentially execute code in the context of the 'nt authority\local service' account.
- Product
- iView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2025A vulnerability exists in Advantech iView versions prior to 5.7.05 build 7057, which could allow a reflected cross-site scripting (XSS) attack.CVE-2025-53397 · Other software · Advantech · reported by ics-cert@hq.dhs.govMedium 5.1
A vulnerability exists in Advantech iView versions prior to 5.7.05 build 7057, which could allow a reflected cross-site scripting (XSS) attack. By exploiting this flaw, an attacker could execute unauthorized scripts in the user's browser, potentially leading to information disclosure or other malicious activities.
- Product
- iView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2025A vulnerability exists in Advantech iView that could allow SQL injection and remote code execution through NetworkServlet.archiveTrapRange().CVE-2025-52577 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 8.7
A vulnerability exists in Advantech iView that could allow SQL injection and remote code execution through NetworkServlet.archiveTrapRange(). This issue requires an authenticated attacker with at least user-level privileges. Certain input parameters are not properly sanitized, allowing an attacker to perform SQL injection and potentially execute code in the context of the 'nt authority\local service' account.
- Product
- iView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2025A vulnerability exists in Advantech iView that allows for argument injection in NetworkServlet.backupDatabase().CVE-2025-52459 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 7.1
A vulnerability exists in Advantech iView that allows for argument injection in NetworkServlet.backupDatabase(). This issue requires an authenticated attacker with at least user-level privileges. Certain parameters can be used directly in a command without proper sanitization, allowing arbitrary arguments to be injected. This can result in information disclosure, including sensitive database credentials.
- Product
- iView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2025A vulnerability exists in Advantech iView that could allow for SQL injection through the CUtils.checkSQLInjection() function.CVE-2025-48891 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 7.2
A vulnerability exists in Advantech iView that could allow for SQL injection through the CUtils.checkSQLInjection() function. This vulnerability can be exploited by an authenticated attacker with at least user-level privileges, potentially leading to information disclosure or a denial-of-service condition.
- Product
- iView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2025A vulnerability exists in Advantech iView in NetworkServlet.processImportRequest() that could allow for a directory traversal attack.CVE-2025-46704 · Other software · Advantech · reported by ics-cert@hq.dhs.govMedium 5.3
A vulnerability exists in Advantech iView in NetworkServlet.processImportRequest() that could allow for a directory traversal attack. This issue requires an authenticated attacker with at least user-level privileges. A specific parameter is not properly sanitized or normalized, potentially allowing an attacker to determine the existence of arbitrary files on the server.
- Product
- iView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2025A vulnerability exists in Advantech iView versions prior to 5.7.05 build 7057, which could allow a reflected cross-site scripting (XSS) attack.CVE-2025-41442 · Other software · Advantech · reported by ics-cert@hq.dhs.govMedium 5.1
A vulnerability exists in Advantech iView versions prior to 5.7.05 build 7057, which could allow a reflected cross-site scripting (XSS) attack. By manipulating certain input parameters, an attacker could execute unauthorized scripts in the user's browser, potentially leading to information disclosure or other malicious activities.
- Product
- iView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2024Security vulnerability in the HiView module Impact: Successful exploitation of this vulnerability may affect feature implementation and integrity.CVE-2024-54097 · Other software · Huawei · reported by psirt@huawei.comHigh 7.3
Security vulnerability in the HiView module Impact: Successful exploitation of this vulnerability may affect feature implementation and integrity.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Advantech iView ConfigurationServlet SQL Injection Information Disclosure Vulnerability.CVE-2023-52335 · Other software · Advantech · reported by zdi-disclosures@trendmicro.comHigh 7.5
Advantech iView ConfigurationServlet SQL Injection Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech iView. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ConfigurationServlet servlet, which listens on TCP port 8080 by default. When parsing the column_value element, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-17863.
- Product
- iView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvantech.comzerodayinitiative.com
Oct 22, 2024Reflected XSS was discovered in an iView List Archer Platform UX page in Archer Platform 6.x before version 2024.09.CVE-2024-49210 · Other software · Archerirm · reported by MITREMedium 5.2
Reflected XSS was discovered in an iView List Archer Platform UX page in Archer Platform 6.x before version 2024.09. A remote unauthenticated attacker could potentially exploit this by tricking a victim application user into supplying malicious HTML or JavaScript code to the vulnerable web application; the malicious code is then reflected back to the victim and executed by the web browser in the context of the vulnerable web application.
- Product
- Archer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarcherirm.communityarcherirm.community
Oct 3, 2024Bandisoft BandiView 7.05 is vulnerable to Buffer Overflow via sub_0x410d1d.CVE-2024-45872 · Other software · bandisoft · reported by MITREMedium 6.3
Bandisoft BandiView 7.05 is vulnerable to Buffer Overflow via sub_0x410d1d. The vulnerability occurs due to insufficient validation of PSD files.
- Product
- bandiview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2024Bandisoft BandiView 7.05 is Incorrect Access Control via sub_0x232bd8 resulting in denial of service (DOS).CVE-2024-45871 · Other software · bandisoft · reported by MITREMedium 6.3
Bandisoft BandiView 7.05 is Incorrect Access Control via sub_0x232bd8 resulting in denial of service (DOS).
- Product
- bandiview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2024Bandisoft BandiView 7.05 is vulnerable to Incorrect Access Control in sub_0x3d80fc via a crafted POC file.CVE-2024-45870 · Other software · bandisoft · reported by MITREMedium 6.5
Bandisoft BandiView 7.05 is vulnerable to Incorrect Access Control in sub_0x3d80fc via a crafted POC file.
- Product
- bandiview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2024Uniview NVR301-04S2-P4 is vulnerable to reflected cross-site scripting attack (XSS).CVE-2024-3850 · Other software · Uniview · reported by ics-cert@hq.dhs.govMedium 4.8
Uniview NVR301-04S2-P4 is vulnerable to reflected cross-site scripting attack (XSS). An attacker could send a user a URL that if clicked on could execute malicious JavaScript in their browser. This vulnerability also requires authentication before it can be exploited, so the scope and severity is limited. Also, even if JavaScript is executed, no additional benefits are obtained.
- Product
- NVR301-04S2-P4
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2024Buffer Overflow vulnerability in bandisoft bandiview v7.0, allows local attackers to cause a denial of service (DoS) via exr image file.CVE-2024-22526 · Other software · Bandisoft · reported by MITREMedium 5.5
Buffer Overflow vulnerability in bandisoft bandiview v7.0, allows local attackers to cause a denial of service (DoS) via exr image file.
- Product
- Bandiview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Mar 1, 2024Initialization of a resource with an insecure default vulnerability in OET-213H-BTS1 sold in Japan by Atsumi Electric Co., Ltd.CVE-2024-25972 · Other software · Zhejiang Uniview Technologies Co.,Ltd and Atsumi Electric Co., Ltd. · reported by vultures@jpcert.or.jpHigh 8.3
Initialization of a resource with an insecure default vulnerability in OET-213H-BTS1 sold in Japan by Atsumi Electric Co., Ltd. allows a network-adjacent unauthenticated attacker to configure and control the affected product.
- Product
- OET-213H-BTS1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 22, 2024** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in Uniview ISC 2500-S up to 20210930.CVE-2024-0778 · Other software · Uniview · reported by VulDBHigh 8
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in Uniview ISC 2500-S up to 20210930. Affected by this issue is the function setNatConfig of the file /Interface/DevManage/VM.php. The manipulation of the argument natAddress/natPort/natServerPort leads to os command injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-251696. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
- Product
- ISC 2500-S
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2023Vulnerability of defects introduced in the design process in the HiviewTunner module.CVE-2023-41297 · Other software · Huawei · reported by psirt@huawei.comCritical 9.8
Vulnerability of defects introduced in the design process in the HiviewTunner module. Successful exploitation of this vulnerability may cause service hijacking.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Sep 19, 2023The vulnerability exists in Uniview IP Camera due to identification and authentication failure at its web-based management interface.CVE-2023-0773 · Other software · Uniview · reported by vdisclose@cert-in.org.inCritical 9.1
The vulnerability exists in Uniview IP Camera due to identification and authentication failure at its web-based management interface. A remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable device. Successful exploitation of this vulnerability could allow the attacker to gain complete control of the targeted device.
- Product
- Uniview IP Camera IPC322LB-SF28-A
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordglobal.uniview.comcert-in.org.in
Jul 31, 2023An authenticated SQL injection vulnerability exists in Advantech iView versions prior to v5.7.4 build 6752.CVE-2023-3983 · Other software · Advantech · reported by vulnreport@tenable.comHigh 8.8
An authenticated SQL injection vulnerability exists in Advantech iView versions prior to v5.7.4 build 6752. An authenticated remote attacker can bypass checks in com.imc.iview.utils.CUtils.checkSQLInjection() to perform blind SQL injection.
- Product
- Iview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Jul 5, 2023Cross Site Scripting (XSS) in Sophos Sophos iView (The EOL was December 31st 2020) in grpname parameter that allows arbitrary script to be executed.CVE-2023-33335 · Network & remote access · Sophos · reported by MITREMedium 6.1
Cross Site Scripting (XSS) in Sophos Sophos iView (The EOL was December 31st 2020) in grpname parameter that allows arbitrary script to be executed.
- Product
- Iview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordinf0seq.github.ioinf0seq.github.io
Jun 29, 2023Telegram v9.6.3 on iOS allows attackers to hide critical information on the User Interface via calling the function SFSafariViewController.CVE-2023-34658 · Other software · Telegram · reported by MITREMedium 5.3
Telegram v9.6.3 on iOS allows attackers to hide critical information on the User Interface via calling the function SFSafariViewController.
- Product
- Telegram
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcrsrg.shexchange.xforce.ibmcloud.com
May 31, 2023Multiple models of the Uniview IP Camera (e.g., IPC_G6103 B6103.16.10.B25.201218, IPC_G61, IPC21, IPC23, IPC32, IPC36, IPC62, and IPC_HCMN) offer an undocumenteCVE-2021-45039 · Other software · Uniview · reported by MITRECritical 9.8
Multiple models of the Uniview IP Camera (e.g., IPC_G6103 B6103.16.10.B25.201218, IPC_G61, IPC21, IPC23, IPC32, IPC36, IPC62, and IPC_HCMN) offer an undocumented UDP service on port 7788 that allows a remote unauthenticated attacker to overflow an internal buffer and achieve code execution. By using this buffer overflow, a remote attacker can start the telnetd service. This service has a hardcoded default username and password (root/123456). Although it has a restrictive shell, this can be easily bypassed via the built-in ECHO shell command.
- Product
- Camera Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordssd-disclosure.comuniview.com
Nov 9, 2022The HiView module has a vulnerability of not filtering third-party apps out when the HiView module traverses to invoke the system provider.CVE-2022-44553 · Other software · Huawei · reported by psirt@huawei.comMedium 5.3
The HiView module has a vulnerability of not filtering third-party apps out when the HiView module traverses to invoke the system provider. Successful exploitation of this vulnerability may cause third-party apps to start periodically.
- Product
- HarmonyOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconsumer.huawei.comdevice.harmonyos.com
Sep 27, 2022An SQL injection vulnerability in Advantech iView 5.7.04.6469.CVE-2022-3323 · Other software · Advantech · reported by vulnreport@tenable.comHigh 7.5
An SQL injection vulnerability in Advantech iView 5.7.04.6469. The specific flaw exists within the ConfigurationServlet endpoint, which listens on TCP port 8080 by default. An unauthenticated remote attacker can craft a special column_value parameter in the setConfiguration action to bypass checks in com.imc.iview.utils.CUtils.checkSQLInjection() to perform SQL injection. For example, the attacker can exploit the vulnerability to retrieve the iView admin password.
- Product
- Iview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Jul 22, 2022The affected product is vulnerable to two instances of command injection, which may allow an attacker to remotely execute arbitrary code.CVE-2022-2143 · Other software · Advantech iView · reported by ics-cert@hq.dhs.govCritical 9.8
The affected product is vulnerable to two instances of command injection, which may allow an attacker to remotely execute arbitrary code.
- Product
- iView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comcisa.gov
Jul 22, 2022The affected product is vulnerable to a SQL injection with high attack complexity, which may allow an unauthorized attacker to disclose information.CVE-2022-2142 · Other software · Advantech iView · reported by ics-cert@hq.dhs.govHigh 8.1
The affected product is vulnerable to a SQL injection with high attack complexity, which may allow an unauthorized attacker to disclose information.
- Product
- iView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2022The affected product is vulnerable to directory traversal, which may allow an attacker to access unauthorized files and execute arbitrary code.CVE-2022-2139 · Other software · Advantech iView · reported by ics-cert@hq.dhs.govMedium 6.5
The affected product is vulnerable to directory traversal, which may allow an attacker to access unauthorized files and execute arbitrary code.
- Product
- iView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2022The affected product is vulnerable due to missing authentication, which may allow an attacker to read or modify sensitive data and execute arbitrary code, resulCVE-2022-2138 · Other software · Advantech iView · reported by ics-cert@hq.dhs.govHigh 8.2
The affected product is vulnerable due to missing authentication, which may allow an attacker to read or modify sensitive data and execute arbitrary code, resulting in a denial-of-service condition.
- Product
- iView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2022The affected product is vulnerable to two SQL injections that require high privileges for exploitation and may allow an unauthorized attacker to disclose informCVE-2022-2137 · Other software · Advantech iView · reported by ics-cert@hq.dhs.govMedium 4.9
The affected product is vulnerable to two SQL injections that require high privileges for exploitation and may allow an unauthorized attacker to disclose information
- Product
- iView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2022The affected product is vulnerable to multiple SQL injections that require low privileges for exploitation and may allow an unauthorized attacker to disclose inCVE-2022-2136 · Other software · Advantech iView · reported by ics-cert@hq.dhs.govHigh 8.8
The affected product is vulnerable to multiple SQL injections that require low privileges for exploitation and may allow an unauthorized attacker to disclose information.
- Product
- iView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2022The affected product is vulnerable to multiple SQL injections, which may allow an unauthorized attacker to disclose information.CVE-2022-2135 · Other software · Advantech iView · reported by ics-cert@hq.dhs.govHigh 7.5
The affected product is vulnerable to multiple SQL injections, which may allow an unauthorized attacker to disclose information.
- Product
- iView
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2021The SAP NetWeaver Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, component Iviews Editor contains a Server-Side Request Forgery (SSRF) vulnerabiliCVE-2021-33705 · Network & remote access · SAP SE · reported by cna@sap.comHigh 8.1
The SAP NetWeaver Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, component Iviews Editor contains a Server-Side Request Forgery (SSRF) vulnerability which allows an unauthenticated attacker to craft a malicious URL which when clicked by a user can make any type of request (e.g. POST, GET) to any internal or external server. This can result in the accessing or modification of data accessible from the Portal but will not affect its availability.
- Product
- SAP NetWeaver Enterprise Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jun 11, 2021The affected product is vulnerable to a SQL injection, which may allow an unauthorized attacker to disclose information on the iView (versions prior to v5.7.03.CVE-2021-32932 · Other software · Advantech · reported by ics-cert@hq.dhs.govHigh 7.5
The affected product is vulnerable to a SQL injection, which may allow an unauthorized attacker to disclose information on the iView (versions prior to v5.7.03.6182).
- Product
- Iview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Jun 11, 2021The affected product’s configuration is vulnerable due to missing authentication, which may allow an attacker to change configurations and execute arbitrary codCVE-2021-32930 · Other software · Advantech · reported by ics-cert@hq.dhs.govCritical 9.8
The affected product’s configuration is vulnerable due to missing authentication, which may allow an attacker to change configurations and execute arbitrary code on the iView (versions prior to v5.7.03.6182).
- Product
- Iview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Apr 29, 2021An issue was discovered in uniview ISC2500-S.CVE-2020-21452 · Other software · Uniview · reported by MITRECritical 9.8
An issue was discovered in uniview ISC2500-S. This is an upload vulnerability where an attacker can upload malicious code via /Interface/DevManage/EC.php?cmd=upload
- Product
- Isc2500-s Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2021Advantech iView versions prior to v5.7.03.6112 are vulnerable to a SQL injection, which may allow an attacker to escalate privileges to 'Administrator'.CVE-2021-22658 · Other software · Advantech · reported by ics-cert@hq.dhs.govCritical 9.8
Advantech iView versions prior to v5.7.03.6112 are vulnerable to a SQL injection, which may allow an attacker to escalate privileges to 'Administrator'.
- Product
- Iview
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govzerodayinitiative.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.