| CVE-2022-3385 | CRITIQUE9.8 |
Advantech R-SeeNet Versions 2.4.17 and prior are vulnerable to a stack-based buffer overflow. An unauthorized attacker can remotely overflow the stack buffer and enable remote code execution.
| 27/10/2022 |
| CVE-2022-3323 | ÉLEVÉE7.5 | An SQL injection vulnerability in Advantech iView 5.7.04.6469. The specific flaw exists within the ConfigurationServlet endpoint, which listens on TCP port 8080 by default. An unauthenticated remote attacker can craft a special column_value parameter in the setConfiguration action to bypass checks in com.imc.iview.util | 27/09/2022 |
| CVE-2022-2143 | CRITIQUE9.8 | The affected product is vulnerable to two instances of command injection, which may allow an attacker to remotely execute arbitrary code. | 22/07/2022 |
| CVE-2022-2142 | MOYENNE5.9 | The affected product is vulnerable to a SQL injection with high attack complexity, which may allow an unauthorized attacker to disclose information. | 22/07/2022 |
| CVE-2022-2139 | CRITIQUE9.8 | The affected product is vulnerable to directory traversal, which may allow an attacker to access unauthorized files and execute arbitrary code. | 22/07/2022 |
| CVE-2022-2138 | ÉLEVÉE7.5 | The affected product is vulnerable due to missing authentication, which may allow an attacker to read or modify sensitive data and execute arbitrary code, resulting in a denial-of-service condition. | 22/07/2022 |
| CVE-2022-2137 | MOYENNE4.9 | The affected product is vulnerable to two SQL injections that require high privileges for exploitation and may allow an unauthorized attacker to disclose information | 22/07/2022 |
| CVE-2022-2136 | MOYENNE6.5 | The affected product is vulnerable to multiple SQL injections that require low privileges for exploitation and may allow an unauthorized attacker to disclose information. | 22/07/2022 |
| CVE-2022-2135 | ÉLEVÉE7.5 | The affected product is vulnerable to multiple SQL injections, which may allow an unauthorized attacker to disclose information. | 22/07/2022 |
| CVE-2021-40397 | ÉLEVÉE7.8 | A privilege escalation vulnerability exists in the installation of Advantech WISE-PaaS/OTA Server 3.0.9. A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM authority. An attacker can provide a malicious file to trigger this vulnerability. | 28/01/2022 |
| CVE-2021-40396 | ÉLEVÉE8.8 | A privilege escalation vulnerability exists in the installation of Advantech DeviceOn/iService 1.1.7. A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM authority. An attacker can provide a malicious file to trigger this vulnerability. | 28/01/2022 |
| CVE-2021-40389 | ÉLEVÉE8.8 | A privilege escalation vulnerability exists in the installation of Advantech DeviceOn/iEdge Server 1.0.2. A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM authority. An attacker can provide a malicious file to trigger this vulnerability. | 28/01/2022 |
| CVE-2021-40388 | ÉLEVÉE8.8 | A privilege escalation vulnerability exists in Advantech SQ Manager Server 1.0.6. A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM authority. An attacker can provide a malicious file to trigger this vulnerability. | 28/01/2022 |
| CVE-2021-21937 | MOYENNE6.5 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘host_alt_filter’ parameter. This can be done as any authenticated user or through cross-site request forgery. | 22/12/2021 |
| CVE-2021-21936 | ÉLEVÉE8.8 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘health_alt_filter’ parameter. This can be done as any authenticated user or through cross-site request forgery. | 22/12/2021 |
| CVE-2021-21935 | MOYENNE6.5 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘host_alt_filter2’ parameter. This can be done as any authenticated user or through cross-site request forgery. | 22/12/2021 |
| CVE-2021-21934 | MOYENNE6.5 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this at ‘imei_filter’ parameter. This can be done as any authenticated user or through cross-site request forgery. | 22/12/2021 |
| CVE-2021-21933 | MOYENNE6.5 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this at ‘esn_filter’ parameter. This can be done as any authenticated user or through cross-site request forgery. | 22/12/2021 |
| CVE-2021-21932 | MOYENNE6.5 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this at ‘name_filter’ parameter. This can be done as any authenticated user or through cross-site request forgery. | 22/12/2021 |
| CVE-2021-21931 | MOYENNE6.5 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests at‘ stat_filter’ parameter to trigger this vulnerability. This can be done as any authenticated user or through cross-site request forgery. | 22/12/2021 |