MB connect line mbCONNECT24, mymbCONNECT24
Successful exploitation of these vulnerabilities could allow a remote attacker to gain unauthorized access to arbitrary information or allow remote code execution.
describes (18)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-12530US | medium6.1 | — | ||
An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2. There is an XSS issue in the redirect.php allowing an attacker to… | ||||
| CVE-2020-12529US | medium5.3 | — | ||
An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2 There is a SSRF in the LDAP access check, allowing an attacker to s… | ||||
| CVE-2020-12528US | high7.7 | — | ||
An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2. Improper use of access validation allows a logged in user to kill… | ||||
| CVE-2020-12527US | medium6.8 | — | ||
An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. Improper access validation allows a… | ||||
| CVE-2020-35570US | medium5.3 | — | ||
An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual through 2.11.2. An unauthenticated attacker is able to access files (… | ||||
| CVE-2020-35569US | medium6.1 | — | ||
An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is a self XSS issue with a crafted cookie in the login page. | ||||
| CVE-2020-35568US | medium4.3 | — | ||
An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. An incomplete filter applied to a da… | ||||
| CVE-2020-35567US | high7.8OT elevated | — | ||
An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. The software uses a secure password for database access, but this password is shared across… | ||||
| CVE-2020-35566US | medium5.3 | — | ||
An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. An attacker can read arbitrary JSON… | ||||
| CVE-2020-35565US | critical9.8OT elevated | — | ||
An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. The login pages bruteforce detection is disabled by default. | ||||
| CVE-2020-35564US | high7.5 | — | ||
An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an outdated and unused component allowing for malicious user input of active code. | ||||
| CVE-2020-35563US | medium5.4 | — | ||
An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an incomplete XSS filter allowing an attacker to inject crafted malicious code into… | ||||
| CVE-2020-35561US | medium5.3 | — | ||
An issue was discovered MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. There is an SSRF in the HA module allow… | ||||
| CVE-2020-35560US | medium6.1 | — | ||
An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an unauthenticated open redirect in the redirect.php. | ||||
| CVE-2020-35559US | medium4.3 | — | ||
An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an unused function that allows an authenticated attacker to use up all available IP… | ||||
| CVE-2020-35558US | high7.5 | — | ||
An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual through 2.11.2. There is an SSRF in the in the MySQL access check, al… | ||||
| CVE-2020-35557US | medium6.5 | — | ||
An issue in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2 allows a logged in user to see devices in the accoun… | ||||
| CVE-2020-10384US | high7.8 | — | ||
An issue was discovered in the MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 software in all versions through 2.6.1. There is a local privilege escalation from the www-data account… | ||||
references
External citations — patches, advisories, analysis.
remediations (21)
- MitigationmymbCONNECT24
Additional details can be found on MB connect line's website.
- MitigationmymbCONNECT24
Additional details can be found on MB connect line's website.
- MitigationmymbCONNECT24
Additional details can be found on MB connect line's website.
- MitigationmymbCONNECT24
Additional details can be found on MB connect line's website.
- MitigationmymbCONNECT24
Additional details can be found on MB connect line's website.
- MitigationmymbCONNECT24
Additional details can be found on MB connect line's website.
- MitigationmymbCONNECT24
Additional details can be found on MB connect line's website.
- MitigationmymbCONNECT24
Additional details can be found on MB connect line's website.
- MitigationmymbCONNECT24
Additional details can be found on MB connect line's website.
- MitigationmymbCONNECT24
Additional details can be found on MB connect line's website.
- MitigationmymbCONNECT24
Additional details can be found on MB connect line's website.
- MitigationmymbCONNECT24
Additional details can be found on MB connect line's website.
- MitigationmymbCONNECT24
Additional details can be found on MB connect line's website.
- MitigationmymbCONNECT24
Additional details can be found on MB connect line's website.
- MitigationmymbCONNECT24
Additional details can be found on MB connect line's website.
- MitigationmymbCONNECT24
Additional details can be found on MB connect line's website.
- MitigationmymbCONNECT24
Additional details can be found on MB connect line's website.
- MitigationmymbCONNECT24
Additional details can be found on MB connect line's website.
- FixedmymbCONNECT24
MB connect line recommends users update mymbCONNECT24 and mbCONNECT24 to Version 2.71 or higher to mitigate many of these vulnerabilities. A future release will include mitigations for the remaining vulnerabilities found in CVE-2020-35567, CVE-2020-35565, and CVE-2020-35561.
https://www.cve.org/CVERecord?id=CVE-2020-35567 - FixedmymbCONNECT24
MB connect line recommends users update mymbCONNECT24 and mbCONNECT24 to Version 2.71 or higher to mitigate many of these vulnerabilities. A future release will include mitigations for the remaining vulnerabilities found in CVE-2020-35567, CVE-2020-35565, and CVE-2020-35561.
https://www.cve.org/CVERecord?id=CVE-2020-35567 - FixedmymbCONNECT24
MB connect line recommends users update mymbCONNECT24 and mbCONNECT24 to Version 2.71 or higher to mitigate many of these vulnerabilities. A future release will include mitigations for the remaining vulnerabilities found in CVE-2020-35567, CVE-2020-35565, and CVE-2020-35561.
https://www.cve.org/CVERecord?id=CVE-2020-35567
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan