Helmholz: Multiple vulnerabilites in myREX24 and myREX24.virtual
Multiple vulnerabilities have been found in myREX24 and myREX24.virtual.
beschreibt (20)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-34575US | high7.5 | — | ||
In MB connect line mymbCONNECT24, mbCONNECT24 in versions <= 2.8.0 an unauthenticated user can enumerate valid users by checking what kind of response the server sends. | ||||
| CVE-2021-34574US | medium4.0 | — | ||
In MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2 an authenticated attacker can change the password of his acco… | ||||
| CVE-2020-12530US | medium6.1 | — | ||
An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2. There is an XSS issue in the redirect.php allowing an attacker to… | ||||
| CVE-2020-12529US | medium5.3 | — | ||
An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2 There is a SSRF in the LDAP access check, allowing an attacker to s… | ||||
| CVE-2020-12528US | high7.7 | — | ||
An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2. Improper use of access validation allows a logged in user to kill… | ||||
| CVE-2020-12527US | medium6.8 | — | ||
An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. Improper access validation allows a… | ||||
| CVE-2020-35570US | medium5.3 | — | ||
An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual through 2.11.2. An unauthenticated attacker is able to access files (… | ||||
| CVE-2020-35569US | medium6.1 | — | ||
An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is a self XSS issue with a crafted cookie in the login page. | ||||
| CVE-2020-35568US | medium4.3 | — | ||
An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. An incomplete filter applied to a da… | ||||
| CVE-2020-35567US | high7.8OT erhöht | — | ||
An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. The software uses a secure password for database access, but this password is shared across… | ||||
| CVE-2020-35566US | medium5.3 | — | ||
An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. An attacker can read arbitrary JSON… | ||||
| CVE-2020-35565US | critical9.8OT erhöht | — | ||
An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. The login pages bruteforce detection is disabled by default. | ||||
| CVE-2020-35564US | high7.5 | — | ||
An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an outdated and unused component allowing for malicious user input of active code. | ||||
| CVE-2020-35563US | medium5.4 | — | ||
An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an incomplete XSS filter allowing an attacker to inject crafted malicious code into… | ||||
| CVE-2020-35561US | medium5.3 | — | ||
An issue was discovered MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. There is an SSRF in the HA module allow… | ||||
| CVE-2020-35560US | medium6.1 | — | ||
An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an unauthenticated open redirect in the redirect.php. | ||||
| CVE-2020-35559US | medium4.3 | — | ||
An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an unused function that allows an authenticated attacker to use up all available IP… | ||||
| CVE-2020-35558US | high7.5 | — | ||
An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual through 2.11.2. There is an SSRF in the in the MySQL access check, al… | ||||
| CVE-2020-35557US | medium6.5 | — | ||
An issue in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2 allows a logged in user to see devices in the accoun… | ||||
| CVE-2020-10384US | high7.8 | — | ||
An issue was discovered in the MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 software in all versions through 2.6.1. There is a local privilege escalation from the www-data account… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (20)
- Kein Fix verfügbar
CVE-2020-35565: None Mitigation: Activate bruteforce detection via Security → Fail2Ban → WebLogin Note: A proper fix for the underlying issue will come with a future architectural core-system-update. To further increase the security level of your account enable MFA.
- Kein Fix verfügbar
CVE-2020-35567: None Note: A proper fix for the underlying issue will come with a future architectural core-system-update.
- Kein Fix verfügbar
no fix available
- Kein Fix verfügbar
no fix available
- Behoben
CVE-2020-10384: Update to version 2.6.2 to close any known way to get to www-data. Note: This issue only exists up until version 2.6.1 and has already been addressed in 2.6.2
- Behoben
CVE-2020-35561: Update to version 2.12.1
- Behoben
Update to version 2.12.1
- Behoben
Update to version 2.12.1
- Behoben
Update to version 2.12.1
- Behoben
Update to version 2.12.1
- Behoben
Update to version 2.12.1
- Behoben
Update to version 2.12.1
- Behoben
Update to version 2.7.1
- Behoben
Update to version 2.7.1
- Behoben
Update to version 2.7.1
- Behoben
Update to version 2.7.1
- Behoben
Update to version 2.7.1
- Behoben
Update to version 2.7.1
- Behoben
Update to version 2.7.1
- Behoben
Update to version 2.7.1
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan