Shoji Baba

اسم البرنامج المعرض للخطر والإصدارات المتأثرة: Active! mail 6، الإصدارات من 6.30.01004145 حتى 6.60.06008562 الوصف: توجد ثغرة أمنية تتعلق بالبرمجة النصية عبر المواقع (cross-site scripting)، مما يسمح بتنفيذ برنامج نصي تعسفي في متصفح الويب الخاص بالمستخدم المسجل الدخول عند الوصول إلى عنوان URL مصمم خصيصًا لهذا الغرض. التوصيات: بالنسبة لبرنامج Active! mail 6، الإصدارات من 6.30.01004145 حتى 6.60.06008562، قم بالتحديث إلى إصدار يتضمن تصحيحًا لهذه المشكلة لمنع استغلالها. في الوقت الحالي، لا توجد معلومات عن إصدار أحدث يحتوي على تصحيح لهذه الثغرة الأمنية.

اسم البرنامج المعرض للخطر والإصدارات المتأثرة: Active! mail 6، الإصدارات 6.60.06008562 والإصدارات الأقدم الوصف: توجد ثغرة أمنية تتعلق بتزوير الطلبات بين المواقع (CSRF)، مما قد يسمح بإرسال رسائل بريد إلكتروني غير مقصودة عندما يقوم مستخدم مسجل الدخول بالوصول إلى عنوان URL مصمم خصيصًا لهذا الغرض. التوصيات: بالنسبة لبرنامج Active! mail 6 الإصدارات 6.60.06008562 والإصدارات الأقدم، يُنصح باتخاذ تدابير للتحقق من صحة الطلبات، مثل التحقق من مصدر الطلبات أو استخدام الرموز المميزة المضادة لـ CSRF، إلى أن يتوفر تصحيح لهذا الخلل. في الوقت الحالي، لا توجد معلومات عن إصدار أحدث يحتوي على تصحيح لهذا الخلل.

The issue allows a network-adjacent unauthenticated attacker to execute an arbitrary OS command on the affected product.

A cross-site scripting issue allows a network-adjacent unauthenticated attacker to execute an arbitrary script on the web browser of the user accessing the management page of the affected product.

The issue allows a network-adjacent unauthenticated attacker to access the affected product without authentication. This is due to an improper authentication vulnerability.

The issue allows a network-adjacent unauthenticated attacker to obtain an arbitrary file in the affected product due to a path traversal vulnerability.

A cross-site request forgery issue allows a remote unauthenticated attacker to change the product settings.

A server-side request forgery issue allows a network-adjacent unauthenticated attacker to send an arbitrary HTTP request (GET) from the affected product.

An improper access control issue exists, potentially allowing a network-adjacent unauthenticated attacker to obtain a `username` and its hashed `password` displayed on the management page of the affected product.

Name of the Vulnerable Software and Affected Versions: RTX830 versions 15.02.17 and earlier NVR510 versions 15.01.18 and earlier NVR700W versions 15.00.19 and earlier RTX1210 versions 14.01.38 and earlier Description: The issue is related to improper neutralization of HTTP request headers for scripting syntax, allowing a remote authenticated attacker to obtain sensitive information via a specially crafted web page. This affects the Web GUI of the mentioned devices. Recommendations: For RTX830 versions 15.02.17 and earlier, update to a version later than 15.02.17 to resolve the issue. For NVR510 versions 15.01.18 and earlier, update to a version later than 15.01.18 to resolve the issue. For NVR700W versions 15.00.19 and earlier, update to a version later than 15.00.19 to resolve the issue. For RTX1210 versions 14.01.38 and earlier, update to a version later than 14.01.38 to resolve the issue. As a temporary workaround, consider restricting access to the Web GUI to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: RTX830 versions 15.02.17 and earlier NVR510 versions 15.01.18 and earlier NVR700W versions 15.00.19 and earlier RTX1210 versions 14.01.38 and earlier Description: The issue is a cross-site script inclusion vulnerability in the Web GUI of the affected products. This allows a remote authenticated attacker to alter the product's settings via a specially crafted web page. Recommendations: For RTX830 versions 15.02.17 and earlier, update to a version later than 15.02.17 to resolve the issue. For NVR510 versions 15.01.18 and earlier, update to a version later than 15.01.18 to resolve the issue. For NVR700W versions 15.00.19 and earlier, update to a version later than 15.00.19 to resolve the issue. For RTX1210 versions 14.01.38 and earlier, update to a version later than 14.01.38 to resolve the issue. As a temporary workaround, consider restricting access to the Web GUI to minimize the risk of exploitation.

A directory traversal issue allows remote authenticated attackers to modify arbitrary files using the `Customapp` function.

The issue allows remote authenticated attackers to execute arbitrary SQL commands.

The issue allows remote attackers to conduct Python code injection attacks.

A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML.

The issue allows remote attackers to execute arbitrary OS commands.

The issue allows remote attackers to conduct XML External Entity (XXE) attacks. This is achieved via unspecified vectors, which could potentially lead to unauthorized access to sensitive data.

The issue allows remote authenticated users to execute arbitrary PHP code.

The issue allows remote attackers to execute arbitrary SQL commands.

The issue allows remote attackers to delete arbitrary files via unspecified vectors when the `File` field is being used in the mail form.