Shoji Baba

Name of the Vulnerable Software and Affected Versions: Active! mail 6 versions 6.30.01004145 through 6.60.06008562 Description: A cross-site scripting issue exists, allowing an arbitrary script to be executed on the logged-in user's web browser when accessing a specially crafted URL. Recommendations: For Active! mail 6 versions 6.30.01004145 through 6.60.06008562, update to a version that includes a fix for this issue to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Active! mail 6 versions 6.60.06008562 and earlier Description: A cross-site request forgery issue exists, potentially allowing unintended emails to be sent when a user, who is logged in, accesses a specially crafted URL. Recommendations: For Active! mail 6 versions 6.60.06008562 and earlier, consider implementing measures to verify the authenticity of requests, such as validating the origin of requests or using anti-CSRF tokens, until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue allows a network-adjacent unauthenticated attacker to execute an arbitrary OS command on the affected product.

A cross-site scripting issue allows a network-adjacent unauthenticated attacker to execute an arbitrary script on the web browser of the user accessing the management page of the affected product.

The issue allows a network-adjacent unauthenticated attacker to access the affected product without authentication. This is due to an improper authentication vulnerability.

The issue allows a network-adjacent unauthenticated attacker to obtain an arbitrary file in the affected product due to a path traversal vulnerability.

A cross-site request forgery issue allows a remote unauthenticated attacker to change the product settings.

A server-side request forgery issue allows a network-adjacent unauthenticated attacker to send an arbitrary HTTP request (GET) from the affected product.

An improper access control issue exists, potentially allowing a network-adjacent unauthenticated attacker to obtain a `username` and its hashed `password` displayed on the management page of the affected product.

Name of the Vulnerable Software and Affected Versions: RTX830 versions 15.02.17 and earlier NVR510 versions 15.01.18 and earlier NVR700W versions 15.00.19 and earlier RTX1210 versions 14.01.38 and earlier Description: The issue is related to improper neutralization of HTTP request headers for scripting syntax, allowing a remote authenticated attacker to obtain sensitive information via a specially crafted web page. This affects the Web GUI of the mentioned devices. Recommendations: For RTX830 versions 15.02.17 and earlier, update to a version later than 15.02.17 to resolve the issue. For NVR510 versions 15.01.18 and earlier, update to a version later than 15.01.18 to resolve the issue. For NVR700W versions 15.00.19 and earlier, update to a version later than 15.00.19 to resolve the issue. For RTX1210 versions 14.01.38 and earlier, update to a version later than 14.01.38 to resolve the issue. As a temporary workaround, consider restricting access to the Web GUI to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: RTX830 versions 15.02.17 and earlier NVR510 versions 15.01.18 and earlier NVR700W versions 15.00.19 and earlier RTX1210 versions 14.01.38 and earlier Description: The issue is a cross-site script inclusion vulnerability in the Web GUI of the affected products. This allows a remote authenticated attacker to alter the product's settings via a specially crafted web page. Recommendations: For RTX830 versions 15.02.17 and earlier, update to a version later than 15.02.17 to resolve the issue. For NVR510 versions 15.01.18 and earlier, update to a version later than 15.01.18 to resolve the issue. For NVR700W versions 15.00.19 and earlier, update to a version later than 15.00.19 to resolve the issue. For RTX1210 versions 14.01.38 and earlier, update to a version later than 14.01.38 to resolve the issue. As a temporary workaround, consider restricting access to the Web GUI to minimize the risk of exploitation.

A directory traversal issue allows remote authenticated attackers to modify arbitrary files using the `Customapp` function.

The issue allows remote authenticated attackers to execute arbitrary SQL commands.

The issue allows remote attackers to conduct Python code injection attacks.

A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML.

The issue allows remote attackers to execute arbitrary OS commands.

The issue allows remote attackers to conduct XML External Entity (XXE) attacks. This is achieved via unspecified vectors, which could potentially lead to unauthorized access to sensitive data.

The issue allows remote authenticated users to execute arbitrary PHP code.

The issue allows remote attackers to execute arbitrary SQL commands.

The issue allows remote attackers to delete arbitrary files via unspecified vectors when the `File` field is being used in the mail form.