Skip to content
OpenAdvisories
High 1 exploited CVE ICSA-21-308-01 9 CVEs

VISAM VBASE Editor

Published Nov 4, 2021 · Updated Nov 4, 2021

Vendor: VISAM Product: VBASE Pro-RT/ Server-RT (Web Remote)

Summary

Successful exploitation of these vulnerabilities may allow un-neutralized user-controllable data input, disclosure of local files, access to NTLM (Windows New Technology LAN Manager) hashes, and access to sensitive files.

Vulnerabilities 9

  • High 7.0
    CVE-2019-18988 Exploited Public exploit

    TeamViewer Desktop through 14.7.1965 allows a bypass of remote-login access control because the same key is used for di…

    KEV Nov 3, 2021
  • High 7.4
    CVE-2021-38417

    VISAM VBASE Editor Improper Access Control

    VISAM VBASE version 11.6.0.6 is vulnerable to improper access control via the web-remote endpoint, which may allow an unauthenticated user viewing access to folders and files in the directory listing.

    VISAM VBASE Pro-RT/ Server-RT (Web Remote)
  • Medium 5.9
    CVE-2021-42537

    VISAM VBASE Editor Improper Restriction of XML

    VISAM VBASE version 11.6.0.6 processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

    VISAM VBASE Pro-RT/ Server-RT (Web Remote)
  • Medium 5.3
    CVE-2021-42535

    VISAM VBASE Editor Cross Site Scripting

    VISAM VBASE version 11.6.0.6 does not neutralize or incorrectly neutralizes user-controllable input before the data is placed in output used as a public-facing webpage.

    VISAM VBASE Pro-RT/ Server-RT (Web Remote)
  • Unscored —
    CVE-2005-2475

    Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a fi…

    unzip Debian
  • Unscored —
    CVE-2018-14333

    TeamViewer through 13.1.1548 stores a password in Unicode format within TeamViewer.exe process memory between "[00 88] …

  • Unscored —
    CVE-2018-16550

    TeamViewer 10.x through 13.x allows remote attackers to bypass the brute-force authentication protection mechanism by s…

  • Unscored —
    CVE-2020-13699 Public exploit EPSS 26%

    TeamViewer Desktop for Windows before 15.8.3 does not properly quote its custom URI handlers. A malicious website could…

  • Unscored —
    CVE-2021-34803

    TeamViewer before 14.7.48644 on Windows loads untrusted DLLs in certain situations.

Revision history

  1. #1

    ICSA-21-308-01 VISAM VBASE Editor

References