Seling Visual Access Manager vulnerabilities
26 known vulnerabilities affecting seling/visual_access_manager.
Total CVEs
26
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL1HIGH4MEDIUM13LOW8
Vulnerabilities
Page 1 of 2
CVE-2019-19994P2CRITICALCVSS 9.8≥ 4.15.0, ≤ 4.29.02020-02-26
CVE-2019-19994 [CRITICAL] CWE-78 CVE-2019-19994: An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. It allows blind
An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. It allows blind Command Injection. An attacker without authentication is able to execute arbitrary operating system command by injecting the vulnerable parameter in the PHP Web page /common/vam_monitor_sap.php.
nvd
CVE-2023-42244P3HIGHCVSS 8.8fixed in 4.42.22025-01-13
CVE-2023-42244 [HIGH] CWE-89 CVE-2023-42244: An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated att
An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple POST parameters of /vam/vam_visits.php.
nvd
CVE-2019-19988P3HIGHCVSS 8.8≥ 4.15.0, ≤ 4.29.02020-02-26
CVE-2019-19988 [HIGH] CWE-787 CVE-2019-19988: An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. A user with vali
An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. A user with valid credentials is able to create and write XML files on the filesystem via /common/vam_editXml.php in the web interface. The vulnerable PHP page checks none of these: the parameter that identifies the file name to be created, the destination path, or the
nvd
CVE-2019-19986P3HIGHCVSS 7.5≥ 4.15.0, ≤ 4.29.02020-02-26
CVE-2019-19986 [HIGH] CWE-89 CVE-2019-19986: An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. An attacker with
An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. An attacker without authentication is able to execute arbitrary SQL SELECT statements by injecting the HTTP (POST or GET) parameter persoid into /tools/VamPersonPhoto.php. The SQL Injection type is Error-based (this means that relies on error messages thrown by the data
nvd
CVE-2019-19989P3HIGHCVSS 7.5≥ 4.15.0, ≤ 4.29.02020-02-26
CVE-2019-19989 [HIGH] CWE-862 CVE-2019-19989: An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. Several PHP page
An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. Several PHP pages, and other type of files, are reachable by any user without checking for user identity and authorization.
nvd
CVE-2023-42248P3MEDIUMCVSS 6.5fixed in 4.42.22025-01-13
CVE-2023-42248 [MEDIUM] CWE-434 CVE-2023-42248: An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated att
An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can write arbitrary files by manipulating POST parameters of the page "common/vam_Sql.php".
nvd
CVE-2019-19992P3MEDIUMCVSS 6.5≥ 4.15.0, ≤ 4.29.02020-02-26
CVE-2019-19992 [MEDIUM] CWE-20 CVE-2019-19992: An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. A user with vali
An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. A user with valid credentials is able to read XML files on the filesystem via the web interface. The PHP page /common/vam_editXml.php doesn't check the parameter that identifies the file name to be read. Thus, an attacker can manipulate the file name to access a poten
nvd
CVE-2023-50811P3MEDIUMCVSS 6.5v4.38.62024-03-19
CVE-2023-50811 [MEDIUM] CWE-444 CVE-2023-50811: An issue discovered in SELESTA Visual Access Manager 4.38.6 allows attackers to modify the “computer
An issue discovered in SELESTA Visual Access Manager 4.38.6 allows attackers to modify the “computer” POST parameter related to the ID of a specific reception by POST HTTP request interception. Iterating that parameter, it has been possible to access to the application and take control of many other receptions in addition the assigned one.
nvd
CVE-2023-42243P4MEDIUMCVSS 5.4fixed in 4.42.22025-01-13
CVE-2023-42243 [MEDIUM] CWE-89 CVE-2023-42243: In Selesta Visual Access Manager < 4.42.2, an authenticated user can access the administrative page
In Selesta Visual Access Manager < 4.42.2, an authenticated user can access the administrative page /common/vam_Sql.php, which allows for arbitrary SQL queries.
nvd
CVE-2019-19987P4MEDIUMCVSS 6.5≥ 4.15.0, ≤ 4.29.02020-02-26
CVE-2019-19987 [MEDIUM] CWE-352 CVE-2019-19987: An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. It allows Cross-
An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. It allows Cross-Site Request Forgery (CSRF) on any HTML form. An attacker can exploit the vulnerability to abuse functionalities such as change password, add user, add privilege, and so on.
nvd
CVE-2019-19993P4MEDIUMCVSS 5.3≥ 4.15.0, ≤ 4.29.02020-02-26
CVE-2019-19993 [MEDIUM] CWE-209 CVE-2019-19993: An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. Several full pat
An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. Several full path disclosure vulnerability were discovered. A user, even with no authentication, may simply send arbitrary content to the vulnerable pages to generate error messages that expose some full paths.
nvd
CVE-2019-19990P4MEDIUMCVSS 5.4≥ 4.15.0, ≤ 4.29.02020-02-26
CVE-2019-19990 [MEDIUM] CWE-79 CVE-2019-19990: An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. Multiple Stored
An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. Multiple Stored Cross-site scripting (XSS) vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML via the web pages /monitor/s_headmodel.php and /vam/vam_user.php.
nvd
CVE-2023-42247P4MEDIUMCVSS 6.1fixed in 4.42.22025-01-13
CVE-2023-42247 [MEDIUM] CWE-79 CVE-2023-42247: Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via monitor/s_mon
Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via monitor/s_monitor_map.php.
nvd
CVE-2023-42246P4MEDIUMCVSS 6.1fixed in 4.42.22025-01-13
CVE-2023-42246 [MEDIUM] CWE-79 CVE-2023-42246: Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via /vam/vam_ep.p
Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via /vam/vam_ep.php.
nvd
CVE-2023-42250P4MEDIUMCVSS 6.1fixed in 4.42.22025-01-13
CVE-2023-42250 [MEDIUM] CWE-79 CVE-2023-42250: Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via /common/autoc
Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via /common/autocomplete.php.
nvd
CVE-2023-42245P4MEDIUMCVSS 6.1fixed in 4.42.22025-01-13
CVE-2023-42245 [MEDIUM] CWE-79 CVE-2023-42245: Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via monitor/s_sch
Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via monitor/s_scheduledfile.php.
nvd
CVE-2023-42249P4MEDIUMCVSS 6.1fixed in 4.42.22025-01-13
CVE-2023-42249 [MEDIUM] CWE-79 CVE-2023-42249: Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via vam/vam_visit
Selesta Visual Access Manager < 4.42.2 is vulnerable to Cross Site Scripting (XSS) via vam/vam_visits.php.
nvd
CVE-2023-42236P4LOWCVSS 3.8fixed in 4.42.22025-01-13
CVE-2023-42236 [LOW] CWE-89 CVE-2023-42236: An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated att
An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in a GET parameter of /common/ajaxfunction.php.
nvd
CVE-2023-42242P4LOWCVSS 3.8fixed in 4.42.22025-01-13
CVE-2023-42242 [LOW] CWE-89 CVE-2023-42242: An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated att
An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in a GET parameter of /monitor/s_terminal.php.
nvd
CVE-2019-19991P4MEDIUMCVSS 5.4≥ 4.15.0, ≤ 4.29.02020-02-26
CVE-2019-19991 [MEDIUM] CWE-79 CVE-2019-19991: An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. Multiple Reflect
An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. Multiple Reflected Cross-site scripting (XSS) vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML via the web pages /vam/vam_anagraphic.php, /vam/vam_vamuser.php, /common/vamp_main.php, and /wiz/change_password.php.
nvd
1 / 2Next →