Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: Image Access Scan2Net 7.40 Clear all filters
TI-2024-18721 CVE-2024-28143 · GHSA-224h-vf26-wvfw

Insecure Password Change Function

Priority LOW 38

The password change function at /cgi/admin.cgi does not require the current/old password, which makes the application vulnerable to account takeover.

CVSS 3.1HIGH 8.4 Local No auth No interaction EPSS 0.00266 Published 2024-12-12 Fixed in 7.40 CWE-620
TI-2024-18723 CVE-2024-28145 · GHSA-pc69-2jfc-f577

Unauthenticated SQL injection in Image Access GmbH Scan2Net

Priority LOW 27

An unauthenticated attacker can perform an SQL injection by accessing the /class/dbconnect.php file and supplying malicious GET parameters.

CVSS 3.1MEDIUM 5.9 Local No auth No interaction EPSS 0.00532 Published 2024-12-12 Fixed in 7.40 CWE-89
TI-2024-32190 CVE-2024-47947 · GHSA-f9hr-3m6x-jmr5

Stored cross site scripting in Image Access GmbH Scan2Net

Priority MEDIUM 55

Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users.

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00482 Published 2024-12-12 Fixed in 7.40 CWE-79
TI-2024-18720 CVE-2024-28142 · GHSA-68rw-c4gj-cpcv

Stored cross site scripting in Image Access GmbH Scan2Net

Priority MEDIUM 55

Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users.

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00464 Published 2024-12-12 Fixed in 7.40 CWE-79