AN
Product
Analytics
17
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 8High 5Medium 4Low 0
Watch
Add Analytics to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-34137 | 9.8 | Jul 13 | SonicWall GMS and Analytics CAS Web Services application use static values for authentication without proper checks leading to authentication bypass vulnerability Affected: through 2.5.0.4-r7 |
| CVE-2023-34136 | 9.8 | Jul 13 | Vulnerability in SonicWall GMS and Analytics allows unauthenticated attacker to upload files to a restricted location not controlled by the attacker Affected: through 2.5.0.4-r7 |
| CVE-2023-34132 | 9.8 | Jul 13 | Use of password hash instead of password for authentication vulnerability in SonicWall GMS and Analytics allows Pass-the-Hash attacks Affected: through 2.5.0.4-r7 |
| CVE-2023-34130 | 9.8 | Jul 13 | SonicWall GMS and Analytics use outdated Tiny Encryption Algorithm (TEA) with a hardcoded key to encrypt sensitive data Affected: through 2.5.0.4-r7 |
| CVE-2023-34128 | 9.8 | Jul 13 | Tomcat application credentials are hardcoded in SonicWall GMS and Analytics configuration file Affected: through 2.5.0.4-r7 |
| CVE-2023-34124 | 9.8 | Jul 13 | The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authentication bypass Affected: through 2.5.0.4-r7 |
| CVE-2022-22280 | 9.8 | Jul 29 | Improper Neutralization of Special Elements used in an SQL Command leading to Unauthenticated SQL Injection vulnerability, impacting SonicWall GMS 9.3.1-SP2-Hotfix1, Analytics… Affected: through 2.5.0.3-2520 |
| CVE-2021-20032 | 9.8 | Aug 10 | SonicWall Analytics 2.5 On-Prem is vulnerable to Java Debug Wire Protocol (JDWP) interface security misconfiguration vulnerability which potentially leads to Remote Code Execution Affected: through 2.5.2518 |
| CVE-2023-34129 | 8.8 | Jul 13 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in SonicWall GMS and Analytics allows an authenticated remote attacker to traverse the… Affected: through 2.5.0.4-r7 |
| CVE-2023-34127 | 8.8 | Jul 13 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SonicWall GMS, SonicWall Analytics enables an authenticated attacker to… Affected: through 2.5.0.4-r7 |
| CVE-2023-34126 | 8.8 | Jul 13 | Vulnerability in SonicWall GMS and Analytics allows an authenticated attacker to upload files on the underlying filesystem with root privileges Affected: through 2.5.0.4-r7 |
| CVE-2023-34133 | 7.5 | Jul 13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SonicWall GMS and Analytics allows an unauthenticated attacker to extract… Affected: through 2.5.0.4-r7 |
| CVE-2023-34123 | 7.5 | Jul 13 | Use of Hard-coded Cryptographic Key vulnerability in SonicWall GMS, SonicWall Analytics Affected: before 2.5.0.4; 2.5.0.4-r7 |
| CVE-2023-34135 | 6.5 | Jul 13 | Path Traversal vulnerability in SonicWall GMS and Analytics allows a remote authenticated attacker to read arbitrary files from the underlying file system via web service Affected: through 2.5.0.4-r7 |
| CVE-2023-34134 | 6.5 | Jul 13 | Exposure of sensitive information to an unauthorized actor vulnerability in SonicWall GMS and Analytics allows authenticated attacker to read administrator password hash via a web… Affected: through 2.5.0.4-r7 |
| CVE-2023-34125 | 6.5 | Jul 13 | Path Traversal vulnerability in GMS and Analytics allows an authenticated attacker to read arbitrary files from the underlying filesystem with root privileges Affected: through 2.5.0.4-r7 |
| CVE-2023-34131 | 5.3 | Jul 13 | Exposure of sensitive information to an unauthorized actor vulnerability in SonicWall GMS and Analytics enables an unauthenticated attacker to access restricted web pages Affected: through 2.5.0.4-r7 |
Showing 17