Show filters
6 Total Results
Displaying 1-6 of 6
Sort by:
Attacker Value
Very High
CVE-2021-26914
Disclosure Date: February 08, 2021 (last updated February 22, 2025)
NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of Java deserialization in MvcUtil valueStringToObject.
0
Attacker Value
Unknown
CVE-2021-40067
Disclosure Date: September 16, 2021 (last updated February 23, 2025)
The access controls on the Mobility read-write API improperly validate user access permissions; this API is disabled by default. If the API is manually enabled, attackers with both network access to the API and valid credentials can read and write data to it; regardless of access control group membership settings. This vulnerability is fixed in Mobility v12.14.
0
Attacker Value
Unknown
CVE-2021-40066
Disclosure Date: September 16, 2021 (last updated February 23, 2025)
The access controls on the Mobility read-only API improperly validate user access permissions. Attackers with both network access to the API and valid credentials can read data from it; regardless of access control group membership settings. This vulnerability is fixed in Mobility v11.76 and Mobility v12.14.
0
Attacker Value
Unknown
CVE-2021-26913
Disclosure Date: February 08, 2021 (last updated February 22, 2025)
NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of Java deserialization in RpcServlet.
0
Attacker Value
Unknown
CVE-2021-26915
Disclosure Date: February 08, 2021 (last updated February 22, 2025)
NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of Java deserialization in webrepdb StatusServlet.
0
Attacker Value
Unknown
CVE-2021-26912
Disclosure Date: February 08, 2021 (last updated February 22, 2025)
NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of Java deserialization in SupportRpcServlet.
0
