CVE-2019-14480

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

AdRem NetCrunch 10.6.0.4587 has an Improper Session Handling vulnerability in the NetCrunch web client, which can lead to an authentication bypass or escalation of privileges.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-200 CWE-311 CWE-338 CWE-522 CWE-732

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://compass-security.com/fileadmin/Research/Advisories/2020-14_CSNC-2019-015_AdRem_NetCrunch_Improper_Session_Handling.txtExploit, Technical Description, Third Party Advisory
https://www.adremsoft.com/support/Product
https://compass-security.com/fileadmin/Research/Advisories/2020-14_CSNC-2019-015_AdRem_NetCrunch_Improper_Session_Handling.txtExploit, Technical Description, Third Party Advisory
https://www.adremsoft.com/support/Product

Timeline

Published: Dec 16, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-144815.4AdRem NetCrunch 10.6.0.4587 has a Cross-Site Request Forgery (CSRF) vulnerability in the NetCrunch web client. Successful exploitation requi CVE-2019-144829.8AdRem NetCrunch 10.6.0.4587 has a hardcoded SSL private key vulnerability in the NetCrunch web client. The same hardcoded SSL private key is CVE-2019-144838.8AdRem NetCrunch 10.6.0.4587 allows Credentials Disclosure. Every user can read the BSD, Linux, MacOS and Solaris private keys, private keys'CVE-2019-144867.8GnuCOBOL 2.2 has a buffer overflow in cb_evaluate_expr in cobc/field.c via crafted COBOL source code.CVE-2019-14499.8A security feature bypass vulnerability exists in the way that Office Click-to-Run (C2R) components handle a specially crafted file, which c CVE-2019-144918.2An issue was discovered in OpenCV before 3.4.7 and 4.x before 4.1.1. There is an out of bounds read in the function cv::predictOrdered<cv::H CVE-2019-144927.5An issue was discovered in OpenCV before 3.4.7 and 4.x before 4.1.1. There is an out of bounds read/write in the function HaarEvaluator::Opt CVE-2019-144937.5An issue was discovered in OpenCV before 4.1.1. There is a NULL pointer dereference in the function cv::XMLParser::parse at modules/core/src CVE-2019-144947.5An issue was discovered in Poppler through 0.78.0. There is a divide-by-zero error in the function SplashOutputDev::tilingPatternFill at Spl CVE-2019-144959.8webadmin.c in 3proxy before 0.8.13 has an out-of-bounds write in the admin interface.CVE-2019-144967.8LoaderXM::load in LoaderXM.cpp in milkyplay in MilkyTracker 1.02.00 has a stack-based buffer overflow.CVE-2019-144977.8ModuleEditor::convertInstrument in tracker/ModuleEditor.cpp in MilkyTracker 1.02.00 has a heap-based buffer overflow.