CVE-2019-14481

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

AdRem NetCrunch 10.6.0.4587 has a Cross-Site Request Forgery (CSRF) vulnerability in the NetCrunch web client. Successful exploitation requires a logged-in user to open a malicious page and leads to account takeover.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://compass-security.com/fileadmin/Research/Advisories/2020-15_CSNC-2019-016_AdRem_NetCrunch_Cross-Site_Request_Forgery_CSRF.txtExploit, Third Party Advisory
https://www.adremsoft.com/support/Product
https://compass-security.com/fileadmin/Research/Advisories/2020-15_CSNC-2019-016_AdRem_NetCrunch_Cross-Site_Request_Forgery_CSRF.txtExploit, Third Party Advisory
https://www.adremsoft.com/support/Product

Timeline

Published: Dec 16, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-144829.8AdRem NetCrunch 10.6.0.4587 has a hardcoded SSL private key vulnerability in the NetCrunch web client. The same hardcoded SSL private key is CVE-2019-144838.8AdRem NetCrunch 10.6.0.4587 allows Credentials Disclosure. Every user can read the BSD, Linux, MacOS and Solaris private keys, private keys'CVE-2019-144867.8GnuCOBOL 2.2 has a buffer overflow in cb_evaluate_expr in cobc/field.c via crafted COBOL source code.CVE-2019-14499.8A security feature bypass vulnerability exists in the way that Office Click-to-Run (C2R) components handle a specially crafted file, which c CVE-2019-144918.2An issue was discovered in OpenCV before 3.4.7 and 4.x before 4.1.1. There is an out of bounds read in the function cv::predictOrdered<cv::H CVE-2019-144927.5An issue was discovered in OpenCV before 3.4.7 and 4.x before 4.1.1. There is an out of bounds read/write in the function HaarEvaluator::Opt CVE-2019-144937.5An issue was discovered in OpenCV before 4.1.1. There is a NULL pointer dereference in the function cv::XMLParser::parse at modules/core/src CVE-2019-144947.5An issue was discovered in Poppler through 0.78.0. There is a divide-by-zero error in the function SplashOutputDev::tilingPatternFill at Spl CVE-2019-144959.8webadmin.c in 3proxy before 0.8.13 has an out-of-bounds write in the admin interface.CVE-2019-144967.8LoaderXM::load in LoaderXM.cpp in milkyplay in MilkyTracker 1.02.00 has a stack-based buffer overflow.CVE-2019-144977.8ModuleEditor::convertInstrument in tracker/ModuleEditor.cpp in MilkyTracker 1.02.00 has a heap-based buffer overflow.CVE-2019-144987.8A divide-by-zero error exists in the Control function of demux/caf.c in VideoLAN VLC media player 3.0.7.1. As a result, an FPE can be trigge