497 matches found
Design/Logic Flaw
ThingsBoard 3.4.1 could allow a remote attacker to gain elevated privileges because hard-coded service credentials usable for privilege escalation are stored in an insecure format. To read this stored data, the attacker needs access to the application server or its source code...
CVE-2022-48341
ThingsBoard 3.4.1 could allow a remote authenticated attacker to achieve Vertical Privilege Escalation. A Tenant Administrator can obtain System Administrator dashboard access by modifying the scope via the scopes parameter...
Thingsboard 安全漏洞
Thingsboard is a Java-based platform for monitoring, management, and data collection of IOT devices from the Thingsboard team. A security vulnerability exists in Thingsboard version 3.4.1, which stems from the fact that a tenant administrator can modify the scope of the scopes parameter to gain...
CVE-2023-26462
ThingsBoard 3.4.1 could allow a remote attacker to gain elevated privileges because hard-coded service credentials usable for privilege escalation are stored in an insecure format. To read this stored data, the attacker needs access to the application server or its source code...
Thingsboard 信任管理问题漏洞
Thingsboard is a Java-based platform for IOT devices for monitoring, management, and data collection from the Thingsboard team. A security vulnerability exists in ThingsBoard version 3.4.1, which stems from hard-coded service credentials stored in an insecure format that can be exploited by an...
PT-2023-20655 · Unknown · Thingsboard
Name of the Vulnerable Software and Affected Versions: ThingsBoard version 3.4.1 Description: The issue allows a remote attacker to gain elevated privileges due to hard-coded service credentials being stored in an insecure format. To exploit this, an attacker would need access to the application...
CVE-2022-48341
ThingsBoard 3.4.1 could allow a remote authenticated attacker to achieve Vertical Privilege Escalation. A Tenant Administrator can obtain System Administrator dashboard access by modifying the scope via the scopes parameter...
CVE-2022-48341
ThingsBoard 3.4.1 contains a vertical privilege escalation vulnerability where a remote authenticated tenant administrator can gain access to the System Administrator dashboard by modifying the scope parameter (scopes). The issue is triggered by scope manipulation and could allow access to higher...
SUSE CVE-2021-36976
libarchive 3.4.1 through 3.5.1 has a use-after-free in copystring called from douncompressblock and processblock...
CVE-2022-23525 affecting package helm 3.4.1-13
CVE-2022-23525 affecting package helm 3.4.1-13. A patched version of the package is available...
PT-2023-18789 · Unknown · Shibboleth Service Provider
Name of the Vulnerable Software and Affected Versions: Shibboleth Service Provider SP versions prior to 3.4.1 Description: The issue concerns insecure folder permissions in the Windows installation path of Shibboleth Service Provider SP. This allows an unprivileged local attacker to escalate...
CVE-2023-22947
CVE-2023-22947 affects Shibboleth Service Provider (SP) on Windows prior to 3.4.1. The issue stems from insecure folder permissions in the Windows installation path (defaulting to C:\opt instead of C:\Program Files), enabling an unprivileged local attacker to escalate to SYSTEM via DLL planting i...
CVE-2022-40004
Cross Site Scripting XSS vulnerability in Things Board 3.4.1 allows remote attackers to escalate privilege via crafted URL to the Audit Log...
CVE-2022-40004
CVE-2022-40004 concerns a Cross Site Scripting (XSS) flaw in Things Board 3.4.1. Publicly documented details in the connected sources indicate that a crafted URL to the Audit Log can be used by a remote attacker to escalate privileges. The risk is described with high/severe impact in CVSS metrics...
CVE-2022-40004
Cross Site Scripting XSS vulnerability in Things Board 3.4.1 allows remote attackers to escalate privilege via crafted URL to the Audit Log...
Thingsboard 跨站脚本漏洞
Thingsboard is a Java-based platform for IOT devices for monitoring, management, and data collection from the Thingsboard team. A security vulnerability exists in Thingsboard version 3.4.1, which stems from the presence of cross-site scripting XSS that allows a remote attacker to elevate privileg...
PT-2022-25162 · Unknown · Thingsboard
Name of the Vulnerable Software and Affected Versions: Things Board version 3.4.1 Description: The issue is related to a Cross Site Scripting XSS vulnerability that allows remote attackers to escalate privileges. This is achieved by crafting a URL to the Audit Log. Recommendations: For version...
AZL-33586 CVE-2022-32149 affecting package git-lfs for versions less than 3.4.1-1
An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse...
Amazon Linux 2022 : bsdcat, bsdcpio, bsdtar (ALAS2022-2022-059)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-059 advisory. An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of the archive. An attacker may provid...