CVE-2023-33371

CVE-2023-33371 affects Control ID IDSecure 4.7.26.0 and earlier. The vulnerability arises from a hardcoded cryptographic key used to sign and verify JWT session tokens, enabling an attacker to forge tokens and bypass authentication. Exploitation details are not provided in these documents, but th...

CVE-2023-33370

CVE-2023-33370 affects Control ID IDSecure 4.7.26.0 and earlier. An uncaught exception vulnerability could cause the main web server to fault and crash, resulting in a denial of service. The issue is documented across multiple sources (NVD, Red Hat advisory, CNNVD, etc.). Affected component: IDSe...

CVE-2023-33368: Exposure of Resource to Wrong Sphere

Some API routes exists in Control ID IDSecure 4.7.26.0 and prior, exfiltrating sensitive information and passwords to users accessing these API routes...

CVE-2023-33369: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing attackers to delete arbitrary files on IDSecure filesystem, causing a denial of service...

CVE-2023-33370: Improper Handling of Exceptional Conditions

An uncaught exception vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing attackers to cause the main web server of IDSecure to fault and crash, causing a denial of service...

PT-2023-24317

Name of the Vulnerable Software and Affected Versions Control ID IDSecure versions 4.7.26.0 and prior Description A path traversal issue exists, allowing attackers to delete arbitrary files on the IDSecure filesystem, causing a denial of service. Recommendations For Control ID IDSecure versions...

CVE-2023-2524

A vulnerability classified as critical has been found in Control iD RHiD 23.3.19.0. This affects an unknown part of the file /v2//. The manipulation leads to direct request. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-228015. NOTE: The...

Authentication flaw

A vulnerability classified as critical has been found in Control iD RHiD 23.3.19.0. This affects an unknown part of the file /v2//. The manipulation leads to direct request. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-228015. NOTE: The...

CVE-2023-2524 Control iD RHiD direct request

A vulnerability classified as critical has been found in Control iD RHiD 23.3.19.0. This affects an unknown part of the file /v2//. The manipulation leads to direct request. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-228015. NOTE: The...

CVE-2023-2524

CVE-2023-2524 describes a critical vulnerability in Control iD RHiD 23.3.19.0. It affects an unknown part of the file /v2/#/ and allows manipulation that leads to a direct request; the attack can be initiated remotely. The issue is widely reported across multiple sources, with vendor contact note...

CVE-2023-2524 Control iD RHiD direct request

A vulnerability classified as critical has been found in Control iD RHiD 23.3.19.0. This affects an unknown part of the file /v2//. The manipulation leads to direct request. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-228015. NOTE: The...

Control iD RHiD 安全漏洞

Control iD RHiD is a complete system from Control iD that allows point computing in the cloud. A security vulnerability exists in Control iD RHiD version 23.3.19.0. An attacker exploiting this vulnerability could send a direct request...

CVE-2023-2524: Direct Request

A vulnerability classified as critical has been found in Control iD RHiD 23.3.19.0. This affects an unknown part of the file /v2//. The manipulation leads to direct request. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-228015. NOTE: The...

CVE-2023-2421

A vulnerability classified as problematic has been found in Control iD RHiD 23.3.19.0. Affected is an unknown function of the file /v2//add/department. The manipulation of the argument Name leads to cross site scripting. It is possible to launch the attack remotely. VDB-227718 is the identifier...

Cross site scripting

A vulnerability classified as problematic has been found in Control iD RHiD 23.3.19.0. Affected is an unknown function of the file /v2//add/department. The manipulation of the argument Name leads to cross site scripting. It is possible to launch the attack remotely. VDB-227718 is the identifier...

CVE-2023-2421 Control iD RHiD department cross site scripting

A vulnerability classified as problematic has been found in Control iD RHiD 23.3.19.0. Affected is an unknown function of the file /v2//add/department. The manipulation of the argument Name leads to cross site scripting. It is possible to launch the attack remotely. VDB-227718 is the identifier...

CVE-2023-2421

CVE-2023-2421 affects Control iD RHiD 23.3.19.0. The vulnerability is a cross-site scripting issue in an unknown function of the file "/v2/#/add/department" where manipulation of the Name argument leads to XSS. It can be exploited remotely. Multiple sources (NVD, Red Hat, PRION, CVE lists) consis...

CVE-2023-2421 Control iD RHiD department cross site scripting

A vulnerability classified as problematic has been found in Control iD RHiD 23.3.19.0. Affected is an unknown function of the file /v2//add/department. The manipulation of the argument Name leads to cross site scripting. It is possible to launch the attack remotely. VDB-227718 is the identifier...

CVE-2023-2421: Improper Neutralization of Input During Web Page Generation

A vulnerability classified as problematic has been found in Control iD RHiD 23.3.19.0. Affected is an unknown function of the file /v2//add/department. The manipulation of the argument Name leads to cross site scripting. It is possible to launch the attack remotely. VDB-227718 is the identifier...

CVE-2023-2044

A vulnerability has been found in Control iD iDSecure 4.7.29.1 and classified as problematic. This vulnerability affects unknown code of the component Dispositivos Page. The manipulation of the argument IP-DNS leads to cross site scripting. The attack can be initiated remotely. VDB-225922 is the...