Faronics Insight 日志信息泄露漏洞

Faronics Insight is an effective classroom management tool from Faronics Canada. A security vulnerability exists in Faronics Insight version 10.0.19045, which stems from the fact that the student's end records every input made on the computer and stores it in a publicly accessible location...

CVE-2023-28350

An issue was discovered in Faronics Insight 10.0.19045 on Windows. Attacker-supplied input is not validated/sanitized before being rendered in both the Teacher and Student Console applications, enabling an attacker to execute JavaScript in these applications. Due to the rich and highly privileged...

CVE-2023-28346

An issue was discovered in Faronics Insight 10.0.19045 on Windows. It is possible for a remote attacker to communicate with the private API endpoints exposed at /login, /consoleSettings, /console, etc. despite Virtual Host Routing being used to block this access. Remote attackers can interact wit...

CVE-2023-28345

CVE-2023-28345 affects Faronics Insight 10.0.19045 on Windows, where the Insight Teacher Console exposes the teacher’s password in cleartext via a localhost API endpoint. An attacker with physical access can open a browser, access the endpoint, and obtain the password, enabling login to the Teach...

CVE-2023-28346

CVE-2023-28346 (Faronics Insight 10.0.19045, Windows) : A vulnerability allows remote attackers with valid credentials to communicate with private API endpoints exposed by the web server (examples: /login, /consoleSettings, /console) despite Virtual Host Routing intended to block access. The flaw...

Faronics Insight 安全漏洞

Faronics Insight is an effective classroom management tool from Faronics Canada. A security vulnerability exists in Faronics Insight version 10.0.19045 that originates from exposing a teacher's console password in plaintext via an API endpoint accessible from the local host...

CVE-2023-28350

An issue was discovered in Faronics Insight 10.0.19045 on Windows. Attacker-supplied input is not validated/sanitized before being rendered in both the Teacher and Student Console applications, enabling an attacker to execute JavaScript in these applications. Due to the rich and highly privileged...

CVE-2023-28347

An issue was discovered in Faronics Insight 10.0.19045 on Windows. It is possible for an attacker to create a proof-of-concept script that functions similarly to a Student Console, providing unauthenticated attackers with the ability to exploit XSS vulnerabilities within the Teacher Console...

CVE-2023-28352

An issue was discovered in Faronics Insight 10.0.19045 on Windows. By abusing the Insight UDP broadcast discovery system, an attacker-controlled artificial Student Console can connect to and attack a Teacher Console even after Enhanced Security Mode has been enabled...

CVE-2023-28352

CVE-2023-28352 affects Faronics Insight 10.0.19045 on Windows. The issue stems from abusing the Insight UDP broadcast discovery system, enabling an attacker‑controlled artificial Student Console to connect to and attack a Teacher Console even after Enhanced Security Mode is enabled. CVSS v3.1 bas...

Faronics Insight 安全漏洞

Faronics Insight is an effective classroom management tool from Faronics Canada. A security vulnerability exists in Faronics Insight version 10.0.19045 that originates from an unauthenticated attacker being able to view continually updated screenshots of a student's desktop and submit a forged...

Faronics Insight 安全漏洞

Faronics Insight is an effective classroom management tool from Faronics Canada. A security vulnerability exists in Faronics Insight version 10.0.19045, which stems from the fact that private interfaces such as /login, /consoleSettings, /console, etc. can be accessed and perform privileged...

Faronics Insight 访问控制错误漏洞

Faronics Insight is an effective classroom management tool from Faronics Canada. A security vulnerability exists in Faronics Insight version 10.0.19045, which originates from the creation of a specially crafted program with functionality similar to the Teacher's Console, which can write arbitrary...

CVE-2023-28349

An issue was discovered in Faronics Insight 10.0.19045 on Windows. It is possible for an attacker to create a crafted program that functions similarly to the Teacher Console. This can compel Student Consoles to connect and put themselves at risk automatically. Connected Student Consoles can be...

CVE-2023-28348

An issue was discovered in Faronics Insight 10.0.19045 on Windows. A suitably positioned attacker could perform a man-in-the-middle attack on either a connected student or teacher, enabling them to intercept student keystrokes or modify executable files being sent from teachers to students...

CVE-2023-28349

An issue was discovered in Faronics Insight 10.0.19045 on Windows. It is possible for an attacker to create a crafted program that functions similarly to the Teacher Console. This can compel Student Consoles to connect and put themselves at risk automatically. Connected Student Consoles can be...

CVE-2023-28350

The CVE-2023-28350 issue affects Faronics Insight version 10.0.19045 on Windows, where attacker-supplied input is rendered in both the Teacher and Student Console applications without proper validation/sanitization. This enables cross-site scripting (XSS) in the consoles, and due to the Teacher C...

CVE-2023-28344

The CVE-2023-28344 issue affects Faronics Insight 10.0.19045 on Windows. The root cause is insufficient access control when handling the agent id parameter in the Insight Teacher Console, allowing unauthenticated attackers to view constantly updated screenshots of student desktops and to submit f...

CVE-2023-28348

An issue was discovered in Faronics Insight 10.0.19045 on Windows. A suitably positioned attacker could perform a man-in-the-middle attack on either a connected student or teacher, enabling them to intercept student keystrokes or modify executable files being sent from teachers to students...

CVE-2023-28351

An issue was discovered in Faronics Insight 10.0.19045 on Windows. Every keystroke made by any user on a computer with the Student application installed is logged to a world-readable directory. A local attacker can trivially extract these cleartext keystrokes, potentially enabling them to obtain...