CVE-2023-28353

An issue was discovered in Faronics Insight 10.0.19045 on Windows. An unauthenticated attacker is able to upload any type of file to any location on the Teacher Console's computer, enabling a variety of different exploitation paths including code execution. It is also possible for the attacker to...

CVE-2023-28349

An issue was discovered in Faronics Insight 10.0.19045 on Windows. It is possible for an attacker to create a crafted program that functions similarly to the Teacher Console. This can compel Student Consoles to connect and put themselves at risk automatically. Connected Student Consoles can be...

Faronics Insight 安全漏洞

Faronics Insight is an effective classroom management tool from Faronics Canada. A security vulnerability exists in Faronics Insight version 10.0.19045 that originates from an unauthenticated attacker being able to view continually updated screenshots of a student's desktop and submit a forged...

CVE-2023-28352

CVE-2023-28352 affects Faronics Insight 10.0.19045 on Windows. The issue stems from abusing the Insight UDP broadcast discovery system, enabling an attacker‑controlled artificial Student Console to connect to and attack a Teacher Console even after Enhanced Security Mode is enabled. CVSS v3.1 bas...

CVE-2023-28350

The CVE-2023-28350 issue affects Faronics Insight version 10.0.19045 on Windows, where attacker-supplied input is rendered in both the Teacher and Student Console applications without proper validation/sanitization. This enables cross-site scripting (XSS) in the consoles, and due to the Teacher C...

CVE-2023-28349

An issue was discovered in Faronics Insight 10.0.19045 on Windows. It is possible for an attacker to create a crafted program that functions similarly to the Teacher Console. This can compel Student Consoles to connect and put themselves at risk automatically. Connected Student Consoles can be...

CVE-2023-28350

An issue was discovered in Faronics Insight 10.0.19045 on Windows. Attacker-supplied input is not validated/sanitized before being rendered in both the Teacher and Student Console applications, enabling an attacker to execute JavaScript in these applications. Due to the rich and highly privileged...

CVE-2023-28344

The CVE-2023-28344 issue affects Faronics Insight 10.0.19045 on Windows. The root cause is insufficient access control when handling the agent id parameter in the Insight Teacher Console, allowing unauthenticated attackers to view constantly updated screenshots of student desktops and to submit f...

CVE-2023-28353

An issue was discovered in Faronics Insight 10.0.19045 on Windows. An unauthenticated attacker is able to upload any type of file to any location on the Teacher Console's computer, enabling a variety of different exploitation paths including code execution. It is also possible for the attacker to...

CVE-2023-28347

An issue was discovered in Faronics Insight 10.0.19045 on Windows. It is possible for an attacker to create a proof-of-concept script that functions similarly to a Student Console, providing unauthenticated attackers with the ability to exploit XSS vulnerabilities within the Teacher Console...

Faronics Insight 安全漏洞

Faronics Insight is an effective classroom management tool from Faronics Canada. A security vulnerability exists in Faronics Insight version 10.0.19045, which stems from discovering the system through misuse of Insight UDP broadcasts, which allows the student's end to connect and attack the...

Faronics Insight 安全漏洞

Faronics Insight is an effective classroom management tool from Faronics Canada. A security vulnerability exists in Faronics Insight version 10.0.19045 that originates from exposing a teacher's console password in plaintext via an API endpoint accessible from the local host...

Faronics Insight 访问控制错误漏洞

Faronics Insight is an effective classroom management tool from Faronics Canada. A security vulnerability exists in Faronics Insight version 10.0.19045, which originates from the creation of a specially crafted program with functionality similar to the Teacher's Console, which can write arbitrary...

Faronics Insight 跨站脚本漏洞

Faronics Insight is an effective classroom management tool from Faronics Canada. A security vulnerability exists in Faronics Insight version 10.0.19045, which stems from the use of a man-in-the-middle attack to present unescaped content on the Teacher's side and the Student's side, thereby...

CVE-2023-28344

An issue was discovered in Faronics Insight 10.0.19045 on Windows. The Insight Teacher Console application allows unauthenticated attackers to view constantly updated screenshots of student desktops and to submit falsified screenshots on behalf of students. Attackers are able to view screenshots ...

CVE-2023-28346

CVE-2023-28346 (Faronics Insight 10.0.19045, Windows) : A vulnerability allows remote attackers with valid credentials to communicate with private API endpoints exposed by the web server (examples: /login, /consoleSettings, /console) despite Virtual Host Routing intended to block access. The flaw...

CVE-2023-28345

CVE-2023-28345 affects Faronics Insight 10.0.19045 on Windows, where the Insight Teacher Console exposes the teacher’s password in cleartext via a localhost API endpoint. An attacker with physical access can open a browser, access the endpoint, and obtain the password, enabling login to the Teach...

CVE-2023-28349

CVE-2023-28349 affects Faronics Insight on Windows (v10.0.19045). A crafted program that mimics the Teacher Console can cause Student Consoles to connect and, with NT AUTHORITY/SYSTEM permissions, write arbitrary files to arbitrary locations, enabling remote code execution. The vulnerability aris...

CVE-2023-28351

An issue was discovered in Faronics Insight 10.0.19045 on Windows. Every keystroke made by any user on a computer with the Student application installed is logged to a world-readable directory. A local attacker can trivially extract these cleartext keystrokes, potentially enabling them to obtain...

CVE-2023-28352

An issue was discovered in Faronics Insight 10.0.19045 on Windows. By abusing the Insight UDP broadcast discovery system, an attacker-controlled artificial Student Console can connect to and attack a Teacher Console even after Enhanced Security Mode has been enabled...