CVE-2022-34150

CVE-2022-34150 affects the MiCODUS MV720 GPS tracker Web server and is an authenticated insecure direct object reference vulnerability on endpoints/parameters for device IDs, enabling an attacker with basic access to manipulate device IDs without further verification (authorization bypass). Publi...

CVE-2022-34150 ICSA-22-200-01 MiCODUS MV720 GPS tracker Authorization Bypass Through User-Controlled Key

The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object reference vulnerability on endpoint and parameter device IDs, which accept arbitrary device IDs without further verification...

CVE-2022-34150 ICSA-22-200-01 MiCODUS MV720 GPS tracker Authorization Bypass Through User-Controlled Key

The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object reference vulnerability on endpoint and parameter device IDs, which accept arbitrary device IDs without further verification...

Unpatched GPS Tracker Bugs Could Let Attackers Disrupt Vehicles Remotely — The Hacker News

The U.S. Cybersecurity and Infrastructure Security Agency CISA is warning of a handful of unpatched security vulnerabilities in MiCODUS MV720 Global Positioning System GPS trackers outfitted in over 1.5 million vehicles that could lead to remote disruption of critical operations. "Successful...

PT-2022-14952 · Micodus · Micodus Mv720 Gps Tracker

Name of the Vulnerable Software and Affected Versions: MiCODUS MV720 GPS tracker affected versions not specified Description: The issue allows SMS-based GPS commands to be executed by the MiCODUS MV720 GPS tracker without requiring authentication. Recommendations: At the moment, there is no...

PT-2022-14860 · Micodus · Micodus Mv720

Name of the Vulnerable Software and Affected Versions: MiCODUS MV720 GPS tracker affected versions not specified Description: The MiCODUS MV720 GPS tracker API server has an authentication mechanism that allows devices to use a hard-coded master password. This may allow an attacker to send SMS...

MiCODUS MV720 GPS 安全漏洞

The MiCODUS MV720 GPS is a GPS tracker from MiCODUS USA. A security vulnerability exists in the MiCODUS MV720 GPS that originates from an authenticated and insecure direct object reference vulnerability in the main web server on the endpoint and parameterized device IDs, which accepts arbitrary...

MiCODUS MV720 GPS tracker

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: MiCODUS Equipment: MV720 GPS tracker Vulnerabilities: Use of Hard-coded Credentials, Improper Authentication, Cross-site Scripting, Authorization Bypass Through User-controlled Key 2. UPDATE OR REPOSTED...

CISA released Security Advisory on MiCODUS MV720 Global Positioning System (GPS) Tracker

CISA has released an Industrial Controls Systems Advisory ICSA detailing six vulnerabilities that were discovered in MiCODUS MV720 Global Positioning System Tracker. Successful exploitation of these vulnerabilities may allow a remote actor to exploit access and gain control the global positioning...

MiCODUS MV720 GPS 安全漏洞

MiCODUS MV720 GPS is a GPS tracker from MiCODUS Corporation. A security vulnerability exists in the MiCODUS MV720 GPS tracker that originates from an authenticated, insecure direct object reference vulnerability in the main web server on the endpoint and POST parameter "Device ID" that accepts an...

CVE-2021-32927

An attacker may be able to inject client-side JavaScript code on multiple instances within all versions of Uffizio GPS Tracker...

CVE-2021-32929

All versions of Uffizio GPS Tracker may allow an attacker to perform unintended actions on behalf of a user...

Code injection

All versions of Uffizio GPS Tracker may allow an attacker to perform unintended actions on behalf of a user...

CVE-2021-32927 Uffizio GPS Tracker Cross-site Scripting

An attacker may be able to inject client-side JavaScript code on multiple instances within all versions of Uffizio GPS Tracker...

CVE-2021-32927 Uffizio GPS Tracker Cross-site Scripting

An attacker may be able to inject client-side JavaScript code on multiple instances within all versions of Uffizio GPS Tracker...

CVE-2021-32927

CVE-2021-32927 affects all versions of Uffizio GPS Tracker and is described as a Cross-Site Scripting vulnerability (CWE-79) caused by improper neutralization of input during web page generation. The issue enables an attacker to inject client-side JavaScript into multiple instances, potentially e...

CVE-2021-32929 Uffizio GPS Tracker Cross-site Request Forgery

All versions of Uffizio GPS Tracker may allow an attacker to perform unintended actions on behalf of a user...

CVE-2021-32929

CVE-2021-32929 affects all versions of Uffizio GPS Tracker and is described as a Cross-site Request Forgery (CSRF) vulnerability that lets an attacker perform unintended actions on behalf of an authenticated user. The Red Hat/ICS/CVE ecosystem and CVE records corroborate that this vulnerability e...

CVE-2021-32929 Uffizio GPS Tracker Cross-site Request Forgery

All versions of Uffizio GPS Tracker may allow an attacker to perform unintended actions on behalf of a user...

Uffizio GPS Tracker

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Uffizio Equipment: GPS Tracker Vulnerabilities: Improper Access Control, Unrestricted Upload of File with Dangerous Type, Open Redirect, Cross-site Scripting, Cross-site Request Forgery 2. RISK...