CVE-2023-41966

Summary of CVE-2023-41966 (Sielco hardware): Privilege escalation in Sielco Analog FM Transmitters and Radio Link devices via HTTP POST that sets a parameter, enabling a user with read permissions to elevate privileges (Write/Admin). Affected versions span multiple revisions including 2.12 EXC500...

CVE-2023-45228 Sielco Radio Link and Analog FM Transmitters Improper Access Control

The application suffers from improper access control when editing users. A user with read permissions can manipulate users, passwords, and permissions by sending a single HTTP POST request with modified parameters...

CVE-2023-45228 Sielco Radio Link and Analog FM Transmitters Improper Access Control

The application suffers from improper access control when editing users. A user with read permissions can manipulate users, passwords, and permissions by sending a single HTTP POST request with modified parameters...

CVE-2023-45228

CVE-2023-45228 concerns improper access control in Sielco Analog FM Transmitters/Radio Link devices. A user with read permissions can manipulate users, passwords and permissions by sending a single HTTP POST with modified parameters, potentially escalating privileges or altering admin credentials...

CVE-2023-45228: Improper Access Control

The application suffers from improper access control when editing users. A user with read permissions can manipulate users, passwords, and permissions by sending a single HTTP POST request with modified parameters...

PT-2023-28196 · Sielco · Analog Fm Transmitter +12

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The application suffers from a privilege escalation issue. A user with read permissions can elevate privileges by sending a HTTP POST to set a parameter...

PT-2023-29464 · Sielco · Analog Fm Transmitter +12

Name of the Vulnerable Software and Affected Versions: Application affected versions not specified Description: The application has an issue with improper access control when editing users. A user with read permissions can manipulate users, passwords, and permissions by sending a single HTTP POST...

CVE-2023-41966: Privilege Defined With Unsafe Actions

The application suffers from a privilege escalation vulnerability. A user with read permissions can elevate privileges by sending a HTTP POST to set a parameter...

Path Traversal

github.com/arduino/arduino-create-agent is vulnerable to Directory Traversal. When the attacker has access to the localhost interface, they can send a specially crafted HTTP POST request to the /v2/pkgs/tools/installed endpoint, specifying the path of the file or folder that they want to delete...

CVE-2023-43802

Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint /upload which handles request with the filename parameter. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can...

CVE-2023-43800 Insufficient Verification of Data Authenticity in Arduino Create Agent

Arduino Create Agent is a package to help manage Arduino development. The vulnerability affects the endpoint /v2/pkgs/tools/installed. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can escalate his privileges to those ...

CVE-2023-43800

Arduino Create Agent is a package to help manage Arduino development. The vulnerability affects the endpoint "/v2/pkgs/tools/installed". A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can escalate his privileges to thos...

CVE-2023-43800 Insufficient Verification of Data Authenticity in Arduino Create Agent

Arduino Create Agent is a package to help manage Arduino development. The vulnerability affects the endpoint /v2/pkgs/tools/installed. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can escalate his privileges to those ...

CVE-2023-43802 Path traversal in Arduino Create Agent

Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint /upload which handles request with the filename parameter. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can...

CVE-2023-43802

Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint "/upload" which handles request with the "filename" parameter. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration,...

CVE-2023-43803

Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint "/v2/pkgs/tools/installed" and the way it handles plugin names supplied as user input. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass...

Arduino Create Agent path traversal - local privilege escalation vulnerability

Impact The vulnerability affects the endpoint /upload which handles request with the filename parameter. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can escalate his privileges to those of the user running the Arduin...

CVE-2023-43803: Improper Limitation of a Pathname to a Restricted Directory

Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint /v2/pkgs/tools/installed and the way it handles plugin names supplied as user input. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass t...

CVE-2023-43800: Insufficient Verification of Data Authenticity

Arduino Create Agent is a package to help manage Arduino development. The vulnerability affects the endpoint /v2/pkgs/tools/installed. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuration, can escalate his privileges to those ...

Arduino Data Forgery Issue Vulnerability

Arduino is a microcontroller board from the Arduino project. A security vulnerability exists in Arduino Create Agent versions prior to 1.3.2, which stems from a security hole in the /v2/pkgs/tools/installed endpoint. An attacker can exploit this vulnerability to bypass CORS configuration and...