EUVD-2023-51439

Malicious code in bioql PyPI...

CVE-2023-47312

Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control due to Login Credential Leakage via Audit Entries...

Hardcoded credentials

Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control due to a hard-coded JWT Secret. The secret is hardcoded into the source code available to anyone on Git Hub. This secret is used to sign the application’s JWT token and verify the incoming user-supplied tokens...

PT-2023-30409

Name of the Vulnerable Software and Affected Versions Headwind MDM Web panel version 5.22.1 Description The issue is related to Incorrect Access Control due to Login Credential Leakage via Audit Entries. This allows unauthorized access to sensitive information. Recommendations For Headwind MDM We...

PT-2023-30412

Name of the Vulnerable Software and Affected Versions Headwind MDM Web panel version 5.22.1 Description The issue allows users to gain access to potentially sensitive API calls, including listing users and their data, file management API calls, and audit-related API calls, due to incorrect access...

PT-2023-30410

Name of the Vulnerable Software and Affected Versions Headwind MDM Web panel version 5.22.1 Description The issue allows for Directory Traversal, where the application's API call to move uploaded temporary files to the file directory during the file upload process is vulnerable. This API call use...

CVE-2023-47314: Improper Neutralization of Input During Web Page Generation

Headwind MDM Web panel 5.22.1 is vulnerable to cross-site scripting XSS. The file upload function allows APK and arbitrary files to be uploaded. By exploiting this issue, attackers may upload HTML files and share the download URL pointing to these files with the victims. As the file download...

CVE-2023-47313

Headwind MDM Web panel 5.22.1 is vulnerable to Directory Traversal. The application uses an API call to move the uploaded temporary file to the file directory during the file upload process. This API call receives two input parameters, such as path and localPath. The first one refers to the...

CVE-2023-47313: Improper Limitation of a Pathname to a Restricted Directory

Headwind MDM Web panel 5.22.1 is vulnerable to Directory Traversal. The application uses an API call to move the uploaded temporary file to the file directory during the file upload process. This API call receives two input parameters, such as path and localPath. The first one refers to the...