CVE-2023-47312: Cleartext Storage of Sensitive Information

Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control due to Login Credential Leakage via Audit Entries...

CVE-2023-47313

Headwind MDM Web panel 5.22.1 is vulnerable to Directory Traversal. The application uses an API call to move the uploaded temporary file to the file directory during the file upload process. This API call receives two input parameters, such as path and localPath. The first one refers to the...

PT-2023-30411 · Headwind · Headwind Mdm Web Panel

Name of the Vulnerable Software and Affected Versions: Headwind MDM Web panel version 5.22.1 Description: The issue allows attackers to upload arbitrary files, including HTML files, to the server. When a victim downloads and opens one of these files, their browser renders the content as a web pag...

PT-2023-9023 · Headwind · Headwind Mdm Web Panel

Name of the Vulnerable Software and Affected Versions: Headwind MDM Web panel version 5.22.1 Description: The issue is related to the use of hard-coded credentials in the JWT Secret Handler component of the Headwind MDM software. This allows a remote attacker to gain access to credentials by...

CVE-2023-47312

CVE-2023-47312 affects Headwind MDM Web panel 5.22.1. The issue is incorrect access control arising from login credential leakage via audit entries, enabling potential elevation of access or disclosure. Root cause details in connected sources indicate credential leakage within audit records as th...

CVE-2023-47314: Improper Neutralization of Input During Web Page Generation

Headwind MDM Web panel 5.22.1 is vulnerable to cross-site scripting XSS. The file upload function allows APK and arbitrary files to be uploaded. By exploiting this issue, attackers may upload HTML files and share the download URL pointing to these files with the victims. As the file download...

CVE-2023-47313

The CVE-2023-47313 entry concerns Headwind MDM Web panel 5.22.1, which is vulnerable to directory traversal. The issue arises in an API call used during file uploads to move the temporary file into the file directory; the inputs include path and localPath, and the first parameter is an absolute p...

CVE-2023-47316: Authorization Bypass Through User-Controlled Key

Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control. The Web panel allows users to gain access to potentially sensitive API calls such as listing users and their data, file management API calls and audit-related API calls...

Headwind MDM Security Vulnerability

Headwind MDM is a platform for managing Android devices in your organization. A security vulnerability exists in Headwind MDM Web panel version 5.22.1 that stems from incorrect access control...

CVE-2023-47313: Improper Limitation of a Pathname to a Restricted Directory

Headwind MDM Web panel 5.22.1 is vulnerable to Directory Traversal. The application uses an API call to move the uploaded temporary file to the file directory during the file upload process. This API call receives two input parameters, such as path and localPath. The first one refers to the...

Headwind MDM Path Traversal Vulnerability

Headwind MDM is a platform for managing Android devices in your organization. A path traversal vulnerability exists in Headwind MDM Web panel version 5.22.1. An attacker can exploit this vulnerability to read arbitrary files on the server running the application...

CVE-2023-47315: Use of Hard-coded Credentials

Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control due to a hard-coded JWT Secret. The secret is hardcoded into the source code available to anyone on Git Hub. This secret is used to sign the application’s JWT token and verify the incoming user-supplied tokens...

Hackers Could Exploit Google Workspace and Cloud Platform for Ransomware Attacks

A set of novel attack methods has been demonstrated against Google Workspace and the Google Cloud Platform that could be potentially leveraged by threat actors to conduct ransomware, data exfiltration, and password recovery attacks. "Starting from a single compromised machine, threat actors could...

Path traversal

NCSIST ManageEngine Mobile Device ManagerMDM APP's special function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and read arbitrary system files...

Path traversal

NCSIST ManageEngine Mobile Device ManagerMDM APP's special function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and read arbitrary system files...

CVE-2023-41356

CVE-2023-41356 concerns the ManageEngine Mobile Device Manager (MDM) APP and describes a path traversal vulnerability in a special function. An unauthenticated remote attacker can bypass authentication and read arbitrary system files. The NVD entry lists a CVSSv3.1 base score of 6.5 (Medium) with...

CVE-2023-41356 WisdomGarden Tronclass ilearn - Path Traversal

NCSIST ManageEngine Mobile Device ManagerMDM APP's special function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and read arbitrary system files...

CVE-2023-41344 NCSIST ManageEngine MDM - Path Traversal

NCSIST ManageEngine Mobile Device ManagerMDM APP's special function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and read arbitrary system files...

CVE-2023-41344

CVE-2023-41344 affects NCSIST ManageEngine Mobile Device Manager (MDM) APP. The connected sources describe a path traversal vulnerability in a special function that allows an unauthenticated remote attacker to bypass authentication and read arbitrary system files. There are multiple attestations ...

CVE-2023-41344: Improper Limitation of a Pathname to a Restricted Directory

NCSIST ManageEngine Mobile Device ManagerMDM APP's special function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and read arbitrary system files...