Cross site request forgery (csrf)

Sewio’s Real-Time Location System RTLS Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to cross-site request forgery in its monitor services. An attacker could take advantage of this vulnerability to execute arbitrary maintenance operations and cause a denial-of-service...

CVE-2022-47917

Sewio RTLS Studio (2.0.0–2.6.2) is affected by CVE-2022-47917 due to improper input validation across multiple modules and services. The root cause allows an attacker to delete arbitrary files and cause a denial-of-service condition. Mitigation: upgrade to RTLS Studio 3.0.0 or later (requires log...

CVE-2022-47917 CVE-2022-47917

Sewio’s Real-Time Location System RTLS Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to improper input validation of user input to several modules and services of the software. This could allow an attacker to delete arbitrary files and cause a denial-of-service condition...

CVE-2022-47911 CVE-2022-47911

Sewio’s Real-Time Location System RTLS Studio version 2.0.0 up to and including version 2.6.2 does not properly validate the input module name to the backup services of the software. This could allow a remote attacker to access sensitive functions of the application and execute arbitrary system...

CVE-2022-47911

Sewio RTLS Studio (versions 2.0.0–2.6.2) is affected by CVE-2022-47911 due to improper validation of the input module name for backup services, which could allow a remote attacker to access sensitive functions and execute arbitrary system commands. That vulnerability is one of several exposed in ...

CVE-2022-47395 CVE-2022-47395

Sewio’s Real-Time Location System RTLS Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to cross-site request forgery in its monitor services. An attacker could take advantage of this vulnerability to execute arbitrary maintenance operations and cause a denial-of-service...

CVE-2022-47395

Sewio RTLS Studio vulnerable to CSRF in monitor services (versions 2.0.0–2.6.2). The issue allows an attacker to perform arbitrary maintenance operations, potentially triggering a denial-of-service. CVSS 3.1 base score 8.1 (CON: None, I/H; A/H) per NVD/CISA metrics; attack vector network, user in...

CVE-2022-46733 CVE-2022-46733

Sewio’s Real-Time Location System RTLS Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to cross-site scripting in its backup services. An attacker could take advantage of this vulnerability to execute arbitrary commands...

CVE-2022-46733

Sewio RTLS Studio, versions 2.0.0 through 2.6.2, are vulnerable to cross-site scripting in the backup services. The issue stems from improper handling of backup data, enabling an attacker to execute arbitrary commands. Practical impact is arbitrary command execution via the backup functionality. ...

CVE-2022-45444

Sewio RTLS Studio

CVE-2022-45444 CVE-2022-45444

Sewio’s Real-Time Location System RTLS Studio version 2.0.0 up to and including version 2.6.2 contains hard-coded passwords for select users in the application’s database. This could allow a remote attacker to login to the database with unrestricted access...

CVE-2022-45127 CVE-2022-45127

Sewio’s Real-Time Location System RTLS Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to cross-site request forgery in its backup services. An attacker could take advantage of this vulnerability to execute arbitrary backup operations and cause a denial-of-service condition...

CVE-2022-45127

CVE-2022-45127 affects Sewio’s RTLS Studio, version 2.0.0 through 2.6.2. The vulnerability is a cross-site request forgery (CSRF) in the backup services, enabling an attacker to trigger arbitrary backup operations and cause a denial-of-service condition. The issue is documented across multiple so...

CVE-2022-43483 CVE-2022-43483

Sewio’s Real-Time Location System RTLS Studio version 2.0.0 up to and including version 2.6.2 does not properly validate the input module name to the monitor services of the software. This could allow a remote attacker to access sensitive functions of the application and execute arbitrary system...

CVE-2022-43483

Sewio RTLS Studio 2.0.0–2.6.2 is vulnerable due to improper input validation of the module name in monitor services, enabling OS command execution. CVE-2022-43483 (OS command injection) is among several vulnerabilities in the same family affecting RTLS Studio 2.0.0–2.6.2, including CVEs 47911, 45...

CVE-2022-43455

Sewio RTLS Studio versions 2.0.0–2.6.2 are affected by improper input validation in the service_start, service_stop, and service_restart modules, enabling an attacker to start, stop, or restart arbitrary services on the server. Affected products: RTLS Studio; root cause: input validation flaw in ...

CVE-2022-43455 CVE-2022-43455

Sewio’s Real-Time Location System RTLS Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to improper input validation of user input to the servicestart, servicestop, and servicerestart modules of the software. This could allow an attacker to start, stop, or restart arbitrary...

CVE-2022-41989

Sewio RTLS Studio (Sewio RTLS Studio) versions 2.0.0 through 2.6.2 are affected by an out-of-bounds write vulnerability caused by lack of validation of the length of RTLS report payloads during communication. This could allow an attacker to send an excessively long payload, leading to denial-of-s...

CVE-2022-41989 CVE-2022-41989

Sewio’s Real-Time Location System RTLS Studio version 2.0.0 up to and including version 2.6.2 does not validate the length of RTLS report payloads during communication. This allows an attacker to send an exceedingly long payload, resulting in an out-of-bounds write to cause a denial-of-service...

Sewio Real-Time Location System (RTLS) Studio 跨站脚本漏洞

Sewio Real-Time Location System RTLS Studio is a real-time location system from Sewio, Inc. A cross-site scripting vulnerability exists in Sewio's Real-Time Location System RTLS Studio versions 2.0.0 through 2.6.2, which stems from a backup service that is vulnerable to cross-site scripting. An...