CVE-2023-45596

A CWE-425 “Direct Request 'Forced Browsing'” vulnerability in the “fileconfiguration” functionality of the web application allows a remote unauthenticated attacker to access confidential configuration files. This issue affects: AiLux imx6 bundle below version imx61.0.7-2...

CVE-2023-45595

A CWE-434 “Unrestricted Upload of File with Dangerous Type” vulnerability in the “fileconfiguration” functionality of the web application allows a remote authenticated attacker to upload any arbitrary type of file into the device. This issue affects: AiLux imx6 bundle below version imx61.0.7-2...

CVE-2023-45595

A CWE-434 “Unrestricted Upload of File with Dangerous Type” vulnerability in the “fileconfiguration” functionality of the web application allows a remote authenticated attacker to upload any arbitrary type of file into the device. This issue affects: AiLux imx6 bundle below version imx61.0.7-2...

CVE-2023-45595

The CVE-2023-45595 entry documents a CWE-434 vulnerability in the AiLux imx6 bundle’s file_configuration functionality, allowing a remote authenticated attacker to upload arbitrary file types to the device. Affected product: AiLux imx6 bundle prior to version imx6_1.0.7-2. Root cause: Unrestricte...

CVE-2023-45593

A CWE-184 “Incomplete List of Disallowed Inputs” vulnerability in the embedded Chromium browser concerning the handling of alternative URLs, other than “ http://localhost” allows a physical attacker to read arbitrary files on the file system, alter the configuration of the embedded browser, and...

CVE-2023-45593

A CWE-184 “Incomplete List of Disallowed Inputs” vulnerability in the embedded Chromium browser concerning the handling of alternative URLs, other than “ http://localhost” allows a physical attacker to read arbitrary files on the file system, alter the configuration of the embedded browser, and...

CVE-2023-45592

CVE-2023-45592 affects AiLux imx6 bundle, with the vulnerable component being the embedded Chromium browser operated with the --no-sandbox option under root privileges. The root cause is execution with unnecessary privileges, which could exacerbate impact from attacks against the embedded browser...

CVE-2023-45591

A CWE-122 “Heap-based Buffer Overflow” vulnerability in the “loggergeneric” function of the “Axrtu” binary allows a remote authenticated attacker to trigger a memory corruption in the context of the binary. This may result in a Denial-of-Service DoS condition, possibly in the execution of arbitra...

CVE-2023-45591

A CWE-122 “Heap-based Buffer Overflow” vulnerability in the “loggergeneric” function of the “Axrtu” binary allows a remote authenticated attacker to trigger a memory corruption in the context of the binary. This may result in a Denial-of-Service DoS condition, possibly in the execution of arbitra...

CVE-2023-5456

A CWE-798 “Use of Hard-coded Credentials” vulnerability in the MariaDB database of the web application allows a remote unauthenticated attacker to access the database service and all included data with the same privileges of the web application. This issue affects: AiLux imx6 bundle below version...

CVE-2023-5456

A CWE-798 “Use of Hard-coded Credentials” vulnerability in the MariaDB database of the web application allows a remote unauthenticated attacker to access the database service and all included data with the same privileges of the web application. This issue affects: AiLux imx6 bundle below version...

CVE-2023-5457

A CWE-1269 “Product Released in Non-Release Configuration” vulnerability in the Django web framework used by the web application due to the “debug” configuration parameter set to “True” allows a remote unauthenticated attacker to access critical information and have other unspecified impacts to t...

CVE-2023-5457

A CWE-1269 “Product Released in Non-Release Configuration” vulnerability in the Django web framework used by the web application due to the “debug” configuration parameter set to “True” allows a remote unauthenticated attacker to access critical information and have other unspecified impacts to t...

CVE-2023-5457

CVE-2023-5457 is a CWE-1269 issue in the Django-based application where debug=True in Django causes exposure of sensitive information. It affects AiLux imx6 bundle prior to version imx6_1.0.7-2. Root cause: non-release configuration leaking data. Impact: confidentiality, integrity, and availabili...

CVE-2023-5456

CVE-2023-5456 is a CWE-798 vulnerability affecting AiLux imx6 bundle prior to version imx6_1.0.7-2. The issue arises from hard-coded credentials in the MariaDB database used by the web application, enabling a remote unauthenticated attacker to access the database service and all data with the web...

PT-2024-13264 · Unknown · Ailux Imx6 Bundle

Name of the Vulnerable Software and Affected Versions: AiLux imx6 bundle versions prior to imx6 1.0.7-2 Description: A CWE-613 “Insufficient Session Expiration” issue in the web application exists due to the session cookie sessionid lasting two weeks, which facilitates session hijacking attacks...

PT-2024-13258 · Google · Chromium

Name of the Vulnerable Software and Affected Versions: AiLux imx6 bundle versions prior to imx6 1.0.7-2 Description: A CWE-552 vulnerability in the embedded Chromium browser allows a physical attacker to arbitrarily download or upload files to or from the file system. This issue has unspecified...

PT-2024-13260 · Unknown · Ailux Imx6 Bundle

Name of the Vulnerable Software and Affected Versions: AiLux imx6 bundle versions prior to imx6 1.0.7-2 Description: A vulnerability in the file configuration functionality of the web application allows a remote unauthenticated attacker to access confidential configuration files. The issue is...

PT-2024-13263 · Ailux · Ailux Imx6 Bundle

Name of the Vulnerable Software and Affected Versions: AiLux imx6 bundle versions prior to imx6 1.0.7-2 Description: A CWE-646 issue in the "iec61850" functionality of the web application allows a remote authenticated attacker to upload any arbitrary type of file into the device. Recommendations:...

AiLux imx6 Security Vulnerability

AiLux imx6 is a computing module from AiLux. A security vulnerability exists in versions prior to AiLux imx6 bundle imx61.0.7-2, which originates from a hole that allows a physical attacker to arbitrarily download/upload files from/to the file system, with unspecified impact on the confidentialit...