Path traversal

i-doit Pro v25 and below was discovered to be vulnerable to path traversal...

CVE-2023-37755

i-doit pro 25 and below and I-doit open 25 and below are configured with insecure default administrator credentials, and there is no warning or prompt to ask users to change the default password and account name. Unauthenticated attackers can exploit this vulnerability to obtain Administrator...

CVE-2023-37755

CVE-2023-37755 affects i-doit Pro 25 and below and i-doit Open 25 and below, with insecure default administrator credentials and no user prompt to change them. Unauthenticated attackers could gain Administrator privileges and perform arbitrary system operations or cause a DoS. The connected sourc...

CVE-2023-37755: Use of Hard-coded Credentials

i-doit pro 25 and below and I-doit open 25 and below are configured with insecure default administrator credentials, and there is no warning or prompt to ask users to change the default password and account name. Unauthenticated attackers can exploit this vulnerability to obtain Administrator...

CVE-2023-37739

i-doit Pro v25 and below was discovered to be vulnerable to path traversal...

CVE-2023-37755

i-doit pro 25 and below and I-doit open 25 and below are configured with insecure default administrator credentials, and there is no warning or prompt to ask users to change the default password and account name. Unauthenticated attackers can exploit this vulnerability to obtain Administrator...

i-doit Security Vulnerabilities

i-doit is a configuration management database software from i-doit Inc. A security vulnerability exists in i-doit pro and i-doit open that stems from the use of a weak password policy when creating an administrator account, which allows an attacker to guess a user's password via a brute force...

CVE-2023-37756: Weak Password Requirements

I-doit pro 25 and below and I-doit open 25 and below employ weak password requirements for Administrator account creation. Attackers are able to easily guess users' passwords via a bruteforce attack...

CVE-2023-37739: Improper Limitation of a Pathname to a Restricted Directory

i-doit Pro v25 and below was discovered to be vulnerable to path traversal...

CVE-2023-37739

CVE-2023-37739 concerns i-doit Pro v25 and below that is vulnerable to a path traversal issue in the product. The connected sources consistently identify i-doit Pro versions prior to 26 as affected, with the root cause being a path traversal vulnerability. The practical impact noted is unauthoriz...

i-doit Trust Management Issues Vulnerabilities

i-doit is a configuration management database software from i-doit Inc. A security vulnerability exists in i-doit pro and i-doit open that stems from a security flaw in the default administrator credentials. An attacker could exploit this vulnerability to gain administrator privileges and execute...

CVE-2023-37756

CVE-2023-37756 affects i-doit Pro/Open versions 25 and below. The root cause is a weak administrator password policy that allows brute-force guessing, enabling unauthorized access. Some connected sources also describe a secondary path where a crafted plugin upload could enable remote code executi...

CVE-2023-37739

i-doit Pro v25 and below was discovered to be vulnerable to path traversal...

i-doit Path Traversal Vulnerability

i-doit is a configuration management database software from i-doit Inc. A security vulnerability exists in i-doit pro v25 and prior versions that stems from the presence of a path traversal vulnerability...

PT-2023-26085 · Unknown · I-Doit Pro

Name of the Vulnerable Software and Affected Versions: i-doit Pro versions prior to v26 Description: The issue is related to path traversal. Recommendations: For versions prior to v26, update to a version above v25 to resolve the issue...

Exploit for Weak Password Requirements in I-Doit

CVE-2023-37756 – Weak Password Requirement in admin-center lea...

CVE-2023-34830

i-doit Open v24 was discovered to contain a reflected cross-site scripting XSS vulnerability via the timeout parameter on the login page...

CVE-2023-34830

i-doit Open v24 was discovered to contain a reflected cross-site scripting XSS vulnerability via the timeout parameter on the login page...

Cross site scripting

i-doit Open v24 was discovered to contain a reflected cross-site scripting XSS vulnerability via the timeout parameter on the login page...

CVE-2023-34830: Improper Neutralization of Input During Web Page Generation

i-doit Open v24 was discovered to contain a reflected cross-site scripting XSS vulnerability via the timeout parameter on the login page...