Ublsoftware ResIOT 跨站脚本漏洞

Ublsoftware ResIOT is a web server and IoT platform from Italian company ResIOT. A security vulnerability exists in Ublsoftware ResIOT versions prior to 4.1.1000114, which stems from an attacker being able to implement multiple cross-site scripts via form fields...

CVE-2022-35134

Boodskap IoT Platform v4.4.9-02 contains a cross-site scripting XSS vulnerability...

CVE-2022-34022: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in ResIOT IOT Platform + LoRaWAN Network Server through 4.1.1000114 via a crafted POST request to /ResiotQueryDBActive...

CVE-2022-34021

Multiple Cross Site Scripting XSS vulnerabilities in ResIOT IOT Platform + LoRaWAN Network Server through 4.1.1000114 via the form fields...

CVE-2022-34022

SQL injection vulnerability in ResIOT IOT Platform + LoRaWAN Network Server through 4.1.1000114 via a crafted POST request to /ResiotQueryDBActive...

CVE-2022-35136: Missing Authentication for Critical Function

Boodskap IoT Platform v4.4.9-02 allows attackers to make unauthenticated API requests...

CVE-2022-34020: Cross-Site Request Forgery (CSRF)

Cross Site Request Forgery CSRF vulnerability in ResIOT ResIOT IOT Platform + LoRaWAN Network Server through 4.1.1000114 allows attackers to add new admin users to the platform or other unspecified impacts...

CVE-2022-35134

The CVE-2022-35134 case concerns Boodskap IoT Platform v4.4.9-02, with a cross-site scripting (XSS) vulnerability in the web application. The connected documents identify the affected product/version and attribute the root cause to insufficient input validation and output cleanup across multiple ...

PT-2022-21973 · Unknown · Resiot Iot Platform +1

Name of the Vulnerable Software and Affected Versions: ResIOT IOT Platform + LoRaWAN Network Server versions through 4.1.1000114 Description: The issue is related to a SQL injection vulnerability. It can be exploited via a crafted POST request to the "/ResiotQueryDBActive" API endpoint. This allo...

CVE-2022-31861

Cross site Scripting XSS in ThingsBoard IoT Platform through 3.3.4.1 via a crafted value being sent to the audit logs...

CVE-2022-31861

Cross site Scripting XSS in ThingsBoard IoT Platform through 3.3.4.1 via a crafted value being sent to the audit logs...

Cross site scripting

Cross site Scripting XSS in ThingsBoard IoT Platform through 3.3.4.1 via a crafted value being sent to the audit logs...

CVE-2022-31861

CVE-2022-31861 is an XSS vulnerability in ThingsBoard IoT Platform up to version 3.3.4.1, exploitable by sending a crafted value to audit logs. Root cause involves unsanitized input in audit-logging paths, enabling cross-site scripting. Affected product/versions are ThingsBoard IoT Platform befor...

CVE-2022-31861

Cross site Scripting XSS in ThingsBoard IoT Platform through 3.3.4.1 via a crafted value being sent to the audit logs...

CVE-2022-31861

Cross site Scripting XSS in ThingsBoard IoT Platform through 3.3.4.1 via a crafted value being sent to the audit logs...

CVE-2022-31861: Improper Neutralization of Input During Web Page Generation

Cross site Scripting XSS in ThingsBoard IoT Platform through 3.3.4.1 via a crafted value being sent to the audit logs...

PT-2022-20962 · Unknown · Thingsboard Iot Platform

Name of the Vulnerable Software and Affected Versions: ThingsBoard IoT Platform versions prior to 3.3.4.1 Description: The issue is related to Cross Site Scripting XSS in the ThingsBoard IoT Platform. It occurs when a crafted value is sent to the audit logs, potentially allowing malicious actions...

CVE-2021-41278

EdgeX Foundry CVE-2021-41278 affects the app-functions-sdk-go (and related EdgeX components) where the AES transform is broken in encryption, allowing potential decryption of data for users who enable AES in their pipelines. Affected releases rely on a flawed AES implementation; the AES transform...

Cisco Talos finds 10 vulnerabilities in Azure Sphere’s Linux kernel, Security Monitor and Pluton

By Claudio Bozzato and Lilith --;. Following our previous engagements see blog posts 1, 2, 3 and 4 with Microsoft's Azure Sphere IoT platform, we decided to take another look at the device, without all the rush and commotion that normally entails a hacking challenge. Today, we’re... This is only...

The vulnerability of the `parser_parse_try_statement_end` function in the `js-parser-statm.c` component of the JavaScript engine for Thingscript and the IoT.js platform, related to the insufficient use of the `assert()` function, allows a attacker to cause a service failure.

The vulnerability of the parserparsetrystatementend function in the js-parser-statm.c component of the JavaScript engine for the Internet of Things, JerryScript, and the IoT.js platform is related to the insufficient use of the assert function. Exploiting this vulnerability could allow a remote...