CVE-2023-47316

Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control. The Web panel allows users to gain access to potentially sensitive API calls such as listing users and their data, file management API calls and audit-related API calls...

CVE-2023-47312

Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control due to Login Credential Leakage via Audit Entries...

CVE-2023-47313

Headwind MDM Web panel 5.22.1 is vulnerable to Directory Traversal. The application uses an API call to move the uploaded temporary file to the file directory during the file upload process. This API call receives two input parameters, such as path and localPath. The first one refers to the...

CVE-2023-47315

Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control due to a hard-coded JWT Secret. The secret is hardcoded into the source code available to anyone on Git Hub. This secret is used to sign the application’s JWT token and verify the incoming user-supplied tokens...

CVE-2023-47313

Headwind MDM Web panel 5.22.1 is vulnerable to Directory Traversal. The application uses an API call to move the uploaded temporary file to the file directory during the file upload process. This API call receives two input parameters, such as path and localPath. The first one refers to the...

Hardcoded credentials

Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control due to a hard-coded JWT Secret. The secret is hardcoded into the source code available to anyone on Git Hub. This secret is used to sign the application’s JWT token and verify the incoming user-supplied tokens...

Headwind MDM Path Traversal Vulnerability

Headwind MDM is a platform for managing Android devices in your organization. A path traversal vulnerability exists in Headwind MDM Web panel version 5.22.1. An attacker can exploit this vulnerability to read arbitrary files on the server running the application...

PT-2023-30411 · Headwind · Headwind Mdm Web Panel

Name of the Vulnerable Software and Affected Versions: Headwind MDM Web panel version 5.22.1 Description: The issue allows attackers to upload arbitrary files, including HTML files, to the server. When a victim downloads and opens one of these files, their browser renders the content as a web pag...

CVE-2023-47316

Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control. The Web panel allows users to gain access to potentially sensitive API calls such as listing users and their data, file management API calls and audit-related API calls...

CVE-2023-47312

CVE-2023-47312 affects Headwind MDM Web panel 5.22.1. The issue is incorrect access control arising from login credential leakage via audit entries, enabling potential elevation of access or disclosure. Root cause details in connected sources indicate credential leakage within audit records as th...

PT-2023-9023 · Headwind · Headwind Mdm Web Panel

Name of the Vulnerable Software and Affected Versions: Headwind MDM Web panel version 5.22.1 Description: The issue is related to the use of hard-coded credentials in the JWT Secret Handler component of the Headwind MDM software. This allows a remote attacker to gain access to credentials by...

CVE-2023-47316

Headwind MDM Web panel 5.22.1 is affected by CVE-2023-47316 due to Incorrect Access Control. The vulnerability enables access to sensitive API calls (e.g., listing users and their data, file management APIs, audit-related APIs). Connected sources corroborate the affected product and issue type bu...

CVE-2023-47313

Headwind MDM Web panel 5.22.1 is vulnerable to Directory Traversal. The application uses an API call to move the uploaded temporary file to the file directory during the file upload process. This API call receives two input parameters, such as path and localPath. The first one refers to the...

CVE-2023-47314

Headwind MDM Web panel version 5.22.1 is affected by a cross-site scripting (XSS) vulnerability arising from the file upload feature, which allows APK and arbitrary files to be uploaded. The vulnerability enables an attacker to upload HTML files and share a download URL; because the file is serve...

Headwind MDM Security Vulnerability

Headwind MDM is a platform for managing Android devices in your organization. A security vulnerability exists in Headwind MDM Web panel version 5.22.1 that stems from incorrect access control...

CVE-2023-47313

The CVE-2023-47313 entry concerns Headwind MDM Web panel 5.22.1, which is vulnerable to directory traversal. The issue arises in an API call used during file uploads to move the temporary file into the file directory; the inputs include path and localPath, and the first parameter is an absolute p...

CVE-2023-47315

Headwind MDM Web panel 5.22.1 is affected by CVE-2023-47315 due to a hard-coded JWT secret that signs and verifies tokens, enabling Incorrect Access Control. The secret is embedded in the source, which is publicly accessible, allowing token forgery or tampering. Impact is described as high (CVSS ...

Headwind MDM Trust Management Issue Vulnerabilities

Headwind MDM is a platform for managing Android devices in the enterprise. A trust management issue vulnerability exists in Headwind MDM Web panel version 5.22.1, which stems from the use of hardcoding in JWT Secret, resulting in an access control error...

Hackers Could Exploit Google Workspace and Cloud Platform for Ransomware Attacks

A set of novel attack methods has been demonstrated against Google Workspace and the Google Cloud Platform that could be potentially leveraged by threat actors to conduct ransomware, data exfiltration, and password recovery attacks. "Starting from a single compromised machine, threat actors could...

Path traversal

NCSIST ManageEngine Mobile Device ManagerMDM APP's special function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and read arbitrary system files...