CVE-2023-42494

Concrete details found: EisBaer Scada is affected by CVE-2023-42494 (CWE-749: Exposed Dangerous Method or Function). The linked PT-2023-6570 entry states the issue involves dangerous methods/functions in the SCADA system and that exploitation may allow a remote attacker to execute arbitrary code;...

CVE-2023-27261 Missing Authentication In IDAttend’s IDWeb Application

Missing authentication in the DeleteAssignments method in IDAttend’s IDWeb application 3.1.052 and earlier allows deletion of data by unauthenticated attackers...

CVE-2023-27259

IDAttend IDWeb application, versions 3.1.052 and earlier, has a vulnerability in the GetAssignmentsDue method where missing authentication allows unauthenticated extraction of sensitive student and teacher data. Root cause: incomplete access control enabling data exposure. Impact: confidential da...

CVE-2023-27259 Missing Authentication In IDAttend’s IDWeb Application

Missing authentication in the GetAssignmentsDue method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction of sensitive student and teacher data by unauthenticated attackers...

CVE-2023-27256 Missing Authentication In IDAttend’s IDWeb Application

Missing authentication in the GetLogFiles method in IDAttend’s IDWeb application 3.1.052 and earlier allows retrieval of sensitive log files by unauthenticated attackers...

CVE-2023-26579 Missing Authentication In IDAttend’s IDWeb Application

Missing authentication in the DeleteStaff method in IDAttend’s IDWeb application 3.1.013 allows deletion of staff information by unauthenticated attackers...

CVE-2023-26574

CVE-2023-26574 concerns the IDAttend IDWeb application (versions 3.1.052 and earlier). The root cause is a missing authentication check in the SearchStudents method, allowing unauthenticated attackers to extract sensitive student data. Impact, per sources, is elevated by the ability to access con...

CVE-2023-26569 Unauthenticated SQL Injection In IDAttend’s IDWeb Application

Unauthenticated SQL injection in the StudentPopupDetailsTimetable method in IDAttend’s IDWeb application 3.1.052 and earlier allows extraction or modification of all data by unauthenticated attackers...

PT-2023-21036 · Idweb · Idweb

Name of the Vulnerable Software and Affected Versions: IDWeb application versions 3.1.052 and earlier Description: The issue concerns missing authentication in the GetActiveToiletPasses method, allowing unauthenticated attackers to retrieve student information. Recommendations: For versions 3.1.0...

PT-2023-21033 · Idweb · Idweb

Name of the Vulnerable Software and Affected Versions: IDWeb application versions 3.1.052 and earlier Description: The issue is related to an unauthenticated SQL injection in the GetRoomChanges method, allowing unauthenticated attackers to extract or modify all data. Recommendations: For versions...

PT-2023-20745 · Idweb · Idweb

Name of the Vulnerable Software and Affected Versions: IDWeb application version 3.1.013 Description: The issue concerns missing authentication in the DeleteStaff method, allowing unauthenticated attackers to delete staff information. Recommendations: For version 3.1.013, ensure proper...

TOTOLINK X2000R Buffer Error Vulnerability

The TOTOLINK X2000R is a wireless router from China's Gion Electronics TOTOLINK. A security vulnerability exists in the TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web version, which stems from a buffer overflow issue in the formIPv6Addr method...

TOTOLINK X6000R Command Injection Vulnerability

The TOTOLINK X6000R is a wireless router from China's Gion Electronics TOTOLINK. A security vulnerability exists in the TOTOLINK X6000R v9.4.0cu.652B20230116 version that stems from a remote command execution vulnerability in the method in the sub415498 location...

IDAttend IDWeb SQL Injection Vulnerability

IDAttend IDWeb is a web-based module from IDAttend, Inc. A security vulnerability exists in IDAttend IDWeb version 3.1.052 and prior versions, which stems from an unauthenticated SQL injection in the GetStudentInconsistencies method...

IDAttend IDWeb Access Control Error Vulnerability

IDAttend IDWeb is a web-based module from IDAttend, Inc. A security vulnerability exists in IDAttend IDWeb version 3.1.052 and prior versions, which stems from a lack of authentication in the SetDB method...

PT-2023-21083 · Idweb · Idweb

Name of the Vulnerable Software and Affected Versions: IDWeb application versions 3.1.052 and earlier Description: The issue concerns missing authentication in the StudentPopupDetails StudentDetails method, allowing unauthenticated attackers to extract sensitive student data. Recommendations: For...

PT-2023-20739 · Idweb · Idweb

Name of the Vulnerable Software and Affected Versions: IDWeb application versions 3.1.052 and earlier Description: The issue concerns missing authentication in the SetDB method, which can lead to denial of service or theft of database login credentials. Recommendations: For versions 3.1.052 and...

IDAttend IDWeb Access Control Error Vulnerability

IDAttend IDWeb is a web-based module from IDAttend, Inc. A security vulnerability exists in IDAttend IDWeb version 3.1.013 that stems from a lack of authentication in the DeleteStaff method...

PT-2023-20748 · Idweb · Idweb

Name of the Vulnerable Software and Affected Versions: IDWeb application versions 3.1.052 and earlier Description: The issue concerns an unauthenticated SQL injection in the GetVisitors method, allowing unauthenticated attackers to extract or modify all data. Recommendations: For versions 3.1.052...

PT-2023-20736 · Idweb · Idweb

Name of the Vulnerable Software and Affected Versions: IDWeb application versions 3.1.052 and earlier Description: The issue is related to missing authentication in the StudentPopupDetails Timetable method, allowing unauthenticated attackers to extract sensitive student data. Recommendations: For...