EUVD-2022-34482

Malicious code in bioql PyPI...

CVE-2022-2199 ICSA-22-200-01 MiCODUS MV720 GPS tracker Cross-site Scripting

The main MiCODUS MV720 GPS tracker web server has a reflected cross-site scripting vulnerability that could allow an attacker to gain control by tricking a user into making a request...

CVE-2022-34150 ICSA-22-200-01 MiCODUS MV720 GPS tracker Authorization Bypass Through User-Controlled Key

The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object reference vulnerability on endpoint and parameter device IDs, which accept arbitrary device IDs without further verification...

PT-2022-21930

Name of the Vulnerable Software and Affected Versions MiCODUS MV720 GPS tracker affected versions not specified Description The main web server of the MiCODUS MV720 GPS tracker has an authenticated insecure direct object references issue. This issue is related to an endpoint and the POST paramete...

PT-2022-22024

Name of the Vulnerable Software and Affected Versions MiCODUS MV720 GPS tracker affected versions not specified Description The main web server of the MiCODUS MV720 GPS tracker has an authenticated insecure direct object reference issue. This issue is related to the endpoint and parameter device...

PT-2022-15205

Name of the Vulnerable Software and Affected Versions MiCODUS MV720 GPS tracker affected versions not specified Description The main web server of the MiCODUS MV720 GPS tracker has a reflected cross-site scripting issue. This could allow an attacker to gain control by tricking a user into making ...

CVE-2022-2107: Use of Hard-coded Credentials

The MiCODUS MV720 GPS tracker API server has an authentication mechanism that allows devices to use a hard-coded master password. This may allow an attacker to send SMS commands directly to the GPS tracker as if they were coming from the GPS owner’s mobile number...

CVE-2022-33944: Authorization Bypass Through User-Controlled Key

The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object references vulnerability on endpoint and POST parameter “Device ID,” which accepts arbitrary device IDs...

CVE-2022-2141: Improper Authentication

SMS-based GPS commands can be executed by MiCODUS MV720 GPS tracker without authentication...

CVE-2022-2199: Improper Neutralization of Input During Web Page Generation

The main MiCODUS MV720 GPS tracker web server has a reflected cross-site scripting vulnerability that could allow an attacker to gain control by tricking a user into making a request...

CVE-2022-34150: Authorization Bypass Through User-Controlled Key

The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object reference vulnerability on endpoint and parameter device IDs, which accept arbitrary device IDs without further verification...

MiCODUS MV720 GPS tracker

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: MiCODUS Equipment: MV720 GPS tracker Vulnerabilities: Use of Hard-coded Credentials, Improper Authentication, Cross-site Scripting, Authorization Bypass Through User-controlled Key 2. UPDATE OR REPOSTED...