CVE-2020-27181: Use of Hard-coded Credentials

A hardcoded AES key in CipherUtils.java in the Java applet of konzept-ix publiXone before 2020.015 allows attackers to craft password-reset tokens or decrypt server-side configuration files...

CVE-2020-27183: Undefined Security Weakness

A RemoteFunctions endpoint with missing access control in konzept-ix publiXone before 2020.015 allows attackers to disclose sensitive user information, send arbitrary e-mails, escalate the privileges of arbitrary user accounts, and have unspecified other impact...

PT-2020-16652

Name of the Vulnerable Software and Affected Versions konzept-ix publiXone versions prior to 2020.015 Description The issue concerns a hardcoded AES key in the Java applet of the affected software. This hardcoded key allows attackers to craft password-reset tokens or decrypt server-side...

PT-2020-16654

Name of the Vulnerable Software and Affected Versions konzept-ix publiXone versions prior to 2020.015 Description The issue is related to a RemoteFunctions endpoint with missing access control, allowing attackers to disclose sensitive user information, send arbitrary e-mails, escalate the...

PT-2020-16653

Name of the Vulnerable Software and Affected Versions konzept-ix publiXone versions prior to 2020.015 Description The issue allows remote attackers to inject arbitrary JavaScript or HTML, which can be achieved via several endpoints, including "appletError.jsp", "job jacket detail.jsp",...

PT-2020-16651

Name of the Vulnerable Software and Affected Versions konzept-ix publiXone versions prior to 2020.015 Description The issue allows attackers to download files by iterating over the fileID parameter in the IXCopy function. This could potentially lead to unauthorized access to sensitive information...

CVE-2020-27182: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in konzept-ix publiXone before 2020.015 allow remote attackers to inject arbitrary JavaScript or HTML via appletError.jsp, jobjacketdetail.jsp, ixedit/editorcomponent.jsp, or the login form...

PT-2020-16650

Name of the Vulnerable Software and Affected Versions konzept-ix publiXone versions prior to 2020.015 Description The issue allows attackers to take over arbitrary user accounts by crafting password-reset tokens. Recommendations For versions prior to 2020.015, update to version 2020.015 or later ...