CVE-2024-55040-Sensaphone-XSS

센사폰 취약점 공개 요약 2024년 9월 중순, 필자는 Sensaphone Web600 모니터링 시스템에서 여러 중간 및 낮은 심각도의 보안 문제를 식별했으며, 여기에는 시스템 설정Setup, 프로필Profile 및 영역Zone 옵션의 저장형 크로스 사이트 스크립팅XSS 취약점이 포함됩니다. 원격 인증된 공격자는 이 결함을 악용하여 Web600 대시보드의 다양한 요소에 임의의 JavaScript 페이로드를 주입할 수 있습니다. 이 문제들의 심각도는 제한적이지만, 권한이 낮은 사용자가 관리자 계정의 세션 토큰을 탈취하고 시스템 ...

EUVD-2024-54806

Malicious code in bioql PyPI...

CVE-2024-55040

Cross Site Scripting vulnerability in Sensaphone WEB600 Monitoring System v.1.6.5.H and before allows a remote attacker to execute arbitrary code via a crafted GET requests to /@.xml, placing payloads in the g7200, g7300, g4601, and g1F02 parameters...

CVE-2024-55040

Cross Site Scripting vulnerability in Sensaphone WEB600 Monitoring System v.1.6.5.H and before allows a remote attacker to execute arbitrary code via a crafted GET requests to /@.xml, placing payloads in the g7200, g7300, g4601, and g1F02 parameters...

CVE-2024-55040

Cross Site Scripting vulnerability in Sensaphone WEB600 Monitoring System v.1.6.5.H and before allows a remote attacker to execute arbitrary code via a crafted GET requests to /@.xml, placing payloads in the g7200, g7300, g4601, and g1F02 parameters...

CVE-2024-55040

Cross Site Scripting vulnerability in Sensaphone WEB600 Monitoring System v.1.6.5.H and before allows a remote attacker to execute arbitrary code via a crafted GET requests to /@.xml, placing payloads in the g7200, g7300, g4601, and g1F02 parameters...

CVE-2024-55040

CVE-2024-55040 affects Sensaphone WEB600 Monitoring System (firmware v1.6.5.H and earlier). The issue is a cross-site scripting (XSS) vulnerability that can be triggered by crafted GET requests to /@.xml, with payloads placed in parameters such as g7200, g7300, g4601, and g1F02. The concrete impa...

CVE-2024-55040

Cross Site Scripting vulnerability in Sensaphone WEB600 Monitoring System v.1.6.5.H and before allows a remote attacker to execute arbitrary code via a crafted GET requests to /@.xml, placing payloads in the g7200, g7300, g4601, and g1F02 parameters...

PT-2025-5686 · Sensaphone · Sensaphone Web600

Name of the Vulnerable Software and Affected Versions: Sensaphone Web600 affected versions not specified Description: The issue concerns stored cross-site scripting XSS in the system's Setup, Profile, and Zone options. This means that an attacker could potentially inject malicious code into these...