CVE-2023-26462

ThingsBoard 3.4.1 could allow a remote attacker to gain elevated privileges because hard-coded service credentials usable for privilege escalation are stored in an insecure format. To read this stored data, the attacker needs access to the application server or its source code...

CVE-2022-48341

ThingsBoard 3.4.1 could allow a remote authenticated attacker to achieve Vertical Privilege Escalation. A Tenant Administrator can obtain System Administrator dashboard access by modifying the scope via the scopes parameter...

Thingsboard 安全漏洞

Thingsboard is a Java-based platform for monitoring, management, and data collection of IOT devices from the Thingsboard team. A security vulnerability exists in Thingsboard version 3.4.1, which stems from the fact that a tenant administrator can modify the scope of the scopes parameter to gain...

CVE-2023-26462

ThingsBoard 3.4.1 is affected by CVE-2023-26462 due to hard-coded service credentials stored in an insecure format. The root cause enables a remote attacker to escalate privileges, though exploitation requires access to the application server or its source code. Documents consistently describe el...

Thingsboard 信任管理问题漏洞

Thingsboard is a Java-based platform for IOT devices for monitoring, management, and data collection from the Thingsboard team. A security vulnerability exists in ThingsBoard version 3.4.1, which stems from hard-coded service credentials stored in an insecure format that can be exploited by an...

CVE-2022-48341

ThingsBoard 3.4.1 contains a vertical privilege escalation vulnerability where a remote authenticated tenant administrator can gain access to the System Administrator dashboard by modifying the scope parameter (scopes). The issue is triggered by scope manipulation and could allow access to higher...

CVE-2023-26462

ThingsBoard 3.4.1 could allow a remote attacker to gain elevated privileges because hard-coded service credentials usable for privilege escalation are stored in an insecure format. To read this stored data, the attacker needs access to the application server or its source code...

CVE-2022-48341

ThingsBoard 3.4.1 could allow a remote authenticated attacker to achieve Vertical Privilege Escalation. A Tenant Administrator can obtain System Administrator dashboard access by modifying the scope via the scopes parameter...

CVE-2022-48341

ThingsBoard 3.4.1 could allow a remote authenticated attacker to achieve Vertical Privilege Escalation. A Tenant Administrator can obtain System Administrator dashboard access by modifying the scope via the scopes parameter...

Thingsboard 跨站脚本漏洞

Thingsboard is a Java-based platform for IOT devices for monitoring, management, and data collection from the Thingsboard team. A security vulnerability exists in Thingsboard version 3.4.1, which stems from the presence of cross-site scripting XSS that allows a remote attacker to elevate privileg...

PT-2022-25162 · Unknown · Thingsboard

Name of the Vulnerable Software and Affected Versions: Things Board version 3.4.1 Description: The issue is related to a Cross Site Scripting XSS vulnerability that allows remote attackers to escalate privileges. This is achieved by crafting a URL to the Audit Log. Recommendations: For version...

CVE-2022-31861

Cross site Scripting XSS in ThingsBoard IoT Platform through 3.3.4.1 via a crafted value being sent to the audit logs...

CVE-2022-31861

Cross site Scripting XSS in ThingsBoard IoT Platform through 3.3.4.1 via a crafted value being sent to the audit logs...

Cross site scripting

Cross site Scripting XSS in ThingsBoard IoT Platform through 3.3.4.1 via a crafted value being sent to the audit logs...

CVE-2022-31861

CVE-2022-31861 is an XSS vulnerability in ThingsBoard IoT Platform up to version 3.3.4.1, exploitable by sending a crafted value to audit logs. Root cause involves unsanitized input in audit-logging paths, enabling cross-site scripting. Affected product/versions are ThingsBoard IoT Platform befor...

CVE-2022-31861

Cross site Scripting XSS in ThingsBoard IoT Platform through 3.3.4.1 via a crafted value being sent to the audit logs...

CVE-2022-31861

Cross site Scripting XSS in ThingsBoard IoT Platform through 3.3.4.1 via a crafted value being sent to the audit logs...

ThingsBoard IoT Platform 跨站脚本漏洞

ThingsBoard IoT Platform is an open source IoT platform for data collection, processing, visualization and device management from ThingsBoard, Inc. A security vulnerability exists in ThingsBoard IoT Platform versions 3.3.4.1 and earlier, which stems from the presence of cross-site scripting XSS v...

PT-2022-20962 · Unknown · Thingsboard Iot Platform

Name of the Vulnerable Software and Affected Versions: ThingsBoard IoT Platform versions prior to 3.3.4.1 Description: The issue is related to Cross Site Scripting XSS in the ThingsBoard IoT Platform. It occurs when a crafted value is sent to the audit logs, potentially allowing malicious actions...

CVE-2021-42751

A cross-site scripting XSS vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote attackers with administrative access to inject arbitrary JavaScript within the description of a rule node...