CVE-2023-26462

ThingsBoard 3.4.1 is affected by CVE-2023-26462 due to hard-coded service credentials stored in an insecure format. The root cause enables a remote attacker to escalate privileges, though exploitation requires access to the application server or its source code. Documents consistently describe el...

CVE-2022-48341: Improper Privilege Management

ThingsBoard 3.4.1 could allow a remote authenticated attacker to achieve Vertical Privilege Escalation. A Tenant Administrator can obtain System Administrator dashboard access by modifying the scope via the scopes parameter...

PT-2023-15717

Name of the Vulnerable Software and Affected Versions ThingsBoard version 3.4.1 Description The issue allows a remote authenticated attacker to achieve Vertical Privilege Escalation. A Tenant Administrator can obtain System Administrator dashboard access by modifying the scope via the scopes...

CVE-2023-26462

ThingsBoard 3.4.1 could allow a remote attacker to gain elevated privileges because hard-coded service credentials usable for privilege escalation are stored in an insecure format. To read this stored data, the attacker needs access to the application server or its source code...

CVE-2022-48341

ThingsBoard 3.4.1 could allow a remote authenticated attacker to achieve Vertical Privilege Escalation. A Tenant Administrator can obtain System Administrator dashboard access by modifying the scope via the scopes parameter...

CVE-2023-26462: Use of Hard-coded Credentials

ThingsBoard 3.4.1 could allow a remote attacker to gain elevated privileges because hard-coded service credentials usable for privilege escalation are stored in an insecure format. To read this stored data, the attacker needs access to the application server or its source code...

Thingsboard 跨站脚本漏洞

Thingsboard is a Java-based platform for IOT devices for monitoring, management, and data collection from the Thingsboard team. A security vulnerability exists in Thingsboard version 3.4.1, which stems from the presence of cross-site scripting XSS that allows a remote attacker to elevate privileg...

PT-2022-25162 · Unknown · Thingsboard

Name of the Vulnerable Software and Affected Versions: Things Board version 3.4.1 Description: The issue is related to a Cross Site Scripting XSS vulnerability that allows remote attackers to escalate privileges. This is achieved by crafting a URL to the Audit Log. Recommendations: For version...

CVE-2022-31861

Cross site Scripting XSS in ThingsBoard IoT Platform through 3.3.4.1 via a crafted value being sent to the audit logs...

CVE-2022-31861

Cross site Scripting XSS in ThingsBoard IoT Platform through 3.3.4.1 via a crafted value being sent to the audit logs...

Cross site scripting

Cross site Scripting XSS in ThingsBoard IoT Platform through 3.3.4.1 via a crafted value being sent to the audit logs...

CVE-2022-31861

CVE-2022-31861 is an XSS vulnerability in ThingsBoard IoT Platform up to version 3.3.4.1, exploitable by sending a crafted value to audit logs. Root cause involves unsanitized input in audit-logging paths, enabling cross-site scripting. Affected product/versions are ThingsBoard IoT Platform befor...

CVE-2022-31861

Cross site Scripting XSS in ThingsBoard IoT Platform through 3.3.4.1 via a crafted value being sent to the audit logs...

CVE-2022-31861

Cross site Scripting XSS in ThingsBoard IoT Platform through 3.3.4.1 via a crafted value being sent to the audit logs...

ThingsBoard IoT Platform 跨站脚本漏洞

ThingsBoard IoT Platform is an open source IoT platform for data collection, processing, visualization and device management from ThingsBoard, Inc. A security vulnerability exists in ThingsBoard IoT Platform versions 3.3.4.1 and earlier, which stems from the presence of cross-site scripting XSS v...

PT-2022-20962 · Unknown · Thingsboard Iot Platform

Name of the Vulnerable Software and Affected Versions: ThingsBoard IoT Platform versions prior to 3.3.4.1 Description: The issue is related to Cross Site Scripting XSS in the ThingsBoard IoT Platform. It occurs when a crafted value is sent to the audit logs, potentially allowing malicious actions...

CVE-2022-31861: Improper Neutralization of Input During Web Page Generation

Cross site Scripting XSS in ThingsBoard IoT Platform through 3.3.4.1 via a crafted value being sent to the audit logs...

CVE-2021-42751

A cross-site scripting XSS vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote attackers with administrative access to inject arbitrary JavaScript within the description of a rule node...

CVE-2021-42750

A cross-site scripting XSS vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote attackers with administrative access to inject arbitrary JavaScript within the title of a rule node...

CVE-2021-42750

A cross-site scripting XSS vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote attackers with administrative access to inject arbitrary JavaScript within the title of a rule node...