CVE-2023-47312

Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control due to Login Credential Leakage via Audit Entries...

CVE-2023-47312

Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control due to Login Credential Leakage via Audit Entries...

Cross site scripting

Headwind MDM Web panel 5.22.1 is vulnerable to cross-site scripting XSS. The file upload function allows APK and arbitrary files to be uploaded. By exploiting this issue, attackers may upload HTML files and share the download URL pointing to these files with the victims. As the file download...

Hardcoded credentials

Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control due to a hard-coded JWT Secret. The secret is hardcoded into the source code available to anyone on Git Hub. This secret is used to sign the application’s JWT token and verify the incoming user-supplied tokens...

CVE-2023-47315

Headwind MDM Web panel 5.22.1 is affected by CVE-2023-47315 due to a hard-coded JWT secret that signs and verifies tokens, enabling Incorrect Access Control. The secret is embedded in the source, which is publicly accessible, allowing token forgery or tampering. Impact is described as high (CVSS ...

CVE-2023-47313

The CVE-2023-47313 entry concerns Headwind MDM Web panel 5.22.1, which is vulnerable to directory traversal. The issue arises in an API call used during file uploads to move the temporary file into the file directory; the inputs include path and localPath, and the first parameter is an absolute p...

Headwind MDM Trust Management Issue Vulnerabilities

Headwind MDM is a platform for managing Android devices in the enterprise. A trust management issue vulnerability exists in Headwind MDM Web panel version 5.22.1, which stems from the use of hardcoding in JWT Secret, resulting in an access control error...

CVE-2023-47314

Headwind MDM Web panel version 5.22.1 is affected by a cross-site scripting (XSS) vulnerability arising from the file upload feature, which allows APK and arbitrary files to be uploaded. The vulnerability enables an attacker to upload HTML files and share a download URL; because the file is serve...

CVE-2023-47313

Headwind MDM Web panel 5.22.1 is vulnerable to Directory Traversal. The application uses an API call to move the uploaded temporary file to the file directory during the file upload process. This API call receives two input parameters, such as path and localPath. The first one refers to the...

Headwind MDM Cross-Site Scripting Vulnerability

Headwind MDM is a platform for managing Android devices in an organization. A cross-site scripting vulnerability exists in Headwind MDM Web panel version 5.22.1, which stems from unrestricted file uploads...

PT-2023-9023 · Headwind · Headwind Mdm Web Panel

Name of the Vulnerable Software and Affected Versions: Headwind MDM Web panel version 5.22.1 Description: The issue is related to the use of hard-coded credentials in the JWT Secret Handler component of the Headwind MDM software. This allows a remote attacker to gain access to credentials by...

Headwind MDM Path Traversal Vulnerability

Headwind MDM is a platform for managing Android devices in your organization. A path traversal vulnerability exists in Headwind MDM Web panel version 5.22.1. An attacker can exploit this vulnerability to read arbitrary files on the server running the application...

CVE-2023-47312

CVE-2023-47312 affects Headwind MDM Web panel 5.22.1. The issue is incorrect access control arising from login credential leakage via audit entries, enabling potential elevation of access or disclosure. Root cause details in connected sources indicate credential leakage within audit records as th...

Headwind MDM Security Vulnerability

Headwind MDM is a platform for managing Android devices in your organization. A security vulnerability exists in Headwind MDM Web panel version 5.22.1, which stems from a credential leak leading to an access control error...

CVE-2023-47316

Headwind MDM Web panel 5.22.1 is affected by CVE-2023-47316 due to Incorrect Access Control. The vulnerability enables access to sensitive API calls (e.g., listing users and their data, file management APIs, audit-related APIs). Connected sources corroborate the affected product and issue type bu...

Headwind MDM Security Vulnerability

Headwind MDM is a platform for managing Android devices in your organization. A security vulnerability exists in Headwind MDM Web panel version 5.22.1 that stems from incorrect access control...

Bosch ctrlX HMI Web Panel WR21 Security Vulnerability

Bosch ctrlX HMI Web Panel WR21 is an HMI panel from Bosch Germany. A security vulnerability exists in Bosch ctrlX HMI Web Panel WR21 that originates from allowing an unprivileged attacker to modify sensitive settings of the Android Agent application...

Bosch ctrlX HMI Web Panel WR21 Security Vulnerability

Bosch ctrlX HMI Web Panel WR21 is an HMI panel from Bosch Germany. A security vulnerability exists in the Bosch ctrlX HMI Web Panel WR21 version that originates from allowing an Android Agent application to retrieve sensitive information using the HTTP protocol, which could allow an attacker to...

Bosch ctrlX HMI Web Panel WR21 Access Control Error Vulnerability

Bosch ctrlX HMI Web Panel WR21 is an HMI panel from Bosch Germany. A security vulnerability exists in the Bosch ctrlX HMI Web Panel WR21 version that originates from a vulnerability that allows an unprivileged attacker with privileged access to the TPC-110W device subnet to gain root privileges a...

Bosch ctrlX HMI Web Panel Trust Management Issue Vulnerability

Bosch ctrlX HMI Web Panel WR21 is an HMI panel from Bosch Germany. The ctrlX HMI Web Panel WR21 version suffers from a security vulnerability that originates from a security flaw in the Android Agent application, which allows an attacker to take control of the network of a malicious MQTT agent...