CVE-2023-27881

CVE-2023-27881 affects PTC Vuforia Studio. Affected: Vuforia Studio (all versions prior to 9.9). Vulnerability: Unrestricted Upload of File with Dangerous Type via the Upload Resource feature allows a user to upload files to arbitrary locations on disk. Impact: potential unauthorized file placeme...

CVE-2023-31200

PTC Vuforia Studio contains a Cross-Site Request Forgery vulnerability (CVE-2023-31200): the local web app does not require a token, enabling an attacker with local access to perform CSRF or replay attacks. Affected products include Vuforia Studio prior to version 9.9. Mitigation recommended by t...

CVE-2023-29152

CVE-2023-29152 affects PTC Vuforia Studio (all versions prior to 9.9). The vulnerability stems from altering the filename parameter in a request, enabling an attacker to delete arbitrary files with the Vuforia server account’s permissions. Impact is file deletion with potential persistence risk a...

CVE-2023-29168

CVE-2023-29168 affects PTC Vuforia Studio: the local Vuforia web application does not support HTTPS and federated credentials are passed via basic authentication, exposing credentials. Affected products: Vuforia Studio all versions prior to 9.9. According to the ICS advisory, it is exploitable re...

CVE-2023-29502

CVE-2023-29502 describes a path traversal vulnerability in PTC Vuforia Studio. A user can modify the resourceDirectory attribute in the appConfig.json file before importing a project into Vuforia to point to a different path, potentially impacting file access. The vulnerability is tied to the Vuf...

CVE-2023-24476

CVE-2023-24476 affects PTC Vuforia Studio (all versions prior to 9.9 per CISA ICS bulletin). The root issue is Improper Authorization: an attacker with local access could record traffic and resend requests, bypassing server authentication for user/session validity. Documented impact focuses on lo...