Filtered by vendor Assaabloy Subscriptions
Filtered by product Control Id Idsecure Subscriptions
Total 6 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-33371 1 Assaabloy 1 Control Id Idsecure 2024-11-21 9.8 Critical
Control ID IDSecure 4.7.26.0 and prior uses a hardcoded cryptographic key in order to sign and verify JWT session tokens, allowing attackers to sign arbitrary session tokens and bypass authentication.
CVE-2023-33370 1 Assaabloy 1 Control Id Idsecure 2024-11-21 7.5 High
An uncaught exception vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing attackers to cause the main web server of IDSecure to fault and crash, causing a denial of service.
CVE-2023-33369 1 Assaabloy 1 Control Id Idsecure 2024-11-21 9.1 Critical
A path traversal vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing attackers to delete arbitrary files on IDSecure filesystem, causing a denial of service.
CVE-2023-33368 1 Assaabloy 1 Control Id Idsecure 2024-11-21 6.5 Medium
Some API routes exists in Control ID IDSecure 4.7.26.0 and prior, exfiltrating sensitive information and passwords to users accessing these API routes.
CVE-2023-33367 1 Assaabloy 1 Control Id Idsecure 2024-11-21 9.8 Critical
A SQL injection vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing unauthenticated attackers to write PHP files on the server's root directory, resulting in remote code execution.
CVE-2023-2044 1 Assaabloy 1 Control Id Idsecure 2024-11-21 3.5 Low
A vulnerability has been found in Control iD iDSecure 4.7.29.1 and classified as problematic. This vulnerability affects unknown code of the component Dispositivos Page. The manipulation of the argument IP-DNS leads to cross site scripting. The attack can be initiated remotely. VDB-225922 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.