CVE-2020-27182

概要

参考情報

• sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-publixone · Third Party Advisory
• seclists.org/fulldisclosure/2020/Oct/28 · Mailing List

publixone のその他の脆弱性

• CVE-2020-27183緊急 9.8A RemoteFunctions endpoint with missing access control in konzept-ix publiXone before 2020.015 allows attackers to disclose sensitive user i…
• CVE-2020-27181中 6.5A hardcoded AES key in CipherUtils.java in the Java applet of konzept-ix publiXone before 2020.015 allows attackers to craft password-reset …
• CVE-2020-27180高 7.5konzept-ix publiXone before 2020.015 allows attackers to download files by iterating over the IXCopy fileID parameter.
• CVE-2020-27179緊急 9.8konzept-ix publiXone before 2020.015 allows attackers to take over arbitrary user accounts by crafting password-reset tokens.