The External Visitor Manager portal of HID’s SAFE versions 5.8.0 through 5.11.3 are vulnerable to manipulation within web fields in the application programmable interface (API). An attacker could log in using account credentials available through a request generated by an internal user and then manipulate the visitor-id within the web API to access the personal data of other users. There is no limit on the number of requests that can be made to the HID SAFE Web Server, so an attacker could also exploit this vulnerability to create a denial-of-service condition.
oryginał ENCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:HHidglobal Safe
APPHidglobal5.8.0 – 5.11.3
Powiązane podatności
An unauthenticated attacker can update the hostname with a specially crafted name that will allow for shell co...
An unauthenticated attacker can send a specially crafted update file to the device that can overflow a buffer....
An authenticated attacker can upload a file with a filename including “..” and “/” to achieve the ability to u...
HID OMNIKEY 5427 and OMNIKEY 5127 readers are vulnerable to CSRF when using the EEM driver (Ethernet Emulation...
An unauthenticated attacker could arbitrarily upload firmware files to the target device, ultimately causing a...