CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-45892
https://notcve.org/view.php?id=CVE-2023-45892
An issue discovered in the Order and Invoice pages in Floorsight Insights Q3 2023 allows an unauthenticated remote attacker to view sensitive customer information. Un problema descubierto en las páginas de Order y Invoice en Floorsight Insights Q3 2023 permite a un atacante remoto no autenticado ver información confidencial del cliente. • https://github.com/Oracle-Security/CVEs/blob/main/FloorsightSoftware/CVE-2023-45892.md • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 3.3EPSS: 0%CPEs: 2EXPL: 1CVE-2023-28351
https://notcve.org/view.php?id=CVE-2023-28351
An issue was discovered in Faronics Insight 10.0.19045 on Windows. Every keystroke made by any user on a computer with the Student application installed is logged to a world-readable directory. A local attacker can trivially extract these cleartext keystrokes, potentially enabling them to obtain PII and/or to compromise personal accounts owned by the victim. • https://research.nccgroup.com/2023/05/30/technical-advisory-multiple-vulnerabilities-in-faronics-insight https://research.nccgroup.com/?research=Technical%20advisories • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 1CVE-2023-28349
https://notcve.org/view.php?id=CVE-2023-28349
An issue was discovered in Faronics Insight 10.0.19045 on Windows. It is possible for an attacker to create a crafted program that functions similarly to the Teacher Console. This can compel Student Consoles to connect and put themselves at risk automatically. Connected Student Consoles can be compelled to write arbitrary files to arbitrary locations on disk with NT AUTHORITY/SYSTEM level permissions, enabling remote code execution. • https://research.nccgroup.com/2023/05/30/technical-advisory-multiple-vulnerabilities-in-faronics-insight https://research.nccgroup.com/?research=Technical%20advisories • CWE-346: Origin Validation Error •
CVSS: 7.3EPSS: 0%CPEs: 2EXPL: 1CVE-2023-28346
https://notcve.org/view.php?id=CVE-2023-28346
An issue was discovered in Faronics Insight 10.0.19045 on Windows. It is possible for a remote attacker to communicate with the private API endpoints exposed at /login, /consoleSettings, /console, etc. despite Virtual Host Routing being used to block this access. Remote attackers can interact with private pages on the web server, enabling them to perform privileged actions such as logging into the console and changing console settings if they have valid credentials. • https://research.nccgroup.com/2023/05/30/technical-advisory-multiple-vulnerabilities-in-faronics-insight https://research.nccgroup.com/?research=Technical%20advisories • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 1CVE-2023-28353
https://notcve.org/view.php?id=CVE-2023-28353
An issue was discovered in Faronics Insight 10.0.19045 on Windows. An unauthenticated attacker is able to upload any type of file to any location on the Teacher Console's computer, enabling a variety of different exploitation paths including code execution. It is also possible for the attacker to chain this vulnerability with others to cause a deployed DLL file to immediately execute as NT AUTHORITY/SYSTEM. • https://research.nccgroup.com/2023/05/30/technical-advisory-multiple-vulnerabilities-in-faronics-insight https://research.nccgroup.com/?research=Technical%20advisories • CWE-434: Unrestricted Upload of File with Dangerous Type •