HOMEVULNERABILITIESVENDORSKonzept-ix

Konzept-ixCVEs & Vulnerabilities

5 CVEs affecting Konzept-ix products, tracked from the National Vulnerability Database, with CVSS/EPSS scores and exploitation status.

5 CVEs→ All vendors

Most Affected Products

publixone 5
CVE-2020-27183CRITICAL

A RemoteFunctions endpoint with missing access control in konzept-ix publiXone before 2020.015 allows attackers to disclose sensitive user information, send arbitrary e-mails, escalate the privileges of arbitrary user accounts, and have unspecified other impact.

27 Oct 2020
9.8
CVSS
CVE-2020-27182MEDIUM

Multiple cross-site scripting (XSS) vulnerabilities in konzept-ix publiXone before 2020.015 allow remote attackers to inject arbitrary JavaScript or HTML via appletError.jsp, job_jacket_detail.jsp, ixedit/editor_component.jsp, or the login form.

27 Oct 2020
6.1
CVSS
CVE-2020-27181MEDIUM

A hardcoded AES key in CipherUtils.java in the Java applet of konzept-ix publiXone before 2020.015 allows attackers to craft password-reset tokens or decrypt server-side configuration files.

27 Oct 2020
6.5
CVSS
CVE-2020-27180HIGH

konzept-ix publiXone before 2020.015 allows attackers to download files by iterating over the IXCopy fileID parameter.

27 Oct 2020
7.5
CVSS
CVE-2020-27179CRITICAL

konzept-ix publiXone before 2020.015 allows attackers to take over arbitrary user accounts by crafting password-reset tokens.

27 Oct 2020
9.8
CVSS
← PrevPage 1 / 1Next →
← All Vendors·CVE Database