Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Nexo\-Os
(Bosch)| Repositories |
Unknown: This might be proprietary software. |
| #Vulnerabilities | 25 |
| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2024-01-10 | CVE-2023-48261 | The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request. | Nexo\-Os | 7.5 | ||
| 2024-01-10 | CVE-2023-48242 | The vulnerability allows an authenticated remote attacker to download arbitrary files in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request. | Nexo\-Os | 6.5 | ||
| 2024-01-10 | CVE-2023-48243 | The vulnerability allows a remote attacker to upload arbitrary files in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request. By abusing this vulnerability, it is possible to obtain remote code execution (RCE) with root privileges on the device. | Nexo\-Os | 8.8 | ||
| 2024-01-10 | CVE-2023-48245 | The vulnerability allows an unauthenticated remote attacker to upload arbitrary files under the context of the application OS user (“root”) via a crafted HTTP request. | Nexo\-Os | 9.8 | ||
| 2024-01-10 | CVE-2023-48244 | The vulnerability allows a remote attacker to inject and execute arbitrary client-side script code inside a victim’s session via a crafted URL or HTTP request. | Nexo\-Os | 6.1 | ||
| 2024-01-10 | CVE-2023-48246 | The vulnerability allows a remote attacker to download arbitrary files in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request. | Nexo\-Os | 6.5 | ||
| 2024-01-10 | CVE-2023-48247 | The vulnerability allows an unauthenticated remote attacker to read arbitrary files under the context of the application OS user (“root”) via a crafted HTTP request. | Nexo\-Os | 7.5 | ||
| 2024-01-10 | CVE-2023-48248 | The vulnerability allows an authenticated remote attacker to upload a malicious file to the SD card containing arbitrary client-side script code and obtain its execution inside a victim’s session via a crafted URL, HTTP request, or simply by waiting for the victim to view the poisoned file. | Nexo\-Os | 5.4 | ||
| 2024-01-10 | CVE-2023-48249 | The vulnerability allows an authenticated remote attacker to list arbitrary folders in all paths of the system under the context of the application OS user (“root”) via a crafted HTTP request. By abusing this vulnerability, it is possible to steal session cookies of other active users. | Nexo\-Os | 6.5 | ||
| 2024-01-10 | CVE-2023-48250 | The vulnerability allows a remote attacker to authenticate to the web application with high privileges through multiple hidden hard-coded accounts. | Nexo\-Os | 9.8 |