Subnet Solutions Inc. PowerSYSTEM Center
Successful exploitation of these vulnerabilities could result in an attacker bypassing a proxy, creating a denial-of-service condition, or viewing sensitive information.
beschreibt (3)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-45857US | medium6.5 | Exploit | ||
An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any… | ||||
| CVE-2021-3749US | high7.5 | Exploit | ||
axios is vulnerable to Inefficient Regular Expression Complexity | ||||
| CVE-2020-28168US | medium5.9 | — | ||
Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- ICS Advisory ICSA-24-277-02 JSONself
- Recommended Practicesexternal
- ICSA Advisory ICSA-24-277-02 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
Behebungen (6)
- MitigationPowerSYSTEM Center
For all vulnerabilities, users can disable usage of previous UI extensions.
- MitigationPowerSYSTEM Center
For all vulnerabilities, users can disable usage of previous UI extensions.
- MitigationPowerSYSTEM Center
For all vulnerabilities, users can disable usage of previous UI extensions.
- BehobenPowerSYSTEM Center
For CVE-2020-28168 and CVE-2023-45857, users can limit outbound connection requests from the PowerSYSTEM Center security zone to external websites.
- BehobenPowerSYSTEM Center
For CVE-2020-28168 and CVE-2023-45857, users can limit outbound connection requests from the PowerSYSTEM Center security zone to external websites.
- BehobenPowerSYSTEM Center
For CVE-2023-45857 and CVE-2021-3749, users can disable PowerSYSTEM Center Client Access Server user's ability to access the browser's F12 Developer Tools to limit user ability to see HTTP headers and corresponding XSRF-TOKEN, and to manipulate requests to the PowerSYSTEM Center website.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan