Control Id Idsecure vulnerabilities
7 known vulnerabilities in Control Id Idsecure from Assaabloy. 7 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.1 Critical severity
iDSecure On-premises: Improper Neutralization of Special Elements used in an SQL Command
ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to SQL injections which could allow an attacker to leak arbitrary information and insert arbitrary SQL syntax into SQL queries.
- 7.5 High severity
iDSecure On-premises: Server-Side Request Forgery
ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to a server-side request forgery vulnerability which could allow an unauthenticated attacker to retrieve information from other servers.
- 9.8 Critical severity
iDSecure On-premises: Improper Authentication
ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to an improper authentication vulnerability which could allow an attacker to bypass authentication and gain permissions in the product.
- 9.8 Critical severity
Control Id Idsecure: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing unauthenticated attackers to write PHP files on the server's root directory, resulting in remote code execution.
- 9.8 Critical severity
Control Id Idsecure: Use of Hard-coded Credentials
Control ID IDSecure 4.7.26.0 and prior uses a hardcoded cryptographic key in order to sign and verify JWT session tokens, allowing attackers to sign arbitrary session tokens and bypass authentication.
- 7.5 High severity
Control Id Idsecure: Improper Handling of Exceptional Conditions
An uncaught exception vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing attackers to cause the main web server of IDSecure to fault and crash, causing a denial of service.
- 9.1 Critical severity
Control Id Idsecure: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing attackers to delete arbitrary files on IDSecure filesystem, causing a denial of service.