Headwind MDM 5.22.1
Approved changes feed: RSS · Atom
cpe:2.3:a:h-mdm:headwind_mdm:5.22.1:*:*:*:*:*:*:*part: a version: 5.22.1 update: *
| Vendor | H Mdm (a5df7983-7693-50d9-a403-ba7593484f38) |
|---|---|
| Product | Headwind Mdm (3fd58ba9-b10a-566b-9edd-b9ad1a1238e2) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from NVD CPE 2.0 feed
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-47316 |
vulnerable | 2026-06-08 06:14:24.632503 |
Details available
Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control. The Web panel allows users to gain access to potentially sensitive API calls such as listing users and their data, file management API calls and audit-related API calls.
Published: 2023-11-22T00:00:00.000Z
Updated: 2024-08-02T21:09:37.365Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-47315 |
vulnerable | 2026-06-08 06:14:24.632174 |
Details available
Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control due to a hard-coded JWT Secret. The secret is hardcoded into the source code available to anyone on Git Hub. This secret is used to sign the application’s JWT token and verify the incoming user-supplied tokens.
Published: 2023-11-22T00:00:00.000Z
Updated: 2024-08-02T21:09:36.645Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-47314 |
vulnerable | 2026-06-08 06:14:24.631748 |
Details available
Headwind MDM Web panel 5.22.1 is vulnerable to cross-site scripting (XSS). The file upload function allows APK and arbitrary files to be uploaded. By exploiting this issue, attackers may upload HTML files and share the download URL pointing to these files with the victims. As the file download function returns the file in inline mode, the victim’s browser will immediately render the content of the HTML file as a web page. As a result, the uploaded client-side code will be evaluated and executed in the victim’s browser, allowing attackers to perform common XSS attacks.
Published: 2023-11-22T00:00:00.000Z
Updated: 2024-08-02T21:09:36.049Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-47313 |
vulnerable | 2026-06-08 06:14:24.631258 |
Details available
Headwind MDM Web panel 5.22.1 is vulnerable to Directory Traversal. The application uses an API call to move the uploaded temporary file to the file directory during the file upload process. This API call receives two input parameters, such as path and localPath. The first one refers to the temporary file with an absolute path without validating it. Attackers may modify this API call by referring to arbitrary files. As a result, arbitrary files can be moved to the files directory and so they can be downloaded.
Published: 2023-11-22T00:00:00.000Z
Updated: 2024-08-02T21:09:36.680Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-47312 |
vulnerable | 2026-06-08 06:14:24.630726 |
Details available
Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control due to Login Credential Leakage via Audit Entries.
Published: 2023-11-22T00:00:00.000Z
Updated: 2024-08-02T21:09:37.314Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.