Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2635▼ 211 respecto a la semana anterior
Críticas / altas1376▲ 147 respecto a la semana anterior
Nueva explotación activa (KEV)7▼ 3 respecto a la semana anterior
Sin puntuar (sin CVSS)81▼ 449 respecto a la semana anterior
6 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Modificada | Alta (8) | 0.24% | — | PTC Vuforia Studio | 7/6/2023 | 17/6/2026 | PTC Vuforia Studio does not require a token; this could allow an attacker with local access to perform a cross-site request forgery attack or a replay attack. | |
| Modificada | Media (4.3) | 0.50% | — | PTC Vuforia Studio | 7/6/2023 | 17/6/2026 | Before importing a project into Vuforia, a user could modify the “resourceDirectory” attribute in the appConfig.json file to be a different path. | |
| Modificada | Alta (7.5) | 0.47% | — | PTC Vuforia Studio | 7/6/2023 | 17/6/2026 | The local Vuforia web application does not support HTTPS, and federated credentials are passed via basic authentication. | |
| Modificada | Alta (8.1) | 0.45% | — | PTC Vuforia Studio | 7/6/2023 | 17/6/2026 | By changing the filename parameter in the request, an attacker could delete any file with the permissions of the Vuforia server account. | |
| Modificada | Crítica (9.9) | 0.66% | — | PTC Vuforia Studio | 7/6/2023 | 17/6/2026 | A user could use the “Upload Resource” functionality to upload files to any location on the disk. | |
| Modificada | Baja (3.3) | 0.13% | — | PTC Vuforia Studio | 7/6/2023 | 17/6/2026 | An attacker with local access to the machine could record the traffic, which could allow them to resend requests without the server authenticating that the user or session are valid. |