VS
Product
Vuforia Studio
6
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 1High 3Medium 1Low 1
Watch
Add Vuforia Studio to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-27881 | 9.9 | Jun 7 | A user could use the “Upload Resource” functionality to upload files to any location on the disk Affected: before 9.9 |
| CVE-2023-29152 | 8.1 | Jun 7 | By changing the filename parameter in the request, an attacker could delete any file with the permissions of the Vuforia server account Affected: before 9.9 |
| CVE-2023-31200 | 8.0 | Jun 7 | PTC Vuforia Studio does not require a token; this could allow an attacker with local access to perform a cross-site request forgery attack or a replay attack Affected: before 9.9 |
| CVE-2023-29168 | 7.5 | Jun 7 | The local Vuforia web application does not support HTTPS, and federated credentials are passed via basic authentication Affected: before 9.9 |
| CVE-2023-29502 | 4.3 | Jun 7 | Before importing a project into Vuforia, a user could modify the “resourceDirectory” attribute in the appConfig.json file to be a different path Affected: before 9.9 |
| CVE-2023-24476 | 3.3 | Jun 7 | An attacker with local access to the machine could record the traffic, which could allow them to resend requests without the server authenticating that the user or session are… Affected: before 9.9 |
Showing 6