Vendor
Tobit Laboratories
22 known vulnerabilities.
Products
7 results · Clear filters · Feed
-
High 8.8
TeamDavid: Weak Cryptography and Insecure Password Storage
Use of hard-coded cryptographic key vulnerability in Tobit Laboratories AG TeamDavid's Webbox. For users created locally in David, passwords are stored in various files using only obfuscation. Any user with access to the server’s file system, or who can other…
-
High 8.9
TeamDavid: Buffer Overflow in 'editini' function
Tobit Laboratories AG TeamDavid's Webbox application handles password changes using a function triggered by including the string "(editini)" in the file path, writing the new password to the specified "Archive.ini" file. However, the application does not veri…
-
High 8.5
TeamDavid: Arbitrary File Write leading to Stored XSS
Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to arbitrary file write, allowing an unauthenticated attacker to create or write into existing files on the server with attacker-controlled content. This is possible because user input is writ…
-
High 7.7
TeamDavid: Server-Side Request Forgery (SSRF) via 'pathnameroot' parameter in search functionality
Tobit Laboratories AG TeamDavid's Webbox 's search functionality accepts a “pathnameroot” parameter, which can be set to network locations using UNC paths (e.g., “\\Server\Share”). The server processes these paths without validation, resulting in outbound con…
-
High 8.5
TeamDavid: Path Traversal in the archive creation functionality
Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a path traversal vulnerability in the archive creation functionality. Because the archive path is user-controlled and insufficiently validated, an attacker can manipulate the input to traverse director…
-
High 8.4
TeamDavid: Local File Inclusion via the form field 'scjob'
Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a local file inclusion vulnerability in the send email, fax, SMS, etc. functionality. By specifying an '@@attach' command in the form field 'scjob', files can be attached to a message, which can then b…
-
High 8.4
TeamDavid: Arbitrary File Deletion via form field 'scjob'
Tobit Laboratories AG TeamDavid's Webbox is vulnerable to an arbitrary file deletion vulnerability in the send email, fax, SMS, etc. functionality. By specifying an @@COMMENTFILE command in the form field scjob, any file on the system can be deleted. This iss…