CVE-2023-28353

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An issue was discovered in Faronics Insight 10.0.19045 on Windows. An unauthenticated attacker is able to upload any type of file to any location on the Teacher Console's computer, enabling a variety of different exploitation paths including code execution. It is also possible for the attacker to chain this vulnerability with others to cause a deployed DLL file to immediately execute as NT AUTHORITY/SYSTEM.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: May 31, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-283549.8An issue was discovered in Opsview Monitor Agent 6.8. An unauthenticated remote attacker can call check_nrpe against affected targets, speci CVE-2023-283567.5A vulnerability has been identified where a maliciously crafted message containing a specific chain of characters can cause the chat to ente CVE-2023-283574.3A vulnerability has been identified in Rocket.Chat, where the ACL checks in the Slash Command /mute occur after checking whether a user is a CVE-2023-283586.1A vulnerability has been discovered in Rocket.Chat where a markdown parsing issue in the "Search Messages" feature allows the insertion of m CVE-2023-283595.3A NoSQL injection vulnerability has been identified in the listEmojiCustom method call within Rocket.Chat. This can be exploited by unauthen CVE-2023-28364.8The CRM Perks Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form settings in versions up to, and including, 1.CVE-2023-283604.3An omission of security-relevant information vulnerability exists in Brave desktop prior to version 1.48.171 when a user was saving a file t CVE-2023-283616.5A Cross-site WebSocket Hijacking (CSWSH) vulnerability found in UniFi OS 2.5 and earlier allows a malicious actor to access certain confiden CVE-2023-283624.0The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in th CVE-2023-283646.1An Open Redirect vulnerability exists prior to version 1.52.117, where the built-in QR scanner in Brave Browser Android navigated to scanned CVE-2023-283659.1A backup file vulnerability found in UniFi applications (Version 7.3.83 and earlier) running on Linux operating systems allows application a CVE-2023-283667.5The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2