CVE-2023-28657

Improper access control vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. A user of the PC where the affected product is installed may gain an administrative privilege. As a result, information regarding the product may be obtained and/or altered by the user.

• CWE-862

• https://jvn.jp/en/vu/JVNVU93372935/Third Party Advisory
• https://www.contec.com/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_chs_230531_en.pdfVendor Advisory
• https://www.contec.com/jp/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_chs_230531_jp.pdfVendor Advisory
• https://jvn.jp/en/vu/JVNVU93372935/Third Party Advisory
• https://www.contec.com/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_chs_230531_en.pdfVendor Advisory
• https://www.contec.com/jp/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_chs_230531_jp.pdfVendor Advisory

Published

Jun 1, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-28651Cross-site scripting vulnerability exists in CONPROSYS HMI S…4.8
• CVE-2023-28652An authenticated malicious user could successfully upload a …6.5
• CVE-2023-28653 The affected application lacks proper valid…7.8
• CVE-2023-28654Osprey Pump Controller version 1.01 has a hidden administrat…9.8
• CVE-2023-28655A malicious user could leverage this vulnerability to escala…5.4
• CVE-2023-28656NGINX Management Suite may allow an authenticated attacker t…8.1
• CVE-2023-28658Insecure inherited permissions in some Intel(R) oneMKL softw…7.8
• CVE-2023-28659The Waiting: One-click Countdowns WordPress Plugin, version …8.8
• CVE-2023-2866 If an attacker can trick an authenticated user into loading…7.8
• CVE-2023-28660The Events Made Easy WordPress Plugin, version <= 2.3.14 is …8.8
• CVE-2023-28661The WP Popup Banners WordPress Plugin, version <= 1.2.5, is …8.8
• CVE-2023-28662The Gift Cards (Gift Vouchers and Packages) WordPress Plugin…9.8