多款ZOHO ManageEngine产品安全漏洞

ZOHO ManageEngine ADAudit Plus and ZOHO ManageEngine Access Manager Plus are both products of ZOHO, Inc. ZOHO ManageEngine ADAudit Plus is designed to simplify auditing, prove compliance and detect threats. zoho ManageEngine Access Manager Plus is a privileged session management solution for...

[SECURITY] Fedora 36 Update: rust-sequoia-octopus-librnp-1.4.1-2.fc36

Reimplementation of RNP's interface using Sequoia for use with Thunderbird...

CVE-2022-24187

The userid and deviceid on the Ourphoto App version 1.4.1 /device/ end-points both suffer from insecure direct object reference vulnerabilities. Other end-users userid and deviceid values can be enumerated by incrementing or decrementing id numbers. The impact of this vulnerability allows an...

CVE-2022-24190

The /device/acceptBind end-point for Ourphoto App version 1.4.1 does not require authentication or authorization. The usertoken header is not implemented or present on this end-point. An attacker can send a request to bind their account to any users picture frame, then send a POST request to acce...

CVE-2022-24187

The userid and deviceid on the Ourphoto App version 1.4.1 /device/ end-points both suffer from insecure direct object reference vulnerabilities. Other end-users userid and deviceid values can be enumerated by incrementing or decrementing id numbers. The impact of this vulnerability allows an...

Authentication flaw

The /device/acceptBind end-point for Ourphoto App version 1.4.1 does not require authentication or authorization. The usertoken header is not implemented or present on this end-point. An attacker can send a request to bind their account to any users picture frame, then send a POST request to acce...

Design/Logic Flaw

The userid and deviceid on the Ourphoto App version 1.4.1 /device/ end-points both suffer from insecure direct object reference vulnerabilities. Other end-users userid and deviceid values can be enumerated by incrementing or decrementing id numbers. The impact of this vulnerability allows an...

PT-2022-16531 · Unknown · Ourphoto App

Name of the Vulnerable Software and Affected Versions: Ourphoto App version 1.4.1 Description: The issue concerns the "/device/acceptBind" end-point, which does not require authentication or authorization. Specifically, the user token header is not implemented or present on this end-point. This...

Shenzhen Fujia Technology OurPhoto 安全漏洞

Shenzhen Fujia Technology OurPhoto is a cloud photo frame software from Shenzhen Fujia Technology, China. It allows you to share photos and video files directly on your cell phone. A security vulnerability exists in Shenzhen Fujia Technology OurPhoto version 1.4.1 that stems from the usertoken...

PT-2022-16529 · Unknown · Ourphoto App

Name of the Vulnerable Software and Affected Versions: Ourphoto App version 1.4.1 Description: The issue concerns the improper implementation of the user token authorization header on the /apiv1/ API endpoints. This allows an attacker to bypass authorization and session management by removing the...

PT-2022-16527 · Unknown · Ourphoto App

Name of the Vulnerable Software and Affected Versions: Ourphoto App version 1.4.1 Description: The issue affects the /device/ end-points, where the user id and device id values suffer from insecure direct object reference vulnerabilities. An attacker can enumerate other end-users' user id and...

PT-2022-16528 · Unknown · Ourphoto App

Name of the Vulnerable Software and Affected Versions: Ourphoto App version 1.4.1 Description: The issue concerns the disclosure of clear-text password information for picture frame devices through the "/device/signin" end-point. Specifically, the deviceVideoCallPassword and mqttPassword are...

CVE-2022-36111

immudb is a database with built-in cryptographic proof and verification. In versions prior to 1.4.1, a malicious immudb server can provide a falsified proof that will be accepted by the client SDK signing a falsified transaction replacing the genuine one. This situation can not be triggered by a...

Code injection

immudb is a database with built-in cryptographic proof and verification. In versions prior to 1.4.1, a malicious immudb server can provide a falsified proof that will be accepted by the client SDK signing a falsified transaction replacing the genuine one. This situation can not be triggered by a...

CVE-2022-36111 immundb has insufficient verification of data authenticity

immudb is a database with built-in cryptographic proof and verification. In versions prior to 1.4.1, a malicious immudb server can provide a falsified proof that will be accepted by the client SDK signing a falsified transaction replacing the genuine one. This situation can not be triggered by a...

immudb 数据伪造问题漏洞

immudb is a CodeNotary open source immutable database based on zero-trust, SQL and key-value, tamper-resistant, data change history . immudb version 1.4.1 before there is a data forgery problem vulnerability , the vulnerability stems from a malicious server can provide false proof , the client SD...

CVE-2022-36111 immundb has insufficient verification of data authenticity

immudb is a database with built-in cryptographic proof and verification. In versions prior to 1.4.1, a malicious immudb server can provide a falsified proof that will be accepted by the client SDK signing a falsified transaction replacing the genuine one. This situation can not be triggered by a...

immudb 数据伪造问题漏洞

Immudb is a database with built-in cryptographic proof and authentication. A data forgery issue vulnerability exists in codenotary immudb versions prior to 1.4.1, which stems from a client SDK that does not validate the UUID and can accept any value reported by the server, which can be exploited ...

CVE-2022-39199 Lack of proper validation in immudb

immudb is a database with built-in cryptographic proof and verification. immudb client SDKs use server's UUID to distinguish between different server instance so that the client can connect to different immudb instances and keep the state for multiple servers. SDK does not validate this uuid and...

PT-2022-23200 · Immudb · Immudb

Name of the Vulnerable Software and Affected Versions: immudb versions prior to 1.4.1 Description: immudb is a database with built-in cryptographic proof and verification. A malicious immudb server can provide a falsified proof that will be accepted by the client SDK, signing a falsified...