LG LED Assistant - Unauthenticated Password Reset

The /api/changePw endpoint in LG LED Assistant allows unauthenticated password resets when requests are considered to come from localhost. An attacker can spoof the X-Forwarded-For header with value 127.0.0.1 to trigger the behavior and receive a success response. id: CVE-2024-2862 info: name: LG...

LG LED Assistant - Thumbnail Path Traversal File Upload

A path traversal vulnerability exists in the endpoint handler for /api/thumbnail in Common.js. An unauthenticated remote attacker can exploit this to upload arbitrary files to any location on the disk drive where the product is installed. id: CVE-2024-2863 info: name: LG LED Assistant - Thumbnail...

VulnCheck KEV: CVE-2024-2862

This vulnerability allows remote attackers to reset the password of anonymous users without authorization on the affected LG LED Assistant...

VulnCheck KEV: CVE-2024-2863

This vulnerability allows remote attackers to traverse paths via file upload on the affected LG LED Assistant...

CVE-2024-2862

This vulnerability allows remote attackers to reset the password of anonymous users without authorization on the affected LG LED Assistant...

EUVD-2023-54466

Malicious code in bioql PyPI...

EUVD-2023-54469

Malicious code in bioql PyPI...

EUVD-2023-54467

Malicious code in bioql PyPI...

EUVD-2023-54468

Malicious code in bioql PyPI...

CVE-2024-2863

This vulnerability allows remote attackers to traverse paths via file upload on the affected LG LED Assistant...

CVE-2023-4616

This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG LED Assistant. Authentication is not required to exploit this vulnerability. The specific flaw exists within the /api/thumbnail endpoint. The issue results from the lack of proper validati...

CVE-2024-2863

This vulnerability allows remote attackers to traverse paths via file upload on the affected LG LED Assistant...

CVE-2024-2863

This vulnerability allows remote attackers to traverse paths via file upload on the affected LG LED Assistant...

CVE-2024-2862

This vulnerability allows remote attackers to reset the password of anonymous users without authorization on the affected LG LED Assistant...

CVE-2024-2862

This vulnerability allows remote attackers to reset the password of anonymous users without authorization on the affected LG LED Assistant...

CVE-2024-2863 Path traversal via file upload on LG LED Assistant

This vulnerability allows remote attackers to traverse paths via file upload on the affected LG LED Assistant...

CVE-2024-2863 Path traversal via file upload on LG LED Assistant

This vulnerability allows remote attackers to traverse paths via file upload on the affected LG LED Assistant...

CVE-2024-2862 Password reset vulnerability without authorization on LG LED Assistant

This vulnerability allows remote attackers to reset the password of anonymous users without authorization on the affected LG LED Assistant...

CVE-2024-2862 Password reset vulnerability without authorization on LG LED Assistant

This vulnerability allows remote attackers to reset the password of anonymous users without authorization on the affected LG LED Assistant...

CVE-2024-2862

LG LED Assistant exposes an unauthenticated password-reset vulnerability (CVE-2024-2862). The Nuclei template details an endpoint: /api/changePw that accepts requests from localhost and can be triggered by spoofing X-Forwarded-For: 127.0.0.1 to obtain a success response, enabling password resets ...