CVE-2016-6547

The Zizai Tech Nut mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file...

CVE-2016-6548

The Zizai Tech Nut mobile app makes requests via HTTP instead of HTTPS. These requests contain the user's authenticated session token with the URL. An attacker can capture these requests and reuse the session token to gain full access the user's account...

CVE-2016-6549

The Zizai Tech Nut device allows unauthenticated Bluetooth pairing, which enables unauthenticated connected applications to write data to the device name attribute...

CVE-2016-6548 Zizai Tech Nut mobile application makes requests using HTTP, which includes the users session token

The Zizai Tech Nut mobile app makes requests via HTTP instead of HTTPS. These requests contain the user's authenticated session token with the URL. An attacker can capture these requests and reuse the session token to gain full access the user's account...

CVE-2016-6547

The CVE-2016-6547 issue affects the Zizai Tech Nut mobile app, where the account password used to authenticate to the cloud API is stored in cleartext in the cache.db file. This creates a local information exposure risk, enabling a user with access to the device to retrieve sensitive credentials....

CVE-2016-6549

The CVE-2016-6549 entry concerns the Zizai Tech Nut device, where unauthenticated Bluetooth pairing enables unauthenticated connected applications to write data to the device name attribute. Affected component is the Nut device’s Bluetooth pairing/authentication logic, with impact limited to mani...

CVE-2016-6548

The CVE-2016-6548 entry concerns the Zizai Tech Nut mobile app, where HTTP requests leak the user’s authenticated session token in the URL. This exposes the session token to network-level observers, enabling potential account takeover since the token can be reused to access the user’s account. Th...

CVE-2016-6549 Zizai Tech Nut allows for unauthenticated Bluetooth pairing

The Zizai Tech Nut device allows unauthenticated Bluetooth pairing, which enables unauthenticated connected applications to write data to the device name attribute...

CVE-2016-6547 Zizai Tech Nut stores the account password in cleartext

The Zizai Tech Nut mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file...

CVE-2016-6549: Missing Authentication for Critical Function

The Zizai Tech Nut device allows unauthenticated Bluetooth pairing, which enables unauthenticated connected applications to write data to the device name attribute...

CVE-2016-6547: Cleartext Storage in a File or on Disk

The Zizai Tech Nut mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file...

PT-2018-4948

Name of the Vulnerable Software and Affected Versions Zizai Tech Nut mobile app affected versions not specified Description The issue concerns the storage of account passwords in cleartext within the cache.db file of the app, which is used for authentication to the cloud API. Recommendations At t...

CVE-2016-6548: Exposure of Sensitive Information to an Unauthorized Actor

The Zizai Tech Nut mobile app makes requests via HTTP instead of HTTPS. These requests contain the user's authenticated session token with the URL. An attacker can capture these requests and reuse the session token to gain full access the user's account...

PT-2018-4949

Name of the Vulnerable Software and Affected Versions Zizai Tech Nut mobile app affected versions not specified Description The issue concerns the Zizai Tech Nut mobile app making requests via HTTP instead of HTTPS, which includes the user's authenticated session token in the URL. This allows an...

PT-2018-4950

Name of the Vulnerable Software and Affected Versions Zizai Tech Nut device affected versions not specified Description The issue allows unauthenticated Bluetooth pairing, enabling unauthenticated connected applications to write data to the device name attribute. Recommendations At the moment,...

Zizai Tech Nut Design Vulnerability

Zizai Tech Nut is a Nut smart finder and anti-loss patch product from China's Zizai Tech. Zizai Tech Nut allows unauthorized pairing of Bluetooth devices, which can be exploited by a remote attacker to submit a special request to write data to the device name attribute...

Zizai Tech Nut Plaintext Password Vulnerability

Zizai Tech Nut is a Nut smart finder and anti-loss patch product from China's Zizai Tech. Zizai Tech Nut stores passwords in plaintext. A remote attacker could exploit this vulnerability to track a user's location...

Zizai Tech Nut contains multiple vulnerabilities

Overview Zizai Tech Nut contains multiple vulnerabilities including sensitive information exposure and missing authentication. Description CWE-313: Cleartext Storage in a File or on Disk - CVE-2016-6547The Nut mobile app stores the account password used to authenticate to the cloud API in...

The vulnerability of the Gentoo Linux operating system allows a malicious intruder to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the nut package up to version 2.6.3 of the Gentoo Linux operating system can lead to violations of confidentiality, integrity, and accessibility of protected information. This vulnerability can be exploited remotely...

openSUSE Security Update : nut (openSUSE-SU-2012:1069-1)

The nut upsd is prone to multiple flaws that allow remote attackers to cause a denial of service application crash by sending unexpected data. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update...