CVE-2022-2930

Unverified Password Change in GitHub repository octoprint/octoprint prior to 1.8.3...

CVE-2022-2930

Unverified Password Change in GitHub repository octoprint/octoprint prior to 1.8.3...

PYSEC-2022-43142

Unverified Password Change in GitHub repository octoprint/octoprint prior to 1.8.3...

PYSEC-2022-43142

Unverified Password Change in GitHub repository octoprint/octoprint prior to 1.8.3...

CVE-2022-2930 Unverified Password Change in octoprint/octoprint

Unverified Password Change in GitHub repository octoprint/octoprint prior to 1.8.3...

CVE-2022-2930

Affected software: OctoPrint (octoprint/octoprint) prior to version 1.8.3. Root cause: unverified password change flow that allowed a password change without requiring the current password, enabling potential account compromise. Impact: high confidentiality, integrity, and availability risks as d...

OctoPrint 安全漏洞

OctoPrint is an application. that provides a fast web interface for controlling consumer 3D printers. A security vulnerability exists in versions prior to OctoPrint 1.8.3 that stems from setting a new password for a user when the product does not require knowledge of the original password or the...

The vulnerability of the OctoPrint 3D-printer controller, related to insufficient limits on authentication attempts, allows a perpetrator to circumvent existing security restrictions through brute-force attacks.

The vulnerability of the OctoPrint 3D-printer controller relates to insufficient restrictions on authentication attempts. Exploiting this vulnerability allows a malicious actor to circumvent existing security measures through brute-force attacks...

Privilege Escalation

octoprint is vulnerable to privilege escalation. The vulnerability exists because of the lack of a rate limit on the login page, allowing an attacker to guess user passwords and gain access to user and administrative accounts...

OctoPrint does not have rate limiting on the login page

OctoPrint 1.7.3 and prior does not have rate limiting on the login page, making it possible for attackers to attempt brute force attacks. The severity of this issue is limited by OctoPrint normally running in a restricted LAN. The devel and maintenance branches of the repository have a fix that...

GHSA-5W5X-Q9P5-9QG3 OctoPrint does not have rate limiting on the login page

OctoPrint 1.7.3 and prior does not have rate limiting on the login page, making it possible for attackers to attempt brute force attacks. The severity of this issue is limited by OctoPrint normally running in a restricted LAN. The devel and maintenance branches of the repository have a fix that...

OctoPrint 安全漏洞

OctoPrint is an application. It provides a fast web interface for controlling consumer 3D printers. A security vulnerability exists in OctoPrint that stems from a lack of request rate limiting on the login screen that allows an attacker to brute-force a username and password to take over any...

Malicious code in octoprint-slackbot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 682178867398fd74736a42b65dc506b26a7e4c8beb24fc3d555d32813fd20dc0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5015 Malicious code in octoprint-slackbot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 682178867398fd74736a42b65dc506b26a7e4c8beb24fc3d555d32813fd20dc0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-VCX4-FPMP-MVV6 OctoPrint API Error Messages vulnerable to XSS

OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters...

OctoPrint Incorrect Access Control

The Logging subsystem in OctoPrint before 1.6.0 has incorrect access control because it attempts to manage files that are not .log files...

OctoPrint API Error Messages vulnerable to XSS

OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters...

GHSA-X9RQ-FJP5-QGM9 OctoPrint Incorrect Access Control

The Logging subsystem in OctoPrint before 1.6.0 has incorrect access control because it attempts to manage files that are not .log files...

Cross-site Scripting (XSS)

OctoPrint is vulnerable to cross-site scripting. The vulnerability exists due to the lack of validation in the redirecturl parameter in the login function of views.py, allowing an attacker to inject and execute malicious javascript by redirecting to malicious URLs...

OctoPrint webcam stream test cross-site scripting vulnerability

OctoPrint is an application that provides a fast web interface for controlling consumer 3D printers. A cross-site scripting vulnerability exists in versions prior to OctoPrint 1.8.0, which stems from a lack of filtering and escaping of data in the software webcam stream test. An attacker could us...