330 matches found
CVE-2022-1430
CVE-2022-1430 affects the OctoPrint project (octoprint/octoprint) prior to version 1.8.0, highlighting a DOM-based Cross-site Scripting (XSS) vulnerability in the web UI. The issue enables JavaScript injection via the login endpoint (as described in the related GHSA advisory), which could lead to...
OctoPrint 跨站脚本漏洞
OctoPrint is an application that provides a fast web interface for controlling consumer 3D printers. A cross-site scripting vulnerability exists in versions prior to OctoPrint 1.8.0, which stems from a lack of filtering and escaping of data in the software webcam stream test. An attacker could us...
OctoPrint 跨站脚本漏洞
OctoPrint is an application. Provides a fast web interface for controlling consumer 3D printers. A cross-site scripting vulnerability exists in OctoPrint versions prior to 1.8.0, which stems from a lack of data filtering and escaping in the login function in the software views.py...
Cross-site Scripting (XSS) - Generic
Description The Stream URL of octoprint application allowing xss payload to execute for which its leads to Cross-site Scripting XSS Proof of Concept Login to the application Now go to settings - Webcam & Timelapse - Stream URL and insert the payload " in the Stream URL and click on "Test" You wil...
OctoPrint Cross-Site Request Vulnerability
OctoPrint is an application. Provides a fast web interface for controlling consumer 3D printers. A cross-site request vulnerability existed prior to OctoPrint version 1.6.0. The vulnerability originated in the program because an API error message included the value of an input parameter. No...
Insecure Access Control
octoprint uses an insecure access control. The vulnerability exists as it attempts to manage files other than .log...
CVE-2021-32560
The Logging subsystem in OctoPrint before 1.6.0 has incorrect access control because it attempts to manage files that are not .log files...
CVE-2021-32560
The Logging subsystem in OctoPrint before 1.6.0 has incorrect access control because it attempts to manage files that are not .log files...
CVE-2021-32561
OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters...
CVE-2021-32561
OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters...
PYSEC-2021-30
OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters...
PYSEC-2021-30
OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters...
Design/Logic Flaw
OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters...
Improper access control
The Logging subsystem in OctoPrint before 1.6.0 has incorrect access control because it attempts to manage files that are not .log files...
PYSEC-2021-29
The Logging subsystem in OctoPrint before 1.6.0 has incorrect access control because it attempts to manage files that are not .log files...
PYSEC-2021-29
The Logging subsystem in OctoPrint before 1.6.0 has incorrect access control because it attempts to manage files that are not .log files...
CVE-2021-32561
Affected product: OctoPrint (before 1.6.0). The issue is a Cross-Site Scripting (XSS) vulnerability caused by API error messages that echo input parameter values, as described in CVE-2021-32561. Impact is XSS via error responses; no exploitation details are provided in the sources. Mitigation: up...
CVE-2021-32561
OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters...
CVE-2021-32560
CVE-2021-32560 (Mode C) Affected: OctoPrint prior to 1.6.0.Vulnerability: In the Logging subsystem, incorrect access control exists by attempting to manage files that are not *.log files.Impact: The issue involves access control on logs/files, with the CVSS indicating potential partial confidenti...