391 matches found
CVE-2022-2930
Affected software: OctoPrint (octoprint/octoprint) prior to version 1.8.3. Root cause: unverified password change flow that allowed a password change without requiring the current password, enabling potential account compromise. Impact: high confidentiality, integrity, and availability risks as d...
CVE-2022-2930: Unverified Password Change
Unverified Password Change in GitHub repository octoprint/octoprint prior to 1.8.3...
OctoPrint 安全漏洞
OctoPrint is an application. that provides a fast web interface for controlling consumer 3D printers. A security vulnerability exists in versions prior to OctoPrint 1.8.3 that stems from setting a new password for a user when the product does not require knowledge of the original password or the...
The vulnerability of the OctoPrint 3D-printer controller, related to insufficient limits on authentication attempts, allows a perpetrator to circumvent existing security restrictions through brute-force attacks.
The vulnerability of the OctoPrint 3D-printer controller relates to insufficient restrictions on authentication attempts. Exploiting this vulnerability allows a malicious actor to circumvent existing security measures through brute-force attacks...
Privilege Escalation
octoprint is vulnerable to privilege escalation. The vulnerability exists because of the lack of a rate limit on the login page, allowing an attacker to guess user passwords and gain access to user and administrative accounts...
OctoPrint does not have rate limiting on the login page
OctoPrint 1.7.3 and prior does not have rate limiting on the login page, making it possible for attackers to attempt brute force attacks. The severity of this issue is limited by OctoPrint normally running in a restricted LAN. The devel and maintenance branches of the repository have a fix that...
GHSA-5W5X-Q9P5-9QG3 OctoPrint does not have rate limiting on the login page
OctoPrint 1.7.3 and prior does not have rate limiting on the login page, making it possible for attackers to attempt brute force attacks. The severity of this issue is limited by OctoPrint normally running in a restricted LAN. The devel and maintenance branches of the repository have a fix that...
OctoPrint 安全漏洞
OctoPrint is an application. It provides a fast web interface for controlling consumer 3D printers. A security vulnerability exists in OctoPrint that stems from a lack of request rate limiting on the login screen that allows an attacker to brute-force a username and password to take over any...
Malicious code in octoprint-slackbot (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 682178867398fd74736a42b65dc506b26a7e4c8beb24fc3d555d32813fd20dc0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-5015 Malicious code in octoprint-slackbot (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 682178867398fd74736a42b65dc506b26a7e4c8beb24fc3d555d32813fd20dc0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
OctoPrint API Error Messages vulnerable to XSS
OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters...
OctoPrint Incorrect Access Control
The Logging subsystem in OctoPrint before 1.6.0 has incorrect access control because it attempts to manage files that are not .log files...
GHSA-VCX4-FPMP-MVV6 OctoPrint API Error Messages vulnerable to XSS
OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters...
GHSA-X9RQ-FJP5-QGM9 OctoPrint Incorrect Access Control
The Logging subsystem in OctoPrint before 1.6.0 has incorrect access control because it attempts to manage files that are not .log files...
Cross-site Scripting (XSS)
OctoPrint is vulnerable to cross-site scripting. The vulnerability exists due to the lack of validation in the redirecturl parameter in the login function of views.py, allowing an attacker to inject and execute malicious javascript by redirecting to malicious URLs...
OctoPrint webcam stream test cross-site scripting vulnerability
OctoPrint is an application that provides a fast web interface for controlling consumer 3D printers. A cross-site scripting vulnerability exists in versions prior to OctoPrint 1.8.0, which stems from a lack of filtering and escaping of data in the software webcam stream test. An attacker could us...
Cross-Site Scripting (XSS)
octoprint is vulnerable to cross-site scripting. The vulnerability exists in webcam stream test due to lack of sanitization which allows a malicious attacker to inject and execute arbitrary javascript...
GHSA-X7R7-WMJ8-VV5G Cross-site Scripting in OctoPrint
Cross-site Scripting XSS - DOM in GitHub repository octoprint/octoprint prior to 1.8.0. The login endpoint allows for javascript injection which may lead to account takeover in a phishing scenario...
Cross-site Scripting in OctoPrint
Cross-site Scripting XSS - DOM in GitHub repository octoprint/octoprint prior to 1.8.0. The login endpoint allows for javascript injection which may lead to account takeover in a phishing scenario...
Cross-site Scripting in OctoPrint
Cross-site Scripting XSS - Generic in GitHub repository octoprint/octoprint prior to 1.8.0. The Stream URL of octoprint application allowing a xss payload to execute...