441 matches found
CVE-2022-2930
Unverified Password Change in GitHub repository octoprint/octoprint prior to 1.8.3...
CVE-2022-2930: Unverified Password Change
Unverified Password Change in GitHub repository octoprint/octoprint prior to 1.8.3...
OctoPrint 安全漏洞
OctoPrint is an application. that provides a fast web interface for controlling consumer 3D printers. A security vulnerability exists in versions prior to OctoPrint 1.8.3 that stems from setting a new password for a user when the product does not require knowledge of the original password or the...
PT-2022-4444
Name of the Vulnerable Software and Affected Versions OctoPrint versions prior to 1.8.3 Description The issue is related to unverified password change in OctoPrint, which is associated with insecure privilege management. This allows an attacker to change a user's account password without knowing...
OctoPrint Insufficient Authentication Brute Force
The vulnerability of the OctoPrint 3D-printer controller relates to insufficient restrictions on authentication attempts. Exploiting this vulnerability allows a malicious actor to circumvent existing security measures through brute-force attacks...
Privilege Escalation
octoprint is vulnerable to privilege escalation. The vulnerability exists because of the lack of a rate limit on the login page, allowing an attacker to guess user passwords and gain access to user and administrative accounts...
GHSA-5W5X-Q9P5-9QG3 OctoPrint does not have rate limiting on the login page
OctoPrint 1.7.3 and prior does not have rate limiting on the login page, making it possible for attackers to attempt brute force attacks. The severity of this issue is limited by OctoPrint normally running in a restricted LAN. The devel and maintenance branches of the repository have a fix that...
OctoPrint does not have rate limiting on the login page
OctoPrint 1.7.3 and prior does not have rate limiting on the login page, making it possible for attackers to attempt brute force attacks. The severity of this issue is limited by OctoPrint normally running in a restricted LAN. The devel and maintenance branches of the repository have a fix that...
OctoPrint 安全漏洞
OctoPrint is an application. It provides a fast web interface for controlling consumer 3D printers. A security vulnerability exists in OctoPrint that stems from a lack of request rate limiting on the login screen that allows an attacker to brute-force a username and password to take over any...
PT-2022-4232
Name of the Vulnerable Software and Affected Versions OctoPrint versions 1.7.3 and prior Description The issue is related to insufficient restriction of authentication attempts, allowing a remote attacker to bypass security restrictions using a brute force attack. This can enable an attacker to...
MAL-2022-5015 Malicious code in octoprint-slackbot (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 682178867398fd74736a42b65dc506b26a7e4c8beb24fc3d555d32813fd20dc0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in octoprint-slackbot (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 682178867398fd74736a42b65dc506b26a7e4c8beb24fc3d555d32813fd20dc0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
OctoPrint Incorrect Access Control
The Logging subsystem in OctoPrint before 1.6.0 has incorrect access control because it attempts to manage files that are not .log files...
OctoPrint API Error Messages vulnerable to XSS
OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters...
GHSA-X9RQ-FJP5-QGM9 OctoPrint Incorrect Access Control
The Logging subsystem in OctoPrint before 1.6.0 has incorrect access control because it attempts to manage files that are not .log files...
GHSA-VCX4-FPMP-MVV6 OctoPrint API Error Messages vulnerable to XSS
OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters...
Cross-site Scripting (XSS)
OctoPrint is vulnerable to cross-site scripting. The vulnerability exists due to the lack of validation in the redirecturl parameter in the login function of views.py, allowing an attacker to inject and execute malicious javascript by redirecting to malicious URLs...
OctoPrint webcam stream test cross-site scripting vulnerability
OctoPrint is an application that provides a fast web interface for controlling consumer 3D printers. A cross-site scripting vulnerability exists in versions prior to OctoPrint 1.8.0, which stems from a lack of filtering and escaping of data in the software webcam stream test. An attacker could us...
Cross-Site Scripting (XSS)
octoprint is vulnerable to cross-site scripting. The vulnerability exists in webcam stream test due to lack of sanitization which allows a malicious attacker to inject and execute arbitrary javascript...
Cross-site Scripting in OctoPrint
Cross-site Scripting XSS - DOM in GitHub repository octoprint/octoprint prior to 1.8.0. The login endpoint allows for javascript injection which may lead to account takeover in a phishing scenario...