Vendors / Sz-fujia Records 4 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 0
CVSS high 3
Exploited now Sz-fujia records in CISA KEV No Sz-fujia vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 72
The /device/acceptBind end-point for Ourphoto App version 1.4.1 does not require authentication or authorization.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.0073 · Published 2022-11-28 · No fix listed CWE-306
Priority HIGH 72
The /device/signin end-point for the Ourphoto App version 1.4.1 discloses clear-text password information for functionality within the picture frame devices.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.0052 · Published 2022-11-28 · No fix listed CWE-312
Priority HIGH 72
The user_id and device_id on the Ourphoto App version 1.4.1 /device/* end-points both suffer from insecure direct object reference vulnerabilities.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.00802 · Published 2022-11-28 · No fix listed CWE-639
Priority HIGH 68
The user_token authorization header on the Ourphoto App version 1.4.1 /apiv1/* end-points is not implemented properly.
CVSS 3.1 MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00551 · Published 2022-11-28 · No fix listed CWE-863
Open these records in search → All records by CVSS severity
0 3 1 0 0
THREATIST.IORead the docs