Vulnerabilities

TI-2024-25709 CVE-2024-38468 · GHSA-3chh-q8fx-pc2w

Shenzhen Guoxin Synthesis image system before 8.3.0 allows unauthorized password resets via the resetPassword API.

MEDIUM 42

Shenzhen Guoxin Synthesis image system before 8.3.0 allows unauthorized password resets via the resetPassword API.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00421 Published 2024-06-16 No fix listed CWE-640

TI-2024-25708 CVE-2024-38467 · GHSA-285m-hpgq-v7jg

LOW 39

Shenzhen Guoxin Synthesis image system before 8.3.0 allows unauthorized user information retrieval via the queryUser API.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00379 Published 2024-06-16 No fix listed CWE-200

TI-2024-25707 CVE-2024-38466 · GHSA-7p4r-33p9-q666

MEDIUM 42

Shenzhen Guoxin Synthesis image system before 8.3.0 has a 123456Qw default password.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00421 Published 2024-06-16 No fix listed CWE-798

TI-2024-25706 CVE-2024-38465 · GHSA-gf86-2hwm-rmxm

LOW 24

Shenzhen Guoxin Synthesis image system before 8.3.0 allows username enumeration because of the response discrepancy of incorrect versus error.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0025 Published 2024-06-16 No fix listed CWE-203