Sz-Fujia Ourphoto
4 CVEs affecting Sz-Fujia Ourphoto. Latest disclosed: 2022-11-28. Critical: 0, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-24190 | High | 7.5 | 2022-11-28 | The /device/acceptBind end-point for Ourphoto App version 1.4.1 does not require authentication or authorization. The user_token header is not implemented or p… |
CVE-2022-24188 | High | 7.5 | 2022-11-28 | The /device/signin end-point for the Ourphoto App version 1.4.1 discloses clear-text password information for functionality within the picture frame devices. T… |
CVE-2022-24187 | High | 7.5 | 2022-11-28 | The user_id and device_id on the Ourphoto App version 1.4.1 /device/* end-points both suffer from insecure direct object reference vulnerabilities. Other end-u… |
CVE-2022-24189 | Medium | 6.5 | 2022-11-28 | The user_token authorization header on the Ourphoto App version 1.4.1 /apiv1/* end-points is not implemented properly. Removing the value causes all requests t… |