| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| kishan0725 Hospital Management System v4 has an Insecure Direct Object Reference (IDOR) vulnerability in the appointment cancellation functionality. |
| A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration. This issue may allow an attacker to impersonate an agent and hide the true status of a monitored machine if the fake agent is added to the verifier list by a legitimate user, resulting in a breach of the integrity of the registrar database. |
| An unauthenticated attacker can obtain a user's plant list by knowing the username. |
| An unauthenticated attacker can check the existence of usernames in the system by querying an API. |
| An unauthenticated attacker can obtain a list of smart devices by knowing a valid username. |
| An authenticated attacker can obtain any plant name by knowing the plant ID. |
| Unauthenticated attackers can add devices of other users to their scenes (or arbitrary scenes of other arbitrary users). |
| An attacker can export other users' plant information. |
| An unauthenticated attacker can hijack other users' devices and potentially control them. |
| Unauthenticated attackers can rename arbitrary devices of arbitrary users (i.e., EV chargers). |
| Unauthenticated attackers can rename "rooms" of arbitrary users. |
| An unauthenticated attacker can delete any user's "rooms" by knowing the user's and room IDs. |
| An unauthenticated attacker can obtain EV charger version and firmware upgrading history by knowing the charger ID. |
| Unauthenticated attackers can query an API endpoint and get device details. |
| An unauthenticated attackers can obtain a list of smart devices by knowing a valid username through an unprotected API. |
| Unauthenticated attackers can retrieve full list of users associated with arbitrary accounts. |
| Unauthenticated attackers can retrieve serial number of smart meters associated to a specific user account. |
| Unauthenticated attackers can query information about total energy consumed by EV chargers of arbitrary users. |
| The buddyboss-platform WordPress plugin before 2.7.60 lacks proper access controls and allows a logged-in user to view comments on private posts |
| Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "rooms"). |
