Sz-fujia vulnerabilities
We track 3 vulnerabilities in Sz-fujia products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on November 28, 2022.
Latest Sz-fujia vulnerabilities
- 7.5 High severity
Ourphoto: Missing Authentication for Critical Functionality
The /device/acceptBind end-point for Ourphoto App version 1.4.1 does not require authentication or authorization. The user_token header is not implemented or present on this end-point. An attacker can send a request to bind their account to any users picture f
- 7.5 High severity
Ourphoto: Cleartext Storage of Sensitive Information
The /device/signin end-point for the Ourphoto App version 1.4.1 discloses clear-text password information for functionality within the picture frame devices. The deviceVideoCallPassword and mqttPassword are returned in clear-text. The lack of sessions manageme
- 7.5 High severity
Ourphoto: Authorization Bypass Through User-Controlled Key
The user_id and device_id on the Ourphoto App version 1.4.1 /device/* end-points both suffer from insecure direct object reference vulnerabilities. Other end-users user_id and device_id values can be enumerated by incrementing or decrementing id numbers. The i