Ourphoto vulnerabilities
3 known vulnerabilities in Ourphoto from Sz-fujia. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
Ourphoto: Missing Authentication for Critical Functionality
The /device/acceptBind end-point for Ourphoto App version 1.4.1 does not require authentication or authorization. The user_token header is not implemented or present on this end-point. An attacker can send a request to bind their account to any users picture f
- 7.5 High severity
Ourphoto: Cleartext Storage of Sensitive Information
The /device/signin end-point for the Ourphoto App version 1.4.1 discloses clear-text password information for functionality within the picture frame devices. The deviceVideoCallPassword and mqttPassword are returned in clear-text. The lack of sessions manageme
- 7.5 High severity
Ourphoto: Authorization Bypass Through User-Controlled Key
The user_id and device_id on the Ourphoto App version 1.4.1 /device/* end-points both suffer from insecure direct object reference vulnerabilities. Other end-users user_id and device_id values can be enumerated by incrementing or decrementing id numbers. The i