Vendor
nerves-hub
8 known vulnerabilities.
Products
3 results · Clear filters · Feed
-
High 8.6
Mass assignment of organization, product and deployment group IDs allows users to write into other organizations and receive their firmware
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in the device API, device forms, signing key and product forms and JITP settings in nerves-hub nerves_hub_web allows an authenticated user who manages devices in any …
-
High 7.4
Improper authentication lets Google sign-in and confirmation links sign users in to accounts registered with their email address by someone else
Improper Authentication vulnerability in Google sign-in and email confirmation in nerves-hub nerves_hub_web allows an attacker who registers another person's email address to share that person's account once they sign in. NervesHub.Accounts.update_or_create_u…
-
High 7.1
Incorrect authorization in the devices page bulk move allows view-role members to move devices into another organization and receive its firmware
Incorrect Authorization vulnerability in the devices page bulk move in nerves-hub nerves_hub_web allows an authenticated user with the manage role in one organization and only the view role in another to move devices into the second organization's product via…