Vendor
OctoPrint
23 known vulnerabilities.
Products
5 results · Clear filters · Feed
-
High 7.0
OctoPrint: File exfiltration possible via query parameters on upload endpoints
OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, OctoPrint's custom Tornado upload handler and Flask with Werkzeug parse request parameters differently, allowing an attacker with FILE_UPLOAD permission to …
-
High 7.5
OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload
OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.11.2 contain a vulnerability that allows an authenticated attacker to upload a file under a specially crafted filename that will allow arbitra…
-
High 7.1
OctoPrint Authentication Bypass via X-Forwarded-For Header when autologinLocal is enabled
OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.0 contain a vulnerability that allows an unauthenticated attacker to completely bypass the authentication if the `autologinLocal` option is…
-
High 7.5
Cross-site Scripting (XSS) - Generic in octoprint/octoprint
Cross-site Scripting (XSS) - Generic in GitHub repository octoprint/octoprint prior to 1.8.0.
-
High 7.5
Cross-site Scripting (XSS) - DOM in octoprint/octoprint
Cross-site Scripting (XSS) - DOM in GitHub repository octoprint/octoprint prior to 1.8.0.