OKLOK Project OKLOK 3.1.1 for iPhone OS
Approved changes feed: RSS · Atom
cpe:2.3:a:oklok_project:oklok:3.1.1:*:*:*:*:iphone_os:*:*part: a version: 3.1.1 update: *
| Vendor | Oklok Project (c079e898-0850-507a-8c0c-b8a543ee67e5) |
|---|---|
| Product | Oklok (61d6823c-eab3-5a3a-83d4-5e1a07508972) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | iphone_os |
| Target hardware | * |
| Other | * |
Notes
Imported from NVD CPE 2.0 feed
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2020-8792 |
vulnerable | 2026-06-08 05:27:19.689636 |
Details available
The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) has an information-exposure issue. In the mobile app, an attempt to add an already-bound lock by its barcode reveals the email address of the account to which the lock is bound, as well as the name of the lock. Valid barcode inputs can be easily guessed because barcode strings follow a predictable pattern. Correctly guessed valid barcode inputs entered through the app interface disclose arbitrary users' email addresses and lock names.
Published: 2020-05-04T13:34:52.000Z
Updated: 2024-08-04T10:12:10.207Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-8791 |
vulnerable | 2026-06-08 05:27:19.689214 |
Details available
The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) allows remote attackers to submit API requests using authenticated but unauthorized tokens, resulting in IDOR issues. A remote attacker can use their own token to make unauthorized API requests on behalf of arbitrary user IDs. Valid and current user IDs are trivial to guess because of the user ID assignment convention used by the app. A remote attacker could harvest email addresses, unsalted MD5 password hashes, owner-assigned lock names, and owner-assigned fingerprint names for any range of arbitrary user IDs.
Published: 2020-05-04T13:22:14.000Z
Updated: 2024-08-04T10:12:10.943Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-8790 |
vulnerable | 2026-06-08 05:27:19.688822 |
Details available
The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) has weak password requirements combined with improper restriction of excessive authentication attempts, which could allow a remote attacker to discover user credentials and obtain access via a brute force attack.
Published: 2020-05-04T13:18:57.000Z
Updated: 2024-08-04T10:12:10.222Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-10876 |
vulnerable | 2026-06-08 05:16:35.991211 |
Details available
The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) does not correctly implement its timeout on the four-digit verification code that is required for resetting passwords, nor does it properly restrict excessive verification attempts. This allows an attacker to brute force the four-digit verification code in order to bypass email verification and change the password of a victim account.
Published: 2020-05-04T13:09:47.000Z
Updated: 2024-08-04T11:14:15.614Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.