h-rouho.jp Cross Site Scripting vulnerability OBB-1449294

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

h-b.com Improper Access Control vulnerability OBB-1439734

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

h-otemon.com Cross Site Scripting vulnerability OBB-1423791

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

openh264:decoder_fuzzer: Use-of-uninitialized-value in UpdateDecStatNoFreezingInfo

Project: https://github.com/cisco/openh264.git Detailed Report: https://oss-fuzz.com/testcase?key=5930193593827328 Project: openh264 Fuzzing Engine: libFuzzer Fuzz Target: decoderfuzzer Job Type: libfuzzermsanopenh264 Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

openh264:decoder_fuzzer: Heap-buffer-overflow in WelsDec::WelsDecodeMbCavlcBSlice

Project: https://github.com/cisco/openh264.git Detailed Report: https://oss-fuzz.com/testcase?key=5678087536377856 Project: openh264 Fuzzing Engine: honggfuzz Fuzz Target: decoderfuzzer Job Type: honggfuzzasanopenh264 Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 16 Crash Address:...

sekcii-h.123stelaji.com Cross Site Scripting vulnerability OBB-1398552

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

h-planner.jp Cross Site Scripting vulnerability OBB-1394894

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

CVE-2020-24217

An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. The file-upload endpoint does not enforce authentication. Attackers can send an unauthenticated HTTP request to upload a custom firmware component, possibly in conjunction with command injection, to...

Path traversal

An issue was discovered on URayTech IPTV/H.264/H.265 video encoders through 1.97. Attackers can send crafted unauthenticated HTTP requests to exploit path traversal and pattern-matching programming flaws, and retrieve any file from the device's file system, including the configuration file with t...

CVE-2020-24218

CVE-2020-24218 affects URayTech IPTV/H.264/H.265 video encoders (up to version 1.97). The issue allows an unauthenticated remote attacker to log in as root using a hard-coded password embedded in the executable, effectively granting full control over the device. Documents indicate this involves d...

CVE-2020-24217

A vulnerability exists in the box application of HiSilicon-based IPTV/H.264/H.265 video encoders , affecting products from vendors such as URayTech , J-Tech Digital , and ProVideoInstruments . The root cause is a lack of authentication on the file-upload endpoint , which allows unauthenticated at...

CVE-2020-24215

CVE-2020-24215 affects HiSilicon-based IPTV/H.264/H.265 video encoders. The issue arises from hard-coded credentials in HTTP requests, enabling an attacker to perform any administrative task, retrieve device configurations (including the cleartext admin password), and upload firmware. This can le...

CVE-2020-24214

CVE-2020-24214 affects HiSilicon-based IPTV/H.264/H.265 video encoders. An unauthenticated crafted RTSP request can trigger a buffer overflow in the box application, causing a crash and a DoS state that lasts about a minute as the device reboots. Exploitation is described as unauthenticated and n...

CVE-2020-24215: Use of Hard-coded Credentials

An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. Attackers can use hard-coded credentials in HTTP requests to perform any administrative task on the device including retrieving the device's configuration with the cleartext admin password, and...

PT-2020-15663

Name of the Vulnerable Software and Affected Versions URayTech IPTV/H.264/H.265 video encoders versions prior to 1.98 Description An issue was discovered that allows attackers to log in as root via a hard-coded password in the executable file. Recommendations For versions prior to 1.98, update to...

CVE-2020-24218: Use of Hard-coded Credentials

An issue was discovered on URayTech IPTV/H.264/H.265 video encoders through 1.97. Attackers can log in as root via the password that is hard-coded in the executable file...

PT-2020-15662

Name of the Vulnerable Software and Affected Versions box application on HiSilicon based IPTV/H.264/H.265 video encoders affected versions not specified Description An issue in the box application allows unauthenticated attackers to view private video streams. When an administrator sets up a secr...

CVE-2020-24219: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered on URayTech IPTV/H.264/H.265 video encoders through 1.97. Attackers can send crafted unauthenticated HTTP requests to exploit path traversal and pattern-matching programming flaws, and retrieve any file from the device's file system, including the configuration file with t...

PT-2020-15664

Name of the Vulnerable Software and Affected Versions URayTech IPTV/H.264/H.265 video encoders versions through 1.97 Description An issue allows attackers to send crafted unauthenticated HTTP requests to exploit path traversal and pattern-matching programming flaws. This enables retrieval of any...

CVE-2020-24217: Missing Authentication for Critical Function

An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. The file-upload endpoint does not enforce authentication. Attackers can send an unauthenticated HTTP request to upload a custom firmware component, possibly in conjunction with command injection, to...