644 matches found
Input validation
The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to XSS attack by sending messages with malicious commands to the affected device...
Input validation
The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to execute restricted commands by sending messages with malicious commands to the affected device...
CVE-2022-28172
CVE-2022-28172 describes a cross-site scripting vulnerability in the web module of Hikvision Hybrid SAN/Cluster Storage products caused by insufficient input validation. Exploitation would involve sending messages with malicious commands to the affected device to trigger XSS. The connected docume...
CVE-2022-28171
The CVE-2022-28171 entry relates to Hikvision Hybrid SAN/Cluster Storage products whose web module has insufficient input validation, enabling remote command execution via sending messages with malicious commands. Connected sources detail concrete exploits and affected firmware series (e.g., Ds-a...
CVE-2022-28171
The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to execute restricted commands by sending messages with malicious commands to the affected device...
Hikvision Hybrid SAN/Cluster Storage 跨站脚本漏洞
A cross-site scripting vulnerability exists in Hikvision Hybrid SAN/Cluster Storage, a series of affordable and reliable hybrid SAN storage area network products from Hikvision, China. vulnerability stems from insufficient input validation in the web module. An attacker could exploit the...
Hikvision Hybrid SAN/Cluster Storage 命令注入漏洞
Hikvision Hybrid SAN/Cluster Storage Products is a line of cost-effective and reliable hybrid SAN Storage Area Network products from Hikvision, a China-based company. A security vulnerability exists in Hikvision Hybrid SAN/Cluster Storage that stems from insufficient input validation in the web...
PT-2022-18865 · Hikvision · Hikvision Hybrid San/Cluster Storage
Name of the Vulnerable Software and Affected Versions: Hikvision Hybrid SAN/Cluster Storage products affected versions not specified Description: The issue is related to insufficient input validation in the web module of certain Hikvision Hybrid SAN/Cluster Storage products. This allows an attack...
CVE-2022-28172
The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to XSS attack by sending messages with malicious commands to the affected device...
CVE-2022-28171
The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to execute restricted commands by sending messages with malicious commands to the affected device...
Hikvision iVMS-A100 has a command execution vulnerability
Hikvision iVMS-A100 is an integrated alarm video management platform that implements multiple functions such as alarm management, video review, preview playback, storage and download, alarm linkage, remote control, information forwarding, business management, and value-added services. iVMS-A100 i...
i-hikvision.com Cross Site Scripting vulnerability OBB-2498177
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Hikvision Web Server Command Injection (CVE-2021-36260)
A command injection vulnerability exists in Hikvision Web Server. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...
Hikvision IP Camera Backdoor
Exploit Title: Hikvision IP Camera - Backdoor Date: 14/03/2022 Exploit Author: Sobhan Mahmoodi Reference: https://ipvm.com/reports/hik-exploit GitHub: https://github.com/bp2008/HikPasswordHelper/ Hikvision included a magic string that allowed instant access to any camera, regardless of what the...
Hikvision IP Camera - Backdoor Vulnerability
Exploit Title: Hikvision IP Camera - Backdoor Exploit Author: Sobhan Mahmoodi Reference: https://ipvm.com/reports/hik-exploit GitHub: https://github.com/bp2008/HikPasswordHelper/ Hikvision included a magic string that allowed instant access to any camera, regardless of what the admin password was...
Hikvision IP Camera - Backdoor
Exploit Title: Hikvision IP Camera - Backdoor Date: 14/03/2022 Exploit Author: Sobhan Mahmoodi Reference: https://ipvm.com/reports/hik-exploit GitHub: https://github.com/bp2008/HikPasswordHelper/ Hikvision included a magic string that allowed instant access to any camera, regardless of what the...
Metasploit Weekly Wrap-Up
This week’s Metasploit Framework release brings us seven new modules. IP Camera Exploitation Rapid7’s Jacob Baines was busy this week with two exploit modules that target IP cameras. The first module exploits an authenticated file upload on Axis IP cameras. Due to lack of proper sanitization, an...
Hikvision IP Camera Unauthenticated Command Injection
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Hikvision IP Camera Unauthenticated Command Injection', 'Description' = %q This module exploits an unauthenticated command injection in a variety...
Hikvision IP Camera Unauthenticated Command Injection Exploit
This Metasploit module exploits an unauthenticated command injection in a variety of Hikvision IP cameras CVE-2021-36260. The module inserts a command into an XML payload used with an HTTP PUT request sent to the /SDK/webLanguage endpoint, resulting in command execution as the root user. This...
