965 matches found
Metasploit Weekly Wrap-Up
Zimbra with Postfix LPE CVE-2022-3569 This week rbowes added an LPE exploit for Zimbra with Postfix. The exploit leverages a vulnerability whereby the Zimbra user can run postfix as root which in turn is capable of executing arbitrary shellscripts. This can be abused for reliable privilege...
Abode Iota 安全漏洞
Abode Iota is a reliable Diy home security system from Abode. A security vulnerability exists in Abode Iota versions 6.9X and 6.9Z, which stems from a stack-based buffer overflow in the XCMD setIPCam function that can be exploited by an attacker to send a malicious XML payload to execute arbitrar...
Metasploit Weekly Wrap-Up
Veritas Backup Exec Agent RCE This module kindly provided by c0rs targets the Veritas Backup Exec Agent in order to gain RCE as the system/root user. The exploit itself is actually a chain of 3 separate CVEs CVE-2021-27876, CVE-2021-27877 and CVE-2021-27878 which only makes it more impressive...
Weak Password Vulnerability in Real-time H.264 IP Camera Monitoring System of Shenzhen Foscombe Intelligent Technology Co.
Shenzhen Foscombe Intelligent Technology Co., Ltd. is a high-tech company headquartered in Shenzhen, Guangdong Province, specializing in network camera products. Real-time H.264 IP Camera Monitoring System of Shenzhen Foscombe Intelligent Technology Co., Ltd. suffers from a weak password...
The vulnerability of the /ptipupgrade.cgi component of the network camera software for video surveillance devices like ISnex HC-IP9100HD and ISnex HC-IP9050HD allows a intruder to gain full access to the device.
The vulnerability of the /ptipupgrade.cgi component of the ISnex HC-IP9100HD and ISnex HC-IP9050HD network camera microprogramming software is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to gain full access to the device through a specially...
Hikvision IP Camera RCE Vulnerability (HSRC-202109-01) - Active Check
Multiple Hikvision IP camera devices are prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CP...
CVE-2022-34538
Digital Watchdog DW MEGApix IP cameras A7.2.220211029 was discovered to contain a command injection vulnerability in the component /admin/vca/bia/addacph.cgi. This vulnerability is exploitable via a crafted POST request...
CVE-2022-34537
Digital Watchdog DW MEGApix IP cameras A7.2.220211029 was discovered to contain a cross-site scripting XSS vulnerability via the component biaoneshot.cgi...
Command injection
Digital Watchdog DW MEGApix IP cameras A7.2.220211029 was discovered to contain a command injection vulnerability in the component /admin/vca/bia/addacph.cgi. This vulnerability is exploitable via a crafted POST request...
CVE-2021-41506
Xiaongmai AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2, AHB7808R-MS, AHB7808T-MS-V2, AHB7804R-LMS, HI351850H10LS39 V4.02.R11.7601.Nat.Onvif.20170420, V4.02.R11.Nat.Onvif.20160422, V4.02.R11.7601.Nat.Onvif.20170424, V4.02.R11.Nat.Onvif.20170327, V4.02.R11.Nat.Onvif.20161205,...
CVE-2022-31873
CVE-2022-31873 affects Trendnet IP-110wn camera fw_tv-ip110wn_v2(1.2.2.68). Vulnerability: cross-site scripting via the prefix parameter in /admin/general.cgi. Root cause: lack of checksum filtering of user-supplied and output data. Impact: attacker can execute JavaScript in the client context. E...
CVE-2022-31875
CVE-2022-31875 affects the Trendnet IP-110wn wireless camera with firmware fw_tv-ip110wn_v2 (1.2.2.68). The vulnerability is a cross-site scripting (XSS) flaw that occurs via the proname parameter in /admin/scheprofile.cgi. The root cause is described as a lack of checksum filtering for user-supp...
CVE-2018-17240
There is a memory dump vulnerability on Netwave IP camera devices at //proc/kcore that allows an unauthenticated attacker to exfiltrate sensitive information from the network configuration e.g., username and password...
Design/Logic Flaw
There is a memory dump vulnerability on Netwave IP camera devices at //proc/kcore that allows an unauthenticated attacker to exfiltrate sensitive information from the network configuration e.g., username and password...
CVE-2018-17240
Netwave IP cameras are affected by CVE-2018-17240 due to a memory dump vulnerability at //proc/kcore that allows an unauthenticated attacker to exfiltrate sensitive network configuration data (e.g., usernames and passwords). Public exploit details exist (Netwave exploit) showing how to dump confi...
CVE-2018-17240
There is a memory dump vulnerability on Netwave IP camera devices at //proc/kcore that allows an unauthenticated attacker to exfiltrate sensitive information from the network configuration e.g., username and password...
Foscam R2C IP Conditional Competition Vulnerability
Foscam R2C IP, a webcam from Foscam China, is a conditional contention vulnerability that could be exploited by remote attackers to gain full remote access to the IP camera and the underlying Linux system with root privileges...
CVE-2022-28743
Time-of-check Time-of-use TOCTOU Race Condition vulerability in Foscam R2C IP camera running System FW = 1.13.1.6, and Application FW = 2.91.2.66, allows an authenticated remote attacker with administrator permissions to execute arbitrary remote code via a malicious firmware patch. The impact of...
Race condition
Time-of-check Time-of-use TOCTOU Race Condition vulerability in Foscam R2C IP camera running System FW = 1.13.1.6, and Application FW = 2.91.2.66, allows an authenticated remote attacker with administrator permissions to execute arbitrary remote code via a malicious firmware patch. The impact of...