NUUO NVRmini Command Injection (CVE-2018-14933)

Exploits CVE-2018-14933 in NUUO NVRmini via command injection in the uploaddir parameter of upgradehandle.php. !/usr/bin/env python3 -- coding: utf-8 -- """NUUO NVRmini upgradehandle.php RCE CVE-2018-14933.""" import re import urllib.parse from kittysploit import from lib.protocols.http.httpclien...

NUUO NVRmini 2 - File Upload Detection (CVE-2018-11523)

Detects CVE-2018-11523 by uploading a PHP phpinfo payload to /upload.php and verifying execution. !/usr/bin/env python3 -- coding: utf-8 -- """NUUO NVRmini 2 unauthenticated PHP upload CVE-2018-11523.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

NUUO NVRmini 2 - Unauth handle_import_user Detection (CVE-2022-23227)

NUUO NVRmini 2 devices expose /handleimportuser.php without authentication CVE-2022-23227 / related CVE-2011-5325 upload surface. Detection matches the Greenbone active check response fingerprint. !/usr/bin/env python3 -- coding: utf-8 -- """NUUO NVRmini 2 unauthenticated handleimportuser.php...

NUUO NVRmini - Remote Command Execution Detection

NUUO NVRmini is vulnerable to unauthenticated remote command execution through the upgradehandle.php file. The vulnerability allows an attacker to execute arbitrary commands by manipulating the uploaddir parameter. !/usr/bin/env python3 -- coding: utf-8 -- """NUUO NVRmini is vulnerable to...

NUUO NVRmini 2 3.0.8 - Local File Inclusion Detection

NUUO NVRmini 2 3.0.8 is vulnerable to local file inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """NUUO NVRmini 2 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'NUUO NVRmini 2 3.0.8 - Local File Inclusion...

EUVD-2016-2103

Malware in sbrugna...

CVE-2016-15038

A vulnerability, which was classified as critical, was found in NUUO NVRmini 2 up to 3.0.8. Affected is an unknown function of the file /deletefile.php. The manipulation of the argument filename leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed ...

NUUO NVRmini 2 Script Access

The vulnerability in the handleimportuser.php script of the NUUO NVRmini 2 network video recorder software relates to the absence of authentication for a critical function. Exploiting this vulnerability can allow an attacker to gain access to read, modify, or delete data...

NUUO NVRmini Devices OS Command Injection Vulnerability

NUUO NVRmini devices contain an OS command injection vulnerability. This vulnerability allows remote command execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command...

NUUO NVRmini2 Devices Missing Authentication Vulnerability

NUUO NVRmini2 devices contain a missing authentication vulnerability that allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users...

NUUO NVRmini 2 / NETGEAR ReadyNAS Surveillance Default Configuration Load And Administrator Password Reset

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'NUUO NVRmini 2 / NETGEAR ReadyNAS Surveillance Default Configuration Load and Administrator Password Reset', 'Description' = %q The NVRmini 2...

CVE-2016-15038 NUUO NVRmini 2 deletefile.php path traversal

A vulnerability, which was classified as critical, was found in NUUO NVRmini 2 up to 3.0.8. Affected is an unknown function of the file /deletefile.php. The manipulation of the argument filename leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed ...

CVE-2016-15038 NUUO NVRmini 2 deletefile.php path traversal

A vulnerability, which was classified as critical, was found in NUUO NVRmini 2 up to 3.0.8. Affected is an unknown function of the file /deletefile.php. The manipulation of the argument filename leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed ...

CVE-2016-15038

NUUO NVRmini 2 (up to 3.0.8) has a path traversal vulnerability in an unknown function of /deletefile.php. Manipulating the filename parameter enables traversal, and remote access is possible. The vulnerability is documented with public exploit references in the provided sources; no remediation d...

CVE-2016-15038: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability, which was classified as critical, was found in NUUO NVRmini 2 up to 3.0.8. Affected is an unknown function of the file /deletefile.php. The manipulation of the argument filename leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed ...

PT-2024-10572

Name of the Vulnerable Software and Affected Versions NUUO NVRmini 2 versions up to 3.0.8 Description A critical issue was found in the file /deletefile.php, where the manipulation of the filename argument leads to path traversal. This issue can be exploited remotely. Recommendations For versions...

NUUO NVRmini path traversal vulnerability

NUUO NVRmini is a standalone Linux-based IP camera surveillance solution from NUUO. A path traversal vulnerability exists in NUUO NVRmini versions 2.x through 3.0.8, which stems from the fact that incorrect manipulation of the parameter filename can lead to path traversal...

VulnCheck KEV: CVE-2016-5680

Stack-based buffer overflow in cgi-bin/cgimain in NUUO NVRmini 2 1.7.6 through 3.0.0 and NETGEAR ReadyNAS Surveillance 1.1.2 allows remote authenticated users to execute arbitrary code via the sn parameter to the transferlicense command...

NUUO NVRmini NVRsolo PHP Code Execution

The vulnerability of the debuggingcenterutils.php component in NUUO NVRmini and NVRsolo network video recording systems exists due to insufficient validation of input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary PHP code...

VulnCheck KEV: CVE-2016-5674

debuggingcenterutils.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.7.5 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the log parameter...