Cross site scripting

NUUO Network Video Recorder NVRsolo v03.06.02 was discovered to contain a reflected cross-site scripting XSS vulnerability via login.php...

NUUO NVRmini NVRsolo PHP Code Execution

The vulnerability of the debuggingcenterutils.php component in NUUO NVRmini and NVRsolo network video recording systems exists due to insufficient validation of input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary PHP code...

CVE-2021-45812

NUUO Network Video Recorder NVRsolo 3.9.1 is affected by a Cross Site Scripting XSS vulnerability. An attacker can steal the user's session by injecting malicious JavaScript codes which leads to session hijacking...

NUUO Network Video Recorder has cross-site scripting vulnerabilities

NUUO Network Video Recorder NVR is a network video recorder from NUUO, Taiwan, China. A cross-site scripting vulnerability exists in NUUO Network Video Recorder NVRsolo version 3.9.1, which stems from the lack of effective filtering and escaping of user-submitted request parameters, and can be...

CVE-2016-5678

NUUO NVRmini 2 1.0.0 through 3.0.0 and NUUO NVRsolo 1.0.0 through 3.0.0 have hardcoded root credentials, which allows remote attackers to obtain administrative access via unspecified vectors...

CVE-2016-5677

NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 have a hardcoded qwe23622260 password for the nuuoeng account, which allows remote attackers to obtain sensitive information via an nvrstatus.php request...

CVE-2016-5676

cgi-bin/cgisystem in NUUO NVRmini 2 1.7.5 through 2.x, NUUO NVRsolo 1.7.5 through 2.x, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to reset the administrator password via a cmd=loaddefconfig action...

Code injection

debuggingcenterutils.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.7.5 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the log parameter...

CVE-2016-5674

debuggingcenterutils.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.7.5 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the log parameter...

CVE-2016-5674

CVE-2016-5674 affects NUUO NVRmini 2 (versions 1.7.5–3.0.0), NVRsolo (1.7.5–3.0.0), and NETGEAR ReadyNAS Surveillance (1.1.1–1.4.1). The vulnerability lies in the web-facing page debugging_center_utils _.php, where the log parameter is not properly validated and is passed to system(), enabling un...

CVE-2016-5675: Improper Input Validation

handledaylightsaving.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, NUUO Crystal 2.2.1 through 3.2.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the NTPServer parameter...

PT-2016-6633

Name of the Vulnerable Software and Affected Versions NUUO NVRmini 2 versions 1.7.5 through 3.0.0 NUUO NVRsolo versions 1.0.0 through 3.0.0 NETGEAR ReadyNAS Surveillance versions 1.1.1 through 1.4.1 Description The issue allows remote attackers to obtain sensitive information due to a hardcoded...

PT-2016-6631

Name of the Vulnerable Software and Affected Versions NUUO NVRmini 2 versions 1.7.5 through 3.0.0 NUUO NVRsolo versions 1.0.0 through 3.0.0 NUUO Crystal versions 2.2.1 through 3.2.0 NETGEAR ReadyNAS Surveillance versions 1.1.1 through 1.4.1 Description The issue allows remote attackers to execute...

PT-2016-6634

Name of the Vulnerable Software and Affected Versions NUUO NVRmini 2 versions 1.0.0 through 3.0.0 NUUO NVRsolo versions 1.0.0 through 3.0.0 Description The issue allows remote attackers to obtain administrative access due to hardcoded root credentials. Recommendations For NUUO NVRmini 2 versions...

PT-2016-6632

Name of the Vulnerable Software and Affected Versions NUUO NVRmini 2 versions 1.7.5 through 2.x NUUO NVRsolo versions 1.7.5 through 2.x NETGEAR ReadyNAS Surveillance versions 1.1.1 through 1.4.1 Description The issue allows remote attackers to reset the administrator password via a...

CVE-2016-5678: Use of Hard-coded Credentials

NUUO NVRmini 2 1.0.0 through 3.0.0 and NUUO NVRsolo 1.0.0 through 3.0.0 have hardcoded root credentials, which allows remote attackers to obtain administrative access via unspecified vectors...

CVE-2016-5677: Exposure of Sensitive Information to an Unauthorized Actor

NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 have a hardcoded qwe23622260 password for the nuuoeng account, which allows remote attackers to obtain sensitive information via an nvrstatus.php request...

CVE-2016-5676: Improper Authorization

cgi-bin/cgisystem in NUUO NVRmini 2 1.7.5 through 2.x, NUUO NVRsolo 1.7.5 through 2.x, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to reset the administrator password via a cmd=loaddefconfig action...

CVE-2016-5674

debuggingcenterutils .php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.7.5 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the log parameter. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker...

PT-2016-3421

Name of the Vulnerable Software and Affected Versions NUUO NVRmini versions 1.7.5 through 3.0.0 NUUO NVRsolo versions 1.7.5 through 3.0.0 NETGEAR ReadyNAS Surveillance versions 1.1.1 through 1.4.1 Description The issue exists due to insufficient input validation in the debugging center utils .php...