244 matches found
CVE-2023-45671
Frigate is an open‑source network video recorder. Prior to version 0.13.0 Beta 3, a reflected cross‑site scripting (XSS) vulnerability exists in API endpoints that rely on the / base path; values in the URL are not sanitized, enabling arbitrary JavaScript execution when an authenticated user is t...
CVE-2023-45671 Frigate reflected XSS through `/<camera_name>` API endpoints
Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, there is a reflected cross-site scripting vulnerability in any API endpoints reliant on the / base path as values provided for the path are not sanitized. Exploiting this vulnerability requires the attacker to both...
CVE-2023-45671 Frigate reflected XSS through `/<camera_name>` API endpoints
Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, there is a reflected cross-site scripting vulnerability in any API endpoints reliant on the / base path as values provided for the path are not sanitized. Exploiting this vulnerability requires the attacker to both...
CVE-2023-45670
CVE-2023-45670 : Frigate before 0.13.0 Beta 3 exposes a CSRF vulnerability in the config/save and config/set endpoints, allowing an attacker to trigger arbitrary configuration updates on a Frigate server via a crafted link. Exploitation requires the attacker to know specific server details and pe...
CVE-2023-45670 Frigate cross-site request forgery in `config_save` and `config_set` request handlers
Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, the config/save and config/set endpoints of Frigate do not implement any CSRF protection. This makes it possible for a request sourced from another site to update the configuration of the Frigate server e.g. via...
Ubiquiti UniFi Cloud Key 跨站请求伪造漏洞
Ubiquiti UniFi Cloud Key is a secret key device that supports management of UniFi networks from Ubiquiti, Inc. A security vulnerability exists in the Ubiquiti UniFi Cloud Key UniFi OS 2.5 and prior versions, which originated from a vulnerability that allows malicious actors to access certain...
CVE-2023-30467
This vulnerability exists in Milesight 4K/H.265 Series NVR models MS-Nxxxx-xxG, MS-Nxxxx-xxE, MS-Nxxxx-xxT, MS-Nxxxx-xxH and MS-Nxxxx-xxC, due to improper authorization at the Milesight NVR web-based management interface. A remote attacker could exploit this vulnerability by sending a specially...
CVE-2023-30467 Improper Authorization Vulnerability in Milesight Network Video Recorder (NVR)
This vulnerability exists in Milesight 4K/H.265 Series NVR models MS-Nxxxx-xxG, MS-Nxxxx-xxE, MS-Nxxxx-xxT, MS-Nxxxx-xxH and MS-Nxxxx-xxC, due to improper authorization at the Milesight NVR web-based management interface. A remote attacker could exploit this vulnerability by sending a specially...
CVE-2022-45460
Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431119.12001.130000.00000, allow an unauthenticated and remote user to exploit a stack-based buffer overflow and crash the web server, resulting in a system reboot. An unauthenticat...
NVS365 安全漏洞
NVS365 is a network video server from NVS365. A security vulnerability exists in NVS365 version V01, which stems from a command execution that can be triggered by the background network test function...
NVS365 安全漏洞
NVS365 is a network video server from NVS365, Inc. A security vulnerability exists in NVS365 version V01 that stems from incorrect access control...
Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Nvs365 Nvs-365-V01_Firmware
NVS-365-Camera NVS-365-Camera NVS-365-Camera Two Vulnerab...
The vulnerability of the microprogrammed software of the D–Link DNR-322L network video recorder camera lies in the fact that the code can be loaded without checking its integrity. This allows a intruder to execute any arbitrary code.
The vulnerability of the microprogrammed software of the D-Link DNR-322L network video recorder relates to the loading of code without checking its integrity. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
多款Xiongmai设备操作系统命令注入漏洞
Xiongmai NVR devices are a series of network video recorders from China-based Xiongmai Technology Xiongmai. A security vulnerability exists in several Xiongmai NVR devices. An attacker can exploit this vulnerability to execute arbitrary commands as root user. The following products and versions a...
CVE-2022-33119
NUUO Network Video Recorder NVRsolo v03.06.02 was discovered to contain a reflected cross-site scripting XSS vulnerability via login.php...
CVE-2021-32941 Annke Network Video Recorder - Stack-based Buffer Overflow
Annke N48PBB Network Video Recorder products of version 3.4.106 build 200422 and prior are vulnerable to a stack-based buffer overflow, which allows an unauthorized remote attacker to execute arbitrary code with the same privileges as the server user root...
CVE-2021-32941 Annke Network Video Recorder - Stack-based Buffer Overflow
Annke N48PBB Network Video Recorder products of version 3.4.106 build 200422 and prior are vulnerable to a stack-based buffer overflow, which allows an unauthorized remote attacker to execute arbitrary code with the same privileges as the server user root...
CVE-2021-32941
CVE-2021-32941 affects Annke N48PBB NVRs. A stack-based buffer overflow in version 3.4.106 build 200422 and earlier could allow an unauthenticated remote attacker to execute code with the server user (root) privileges. Public indicators from ICS/CISA document the vulnerability as stack-based, wit...
QNAP Systems QVR 命令注入漏洞
QNAP Systems QVR is a QNAP monitoring system control center from China Weilian Technology QNAP Systems. A command injection vulnerability exists in versions prior to QNAP Systems QVR 5.1.6 build 20220401, which can be exploited by an attacker to execute arbitrary commands...