CVE-2025-57437

The Blackmagic Web Presenter HD firmware version 3.3 exposes sensitive information via an unauthenticated Telnet service on port 9977. When connected, the service reveals extensive device configuration data including: - Model, version, and unique identifiers - Network settings including IP, MAC,...

CVE-2025-57437

The Blackmagic Web Presenter HD firmware version 3.3 exposes sensitive information via an unauthenticated Telnet service on port 9977. When connected, the service reveals extensive device configuration data including: - Model, version, and unique identifiers - Network settings including IP, MAC,...

CVE-2025-9983

GALAYOU G2 cameras stream video output via RTSP streams. By default these streams are protected by randomly generated credentials. However these credentials are not required to access the stream. Changing these values does not change camera's behavior. The vendor did not respond in any way. Only...

CVE-2025-9983 Lack of Authentication for RTSP stream

GALAYOU G2 cameras stream video output via RTSP streams. By default these streams are protected by randomly generated credentials. However these credentials are not required to access the stream. Changing these values does not change camera's behavior. The vendor did not respond in any way. Only...

PT-2025-38751

Name of the Vulnerable Software and Affected Versions Blackmagic Web Presenter HD firmware version 3.3 Description The Blackmagic Web Presenter HD firmware version 3.3 has an unauthenticated Telnet service accessible on port 9977 that exposes sensitive information. Connecting to this service...

CVE-2025-57437

The Blackmagic Web Presenter HD firmware version 3.3 exposes sensitive information via an unauthenticated Telnet service on port 9977. When connected, the service reveals extensive device configuration data including: - Model, version, and unique identifiers - Network settings including IP, MAC,...

PT-2025-38761

Name of the Vulnerable Software and Affected Versions Blackmagic ATEM Mini Pro version 2.7 Description The Blackmagic ATEM Mini Pro 2.7 device exposes an undocumented Telnet service on TCP port 9993. This service accepts unauthenticated plaintext commands, allowing control over streaming,...

CVE-2025-57437

The CVE-2025-57437 affects Blackmagic Web Presenter HD firmware v3.3. An unauthenticated Telnet service on port 9977 exposes extensive device configuration data, including model, version, unique identifiers, IP/MAC/DNS, current stream platform, stream key, streaming URL, and audio/video settings....

Blackmagic Design ATEM Mini Pro 安全漏洞

Blackmagic Design ATEM Mini Pro is a live video streaming device from Blackmagic Design, USA. A security vulnerability exists in the Blackmagic Design ATEM Mini Pro version 2.7 that originates from an undocumented Telnet service accepting unauthenticated commands in clear text, which could allow ...

GALAYOU G2 访问控制错误漏洞

The GALAYOU G2 is a surveillance camera from GALAYOU USA. An access control error vulnerability exists in GALAYOU G2 version 11.100001.01.28, which stems from RTSP streams that do not properly implement credential validation, which could lead to unauthorized access to video streams...

Blackmagic Design Web Presenter 安全漏洞

Blackmagic Design Web Presenter is a live video streaming appliance from Blackmagic Design, USA. A security vulnerability exists in Blackmagic Design Web Presenter version 3.3, which stems from the Telnet service accepting commands without authentication, which could allow a remote attacker to...

CVE-2025-57440

CVE-2025-57440 affects Blackmagic ATEM Mini Pro 2.7. The vulnerability is an undocumented Telnet service exposed on TCP port 9993, referred to as the “ATEM Ethernet Protocol 1.0,” which accepts unauthenticated plaintext commands for controlling streaming, recording, storage formatting, and system...

PT-2025-38711

Name of the Vulnerable Software and Affected Versions GALAYOU G2 cameras version 11.100001.01.28 Description GALAYOU G2 cameras stream video output via RTSP streams. By default, these streams are protected by randomly generated credentials, but these credentials are not required to access the...

ai.starlake:starlake-streaming_2.13 (>=1.3.3 <=1.3.5), chat.octet:llama-java-core (>=1.4.1 <=1.4.2) +294 more potentially affected by CVE-2025-59340 via com.hubspot.jinjava:jinjava (>=1.0.3 <=2.7.4)

com.hubspot.jinjava:jinjava MAVEN version =1.0.3, =1.3.3, =1.4.1, =1.0.2, =1.0.2, =0.1.0, =1.3.0, =0.3.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.1.6 - com.elevenware.felson.examples:authserver =0.0.2 - com.elevenware.felson.examples:felson-examples-app =0.0.2 - com.elevenware.felson.examples:one =0.0...

Path Traversal

github.com/mattermost/mattermost-server is vulnerable to path traversal. The vulnerability is due to improper sanitization of file names, which allows an attacker with file upload permissions to overwrite file attachment thumbnails via file streaming APIs...

Mattermost Server 10.5.x < 10.5.9 / 10.8.x < 10.8.4 / 10.9.x < 10.9.4 / 10.10.x < 10.10.1 / 10.11.0 Path Traversal (MMSA-2025-00501)

The version of Mattermost Server installed on the remote host is affected by a vulnerability as referenced in the MMSA-2025-00501 advisory. - Mattermost versions 10.8.x = 10.8.3, 10.5.x = 10.5.8, 10.10.x = 10.10.0, 10.9.x = 10.9.3 fail to sanitize file names which allows users with file upload...

CVE-2025-10472 harry0703 MoneyPrinterTurbo URL video.py stream_video path traversal

A vulnerability has been found in harry0703 MoneyPrinterTurbo up to 1.2.6. The impacted element is the function downloadvideo/streamvideo of the file app/controllers/v1/video.py of the component URL Handler. The manipulation of the argument filepath leads to path traversal. The attack can be...

CVE-2025-10364

CVE-2025-10364 affects the Evertz SDVN 3080ipx-10G web management interface. The issue is a command-injection vulnerability in feature-transfer-export.php that allows remote unauthenticated arbitrary code execution with root privileges. The connected sources confirm the vulnerability is tied to t...

CVE-2025-54376

Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, Hoverfly’s admin WebSocket endpoint /api/v2/ws/logs is not protected by the same authentication middleware that guards the REST admin API. Consequently, an unauthenticated remote attacker can stream real-time applicatio...

Linux Distros Unpatched Vulnerability : CVE-2021-38382

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Live555 through 1.08 does not handle Matroska and Ogg files properly. Sending two successive RTSP SETUP commands for the same track causes a Use-After-Free and...