CVE-2025-9983

GALAYOU G2 cameras stream video output via RTSP streams. By default these streams are protected by randomly generated credentials. However these credentials are not required to access the stream. Changing these values does not change camera's behavior. The vendor did not respond in any way. Only...

CVE-2025-9983 Lack of Authentication for RTSP stream

GALAYOU G2 cameras stream video output via RTSP streams. By default these streams are protected by randomly generated credentials. However these credentials are not required to access the stream. Changing these values does not change camera's behavior. The vendor did not respond in any way. Only...

CVE-2025-57437

The Blackmagic Web Presenter HD firmware version 3.3 exposes sensitive information via an unauthenticated Telnet service on port 9977. When connected, the service reveals extensive device configuration data including: - Model, version, and unique identifiers - Network settings including IP, MAC,...

Blackmagic Design ATEM Mini Pro 安全漏洞

Blackmagic Design ATEM Mini Pro is a live video streaming device from Blackmagic Design, USA. A security vulnerability exists in the Blackmagic Design ATEM Mini Pro version 2.7 that originates from an undocumented Telnet service accepting unauthenticated commands in clear text, which could allow ...

Blackmagic Design Web Presenter 安全漏洞

Blackmagic Design Web Presenter is a live video streaming appliance from Blackmagic Design, USA. A security vulnerability exists in Blackmagic Design Web Presenter version 3.3, which stems from the Telnet service accepting commands without authentication, which could allow a remote attacker to...

PT-2025-38761

Name of the Vulnerable Software and Affected Versions Blackmagic ATEM Mini Pro version 2.7 Description The Blackmagic ATEM Mini Pro 2.7 device exposes an undocumented Telnet service on TCP port 9993. This service accepts unauthenticated plaintext commands, allowing control over streaming,...

PT-2025-38751

Name of the Vulnerable Software and Affected Versions Blackmagic Web Presenter HD firmware version 3.3 Description The Blackmagic Web Presenter HD firmware version 3.3 has an unauthenticated Telnet service accessible on port 9977 that exposes sensitive information. Connecting to this service...

CVE-2025-57440

The Blackmagic ATEM Mini Pro 2.7 exposes an undocumented Telnet service on TCP port 9993 , referred to as the "ATEM Ethernet Protocol 1.0". This service accepts unauthenticated plaintext commands , allowing an attacker with network access to the port to gain full remote control of the device. Imp...

GALAYOU G2 访问控制错误漏洞

The GALAYOU G2 is a surveillance camera from GALAYOU USA. An access control error vulnerability exists in GALAYOU G2 version 11.100001.01.28, which stems from RTSP streams that do not properly implement credential validation, which could lead to unauthorized access to video streams...

PT-2025-38711

Name of the Vulnerable Software and Affected Versions GALAYOU G2 cameras version 11.100001.01.28 Description GALAYOU G2 cameras stream video output via RTSP streams. By default, these streams are protected by randomly generated credentials, but these credentials are not required to access the...

CVE-2025-57437

The Blackmagic Web Presenter HD firmware version 3.3 is vulnerable to sensitive information exposure via an unauthenticated Telnet service on port 9977 . An attacker connecting to this service can retrieve extensive configuration data, including device identifiers, network settings (IP, MAC, DNS)...

Path Traversal

github.com/mattermost/mattermost-server is vulnerable to path traversal. The vulnerability is due to improper sanitization of file names, which allows an attacker with file upload permissions to overwrite file attachment thumbnails via file streaming APIs...

Mattermost Server 10.5.x < 10.5.9 / 10.8.x < 10.8.4 / 10.9.x < 10.9.4 / 10.10.x < 10.10.1 / 10.11.0 Path Traversal (MMSA-2025-00501)

The version of Mattermost Server installed on the remote host is affected by a vulnerability as referenced in the MMSA-2025-00501 advisory. - Mattermost versions 10.8.x = 10.8.3, 10.5.x = 10.5.8, 10.10.x = 10.10.0, 10.9.x = 10.9.3 fail to sanitize file names which allows users with file upload...

CVE-2025-10472 harry0703 MoneyPrinterTurbo URL video.py stream_video path traversal

A vulnerability has been found in harry0703 MoneyPrinterTurbo up to 1.2.6. The impacted element is the function downloadvideo/streamvideo of the file app/controllers/v1/video.py of the component URL Handler. The manipulation of the argument filepath leads to path traversal. The attack can be...

CVE-2025-10364

CVE-2025-10364 affects the Evertz SDVN 3080ipx-10G web management interface. The issue is a command-injection vulnerability in feature-transfer-export.php that allows remote unauthenticated arbitrary code execution with root privileges. The connected sources confirm the vulnerability is tied to t...

CVE-2025-54376

Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, Hoverfly’s admin WebSocket endpoint /api/v2/ws/logs is not protected by the same authentication middleware that guards the REST admin API. Consequently, an unauthenticated remote attacker can stream real-time applicatio...

Linux Distros Unpatched Vulnerability : CVE-2021-38382

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Live555 through 1.08 does not handle Matroska and Ogg files properly. Sending two successive RTSP SETUP commands for the same track causes a Use-After-Free and...

Linux Distros Unpatched Vulnerability : CVE-2020-24027

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Live Networks, Inc., liblivemedia version 20200625, there is a potential buffer overflow bug in the server handling of a RTSP PLAY command, when the command...

Linux Distros Unpatched Vulnerability : CVE-2021-28899

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the AC3AudioFileServerMediaSubsession, ADTSAudioFileServerMediaSubsession, and AMRAudioFileServerMediaSubsessionLive...

Sunshine 安全漏洞

Sunshine is an open source self-service game streaming host for Moonlight by LizardByte. A security vulnerability exists in Sunshine version v2025.122.141614, which stems from DLL search order hijacking and could lead to the insertion of a malicious DLL...