Uniview NVR301-04S2-P4 - Cross-Site Scripting

Uniview NVR301-04S2-P4 contains a reflected cross-site scripting vulnerability via the PATH of LAPI. CISA and Uniview state that this vulnerability needs to be authenticated. This is incorrect. Any PATH payload can cause XSS. A submission to Mitre has been sent to update the verbiage in the findi...

Uniview IP Cameras Improper Authentication (CVE-2023-0773)

Some Uniview IPC products have an access control vulnerability in their web-based management interface. A remote, unauthenticated attacker can send specially crafted HTTP requests to modify device user credentials. Successful exploitation of this vulnerability could allow the attacker to gain...

Uniview IP Cameras Classic Buffer Overflow (CVE-2021-45039)

Multiple models of the Uniview IP Camera offer an undocumented UDP service on port 7788 that allows a remote, unauthenticated attacker to overflow an internal buffer and achieve code execution. By using this buffer overflow, a remote attacker can start the telnetd service. This service has a...

CVE-2018-14923

A vulnerability in uniview EZPlayer 1.0.6 could allow an attacker to execute arbitrary code on a targeted system via video playback...

EUVD-2020-14224

Malware in sbrugna...

EUVD-2018-6805

Malware in sbrugna...

EUVD-2023-12790

Malicious code in bioql PyPI...

EUVD-2021-31836

Malicious code in bioql PyPI...

EUVD-2024-32418

Malicious code in bioql PyPI...

CVE-2023-0773

The vulnerability exists in Uniview IP Camera due to identification and authentication failure at its web-based management interface. A remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable device. Successful exploitation of this vulnerabili...

CVE-2020-21452

An issue was discovered in uniview ISC2500-S. This is an upload vulnerability where an attacker can upload malicious code via /Interface/DevManage/EC.php?cmd=upload...

CVE-2024-0778

UNSUPPORTED WHEN ASSIGNED A vulnerability, which was classified as critical, has been found in Uniview ISC 2500-S up to 20210930. Affected by this issue is the function setNatConfig of the file /Interface/DevManage/VM.php. The manipulation of the argument natAddress/natPort/natServerPort leads to...

CVE-2024-3850

Uniview NVR301-04S2-P4 is vulnerable to reflected cross-site scripting attack XSS. An attacker could send a user a URL that if clicked on could execute malicious JavaScript in their browser. This vulnerability also requires authentication before it can be exploited, so the scope and severity is...

CVE-2024-3850

Uniview NVR301-04S2-P4 is vulnerable to reflected cross-site scripting attack XSS. An attacker could send a user a URL that if clicked on could execute malicious JavaScript in their browser. This vulnerability also requires authentication before it can be exploited, so the scope and severity is...

CVE-2024-3850 Uniview NVR301-04S2-P4 Cross-site Scripting

Uniview NVR301-04S2-P4 is vulnerable to reflected cross-site scripting attack XSS. An attacker could send a user a URL that if clicked on could execute malicious JavaScript in their browser. This vulnerability also requires authentication before it can be exploited, so the scope and severity is...

CVE-2024-3850 Uniview NVR301-04S2-P4 Cross-site Scripting

Uniview NVR301-04S2-P4 is vulnerable to reflected cross-site scripting attack XSS. An attacker could send a user a URL that if clicked on could execute malicious JavaScript in their browser. This vulnerability also requires authentication before it can be exploited, so the scope and severity is...

CVE-2024-3850

Affected product: Uniview NVR301-04S2-P4. Vulnerability: reflected cross-site scripting (XSS) via the PATH of LAPI. Root cause: improper neutralization of input during web page generation (CWE-79), with XSS possible on pages under /LAPI/. Some sources note authentication is required; others indic...

PT-2024-28037

Name of the Vulnerable Software and Affected Versions Uniview NVR301-04S2-P4 Description The issue is related to a reflected cross-site scripting attack XSS, where an attacker could send a user a URL that, if clicked, could execute malicious JavaScript in their browser. This issue requires...

Uniview NVR301-04S2-P4 Cross-Site Scripting Vulnerability

Uniview NVR301-04S2-P4 is a camera from Uniview Technology China. The Uniview NVR301-04S2-P4 suffers from a cross-site scripting vulnerability that stems from susceptibility to reflective cross-site scripting attacks XSS...

CVE-2024-3850: Improper Neutralization of Input During Web Page Generation

Uniview NVR301-04S2-P4 is vulnerable to reflected cross-site scripting attack XSS. An attacker could send a user a URL that if clicked on could execute malicious JavaScript in their browser. This vulnerability also requires authentication before it can be exploited, so the scope and severity is...