Network Video Server Weak Password Vulnerability in Network Video Server

Network Video Server is a network video server. A weak password vulnerability exists in Network Video Server, which can be exploited by an attacker to obtain sensitive information...

ICSA-20-070-01_Siemens and PKE SiNVR/SiVMS Video Server (Update B)

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendors: Siemens and PKE Equipment: SiNVR/SiVMS Video Server Vulnerabilities: Cleartext Storage in a File or on Disk, Path Traversal, Improper Input Validation, Weak Cryptography for Passwords 2. UPDATE...

Cisco Expressway Series and Cisco TelePresence Video Communication Server Memory Exhaustion Vulnerability

Cisco Expressway Series and Cisco TelePresence Video Communication Server VCS are both products of Cisco Corporation.Cisco Expressway Series is an advanced collaboration gateway for unified communications.Cisco TelePresence Video Communication Server is a video communication server. The Cisco...

The vulnerability of the VPort 461 Series video server arises from the lack of measures to neutralize special elements used in operating system teams, allowing a hacker to execute arbitrary code.

The vulnerability of the VPort 461 Series video server is related to the lack of measures to neutralize special elements used in operating system teams. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the Central Control Server (CCS) and the Video Server of Siemens’ SiNVR 3 solution, related to the lack of measures for cleaning input data, allows a intruder to inject malicious code into the web application of the Central Control Server.

The vulnerability of the Central Control Server CCS and the video server of Siemens’ SiNVR 3 solution relates to the lack of measures for cleaning incoming data. Exploiting this vulnerability allows a malicious actor to inject malicious code into the web application of the Central Control Server...

The vulnerability of the Central Control Server (CCS) and the Video Server of Siemens’ SiNVR 3 solution, related to the unencrypted storage of user credentials, allows a intruder to gain unauthorized access to users’ credentials.

The vulnerability of the Central Control Server CCS and the Video Server of Siemens’ SiNVR 3 solution for video management involves unencrypted storage of user credentials. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to users’...

Weak Password Vulnerability in Network Video Server of Longchamp Cintron

Ltd. is a provider of products and application solutions in the field of network video surveillance in China. A weak password vulnerability exists in the network video server, which can be exploited by an attacker to log in to the backend of the system...

CVE-2020-8144

The UniFi Video Server v3.9.3 and prior for Windows 7/8/10 x64 web interface Firmware Update functionality, under certain circumstances, does not validate firmware download destinations to ensure they are within the intended destination directory tree. It accepts a request with a URL to firmware...

CVE-2020-8145

The UniFi Video Server Windows web interface configuration restore functionality at the “backup” and “wizard” endpoints does not implement sufficient privilege checks. Low privileged users, belonging to the PUBLICGROUP or CUSTOMGROUP groups, can access these endpoints and overwrite the current...

CVE-2020-8144

The UniFi Video Server v3.9.3 and prior for Windows 7/8/10 x64 web interface Firmware Update functionality, under certain circumstances, does not validate firmware download destinations to ensure they are within the intended destination directory tree. It accepts a request with a URL to firmware...

CVE-2020-8145

The UniFi Video Server Windows web interface configuration restore functionality at the “backup” and “wizard” endpoints does not implement sufficient privilege checks. Low privileged users, belonging to the PUBLICGROUP or CUSTOMGROUP groups, can access these endpoints and overwrite the current...

Design/Logic Flaw

The UniFi Video Server v3.9.3 and prior for Windows 7/8/10 x64 web interface Firmware Update functionality, under certain circumstances, does not validate firmware download destinations to ensure they are within the intended destination directory tree. It accepts a request with a URL to firmware...

Design/Logic Flaw

The UniFi Video Server Windows web interface configuration restore functionality at the “backup” and “wizard” endpoints does not implement sufficient privilege checks. Low privileged users, belonging to the PUBLICGROUP or CUSTOMGROUP groups, can access these endpoints and overwrite the current...

CVE-2020-8145

CVE-2020-8145 affects the UniFi Video Server (Windows) web interface. The vulnerability is in the backup and wizard configuration-restore endpoints, which do not perform sufficient privilege checks. Low-privilege users (PUBLIC_GROUP or CUSTOM_GROUP) can access these endpoints and overwrite the cu...

CVE-2020-8145

The UniFi Video Server Windows web interface configuration restore functionality at the “backup” and “wizard” endpoints does not implement sufficient privilege checks. Low privileged users, belonging to the PUBLICGROUP or CUSTOMGROUP groups, can access these endpoints and overwrite the current...

CVE-2020-8144

The CVE-2020-8144 issue affects UniFi Video Server v3.9.3 and earlier on Windows (x64) where the firmware update mechanism does not validate the download destination, allowing a crafted ..\ sequence to cause the firmware file to be saved outside the intended directory. This path traversal could e...

CVE-2020-8144

The UniFi Video Server v3.9.3 and prior for Windows 7/8/10 x64 web interface Firmware Update functionality, under certain circumstances, does not validate firmware download destinations to ensure they are within the intended destination directory tree. It accepts a request with a URL to firmware...

CVE-2020-8144: Improper Limitation of a Pathname to a Restricted Directory

The UniFi Video Server v3.9.3 and prior for Windows 7/8/10 x64 web interface Firmware Update functionality, under certain circumstances, does not validate firmware download destinations to ensure they are within the intended destination directory tree. It accepts a request with a URL to firmware...

PT-2020-19980

Name of the Vulnerable Software and Affected Versions UniFi Video Server versions 3.9.3 and prior Description The web interface Firmware Update functionality does not validate firmware download destinations, allowing manipulation of the destination file path to be outside the intended directory...

Siemens SiNVR 3 Insufficient Records Vulnerability

SiNVR 3 is a video management platform.Central Control Server CCS is the central control server and Video Server is the video server. SiNVR 3 has an insufficient security operation logging vulnerability in the XML-based communication protocol implementation, which can be exploited by a remote...