CVE-2018-14495: Improper Neutralization of Special Elements used in an OS Command

Vivotek FD8136 devices allow Remote Command Injection, aka "another command injection vulnerability in our target device," a different issue than CVE-2018-14494. NOTE: The vendor has disputed this as a vulnerability and states that the issue does not cause a web server crash or have any other...

Vivotek NVR Default Credentials (HTTP)

The remote installation of Vivotek NVR is using known default credentials for its web interface. Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public...

Cross-site scripting vulnerability in VIVOTEK Network Camera series products (CNVD-2019-00683)

VIVOTEK Network Camera Series is a series of network camera products from China VIVOTEK. A cross-site scripting vulnerability exists in the eventscript.js file in the VIVOTEK Network Camera Series using firmware versions 0x06x to 0x08x. The vulnerability can be exploited by a remote attacker to...

VIVOTEK Network Camera Series Product Cross-Site Scripting Vulnerability

VIVOTEK Network Camera Series is a series of network camera products from China VIVOTEK. A cross-site scripting vulnerability exists in the syslog.html file of VIVOTEK Network Camera Series products using firmware versions 0x06x to 0x08x, which can be exploited by remote attackers to execute...

Vivotek NVR Detection

Detection of Vivotek SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.114060";...

Cross site scripting

Cross-site scripting in syslog.html in VIVOTEK Network Camera Series products with firmware 0x06x to 0x08x allows remote attackers to execute arbitrary JavaScript code via an HTTP Referer Header...

Improper access control

Incorrect Access Control in modinetd.cgi in VIVOTEK Network Camera Series products with firmware before XXXXXX-VVTK-0X09a allows remote attackers to enable arbitrary system services via a URL parameter...

CVE-2018-18004

Incorrect Access Control in modinetd.cgi in VIVOTEK Network Camera Series products with firmware before XXXXXX-VVTK-0X09a allows remote attackers to enable arbitrary system services via a URL parameter...

CVE-2018-18005

Cross-site scripting in eventscript.js in VIVOTEK Network Camera Series products with firmware 0x06x to 0x08x allows remote attackers to execute arbitrary JavaScript via a URL query string parameter...

CVE-2018-18244

Cross-site scripting in syslog.html in VIVOTEK Network Camera Series products with firmware 0x06x to 0x08x allows remote attackers to execute arbitrary JavaScript code via an HTTP Referer Header...

CVE-2018-18005

Cross-site scripting in eventscript.js in VIVOTEK Network Camera Series products with firmware 0x06x to 0x08x allows remote attackers to execute arbitrary JavaScript via a URL query string parameter...

CVE-2018-18004

Incorrect Access Control in modinetd.cgi in VIVOTEK Network Camera Series products with firmware before XXXXXX-VVTK-0X09a allows remote attackers to enable arbitrary system services via a URL parameter...

CVE-2018-18244

Cross-site scripting in syslog.html in VIVOTEK Network Camera Series products with firmware 0x06x to 0x08x allows remote attackers to execute arbitrary JavaScript code via an HTTP Referer Header...

CVE-2018-18244

The CVE-2018-18244 entry corresponds to a cross-site scripting vulnerability in VIVOTEK Network Camera Series. The affected component is the syslog.html page, exploitable on firmware versions 0x06x to 0x08x. An attacker can remotely inject and execute arbitrary JavaScript in the context of a user...

CVE-2018-18004

CVE-2018-18004 affects VIVOTEK Network Camera Series via mod_inetd.cgi in firmware before XXXXXX-VVTK-0X09a. Root cause: incorrect access control that permits remote attackers to trigger arbitrary system services through a URL parameter. Impact: potential partial integrity impact by enabling unin...

CVE-2018-18005

Summary: CVE-2018-18005 affects VIVOTEK Network Camera Series devices. The vulnerability is a cross-site scripting (XSS) flaw in the JavaScript file event_script.js, exploitable on firmware versions 0x06x to 0x08x. A remote attacker can cause arbitrary JavaScript execution by supplying a crafted ...

PT-2019-9542

Name of the Vulnerable Software and Affected Versions VIVOTEK Network Camera Series products with firmware before XXXXXX-VVTK-0X09a Description The issue concerns an Incorrect Access Control in the mod inetd.cgi module, allowing remote attackers to enable arbitrary system services via a URL...

CVE-2018-18005: Improper Neutralization of Input During Web Page Generation

Cross-site scripting in eventscript.js in VIVOTEK Network Camera Series products with firmware 0x06x to 0x08x allows remote attackers to execute arbitrary JavaScript via a URL query string parameter...

PT-2019-9543

Name of the Vulnerable Software and Affected Versions VIVOTEK Network Camera Series products with firmware 0x06x through 0x08x Description The issue concerns cross-site scripting in the event script.js file, allowing remote attackers to execute arbitrary JavaScript code via a URL query string...

CVE-2018-18244: Improper Neutralization of Input During Web Page Generation

Cross-site scripting in syslog.html in VIVOTEK Network Camera Series products with firmware 0x06x to 0x08x allows remote attackers to execute arbitrary JavaScript code via an HTTP Referer Header...