CVE-2025-34065

An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd web server. The strstr function allows unauthenticated access to any request containing "/nobody" in the URL, bypassing login controls...

CVE-2025-27452

The configuration of the Apache httpd webserver which serves the MEAC300-FNADE4 web application, is partly insecure. There are modules activated that are not required for the operation of the FNADE4 web application. The functionality of the some modules pose a risk to the webserver which enable...

PHP 8.2.x < 8.2.29 Multiple Vulnerabilities

The version of PHP installed on the remote host is prior to 8.2.29. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.2.29 advisory. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number...

The vulnerability in the built-in web server boa (/boafrm/formIpv6Setup) of the TOTOLINK X15 router’s microprogramming software allows a hacker to induce a service failure.

The vulnerability of the built-in web server boa /boafrm/formIpv6Setup of the TOTOLINK X15 router’s microprogramming software is related to the issue of the operation exceeding the buffer in memory when processing the submit-url parameter. Exploiting this vulnerability allows a malicious actor to...

The vulnerability of the built-in boa server (/boafrm/formWlSiteSurvey) of TOTOLINK A3002RU router microprogramming software allows a intruder to cause a service failure.

The vulnerability of the built-in boa server /boafrm/formWlSiteSurvey of the TOTOLINK A3002RU router’s microprogramming software is related to the issue of the operation exceeding the buffer boundaries in memory when processing the submit-url parameter. Exploiting this vulnerability allows a...

The vulnerability of the built-in web server boa (/boafrm/formFilter) of the TOTOLINK N300RH router’s microprogramming software allows a hacker to cause a service failure.

The vulnerability of the built-in web server boa /boafrm/formFilter of the TOTOLINK N300RH router software is related to improper cleaning or release of resources during the processing of the url parameter. Exploiting this vulnerability allows a malicious actor to cause service failures by sendin...

The vulnerability of the built-in boa server (/boafrm/formParentControl) of the TOTOLINK A3002RU router’s microprogramming software allows a intruder to cause a service failure.

The vulnerability of the built-in boa server /boafrm/formParentControl of the TOTOLINK A3002RU router’s microprogramming software is related to the issue of the operation exceeding the buffer in memory when processing the submit-url parameter. Exploiting this vulnerability allows a malicious acto...

The vulnerability of the built-in web server boa (/boafrm/formPortFw) of the TOTOLINK N300RH router’s microprogramming software allows a hacker to induce a service failure.

The vulnerability of the built-in web server boa /boafrm/formPortFw of the TOTOLINK N300RH router’s microprogramming software is related to the issue of the operation exceeding the buffer in memory when processing the servicetype parameter. Exploiting this vulnerability allows a malicious actor t...

CVE-2025-34065

An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd web server. The strstr function allows unauthenticated access to any request containing "/nobody" in the URL, bypassing login controls...

CVE-2025-34053

An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd web server. The strstr function is used to identify ".cab" requests, allowing any URL containing ".cab" to bypass authentication and access protected endpoints...

CVE-2025-34065

The CVE-2025-34065 vulnerability affects AVTECH IP cameras, DVRs, and NVRs (streamd web server). The issue is an authentication bypass where the strstr() function allows unauthenticated access to any request containing "/nobody" in the URL, bypassing login controls. Affected systems are AVTECH de...

CVE-2025-34053 AVTECH IP camera, DVR, and NVR Devices Authentication Bypass via .cab Path Manipulation

An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd web server. The strstr function is used to identify ".cab" requests, allowing any URL containing ".cab" to bypass authentication and access protected endpoints...

CVE-2025-34053 AVTECH IP camera, DVR, and NVR Devices Authentication Bypass via .cab Path Manipulation

An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd web server. The strstr function is used to identify ".cab" requests, allowing any URL containing ".cab" to bypass authentication and access protected endpoints...

PT-2025-27537 · Avtech · Avtech Dvr +2

Name of the Vulnerable Software and Affected Versions: AVTECH IP camera, DVR, and NVR devices affected versions not specified Description: An authentication bypass issue exists in the streamd web server of AVTECH devices. The strstr function is used to identify ".cab" requests, allowing any URL...

AVTECH IP camera、AVTECH DVR和AVTECH NVR 安全漏洞

AVTECH IP camera and others are products of AVTECH Corporation, USA.AVTECH IP camera is a series of network security cameras.AVTECH DVR is a digital video recording host.AVTECH NVR is a network video recorder. A security vulnerability exists in AVTECH IP camera, AVTECH DVR and AVTECH NVR that...

AVTECH IP camera、AVTECH DVR和AVTECH NVR 安全漏洞

AVTECH IP camera and others are products of AVTECH Corporation, USA.AVTECH IP camera is a series of network security cameras.AVTECH DVR is a digital video recording host.AVTECH NVR is a network video recorder. A security vulnerability exists in AVTECH IP camera, AVTECH DVR and AVTECH NVR that...

PT-2025-27544 · Avtech · Avtech Dvr +2

Name of the Vulnerable Software and Affected Versions: AVTECH IP camera, DVR, and NVR devices affected versions not specified Description: An authentication bypass issue exists in the streamd web server of AVTECH devices. The strstr function allows unauthenticated access to any request containing...

The vulnerability of IBM Cognos Analytics, a web server for online business analytics services, allows attackers to compromise the confidentiality of protected information.

The vulnerability of the IBM Cognos Analytics online business analytics server relates to the disclosure of information through source code. Exploiting this vulnerability could allow a malicious actor, operating remotely, to compromise the confidentiality of the protected information...

CVE-2025-44163

RaspAP raspap-webgui 3.3.1 is vulnerable to Directory Traversal in ajax/networking/getwgkey.php. An authenticated attacker can send a crafted POST request with a path traversal payload in the entity parameter to overwrite arbitrary files writable by the web server via abuse of the tee command use...

CVE-2025-53094 ESPAsyncWebServer Vulnerable to CRLF Injection in AsyncWebHeader.cpp

ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. In versions up to and including 3.7.8, a CRLF Carriage Return Line Feed injection vulnerability exists in the construction and output of HTTP headers within AsyncWebHeader.cpp. Unsanitize...