PT-2025-3342

Name of the Vulnerable Software and Affected Versions Geovision GV-ASWeb versions 6.1.0.0 and earlier Description The issue is related to incorrect access control, allowing unauthorized attackers with low-level privileges to manage and create new user accounts by supplying a crafted HTTP request...

CVE-2024-56901

A Cross-Site Request Forgery CSRF vulnerability in Geovision GV-ASWeb application with the version 6.1.1.0 or less that allows attackers to arbitrarily create Administrator accounts via a crafted GET request method. This vulnerability is used in chain with CVE-2024-56903 for a successful CSRF...

CVE-2024-56903

Geovision GV-ASWeb with the version 6.1.1.0 or less allows attackers to modify POST request method with the GET against critical functionalities, such as account management. This vulnerability is used in chain with CVE-2024-56901 for a successful CSRF attack...

Geovision GV-ASWeb 安全漏洞

Geovision GV-ASWeb is a web-based software from Geovision China that is used to remotely access and configure the GV-ASManager's database. A security vulnerability exists in Geovision GV-ASWeb version 6.1.1.0 and earlier, which stems from the presence of cross-site request forgery CSRF, which...

CVE-2024-56898

The Geovision GV-ASWeb web application (version v6.1.0.0 and earlier ) contains a broken access control vulnerability. This flaw allows an attacker with low-level privileges, such as a Guest account (enabled by default), to perform unauthorized actions by supplying a crafted HTTP request . Succes...

PT-2025-3344 · Geovision · Geovision Gv-Asweb

Name of the Vulnerable Software and Affected Versions: Geovision GV-ASWeb versions 6.1.0.0 and earlier Description: The issue allows unauthorized attackers with low-level privileges to request information about other accounts via a crafted HTTP request. Recommendations: For Geovision GV-ASWeb...

CVE-2024-56903

Geovision GV-ASWeb (version 6.1.1.0 and earlier) is vulnerable to a flaw that allows attackers to modify POST request methods to GET against critical functionalities, such as account management. This vulnerability is used in a chain with CVE-2024-56901 to facilitate a successful Cross-Site Reques...

CVE-2024-56902

Information disclosure vulnerability in Geovision GV-ASManager web application with the version v6.1.0.0 or less, which discloses account information, including cleartext password...

CVE-2024-56902

The Geovision GV-ASManager web application (version v6.1.0.0 or less ) is vulnerable to an information disclosure vulnerability. An unauthorized attacker with low-level privileges—such as the default Guest account—can use a crafted HTTP request to enumerate user account information, including cle...

CVE-2024-56898

Broken access control vulnerability in Geovision GV-ASWeb with version v6.1.0.0 or less. This vulnerability allows low privilege users perform actions that they aren't authorized to, which can be leveraged to escalate privileges, create, modify or delete accounts...

CVE-2024-56901

A Cross-Site Request Forgery CSRF vulnerability in Geovision GV-ASWeb application with the version 6.1.1.0 or less that allows attackers to arbitrarily create Administrator accounts via a crafted GET request method. This vulnerability is used in chain with CVE-2024-56903 for a successful CSRF...

CVE-2024-56902

Information disclosure vulnerability in Geovision GV-ASManager web application with the version v6.1.0.0 or less, which discloses account information, including cleartext password...

CVE-2024-56903

Geovision GV-ASWeb with the version 6.1.1.0 or less allows attackers to modify POST request method with the GET against critical functionalities, such as account management. This vulnerability is used in chain with CVE-2024-56901 for a successful CSRF attack...

CVE-2024-56901

The Geovision GV-ASWeb application (version 6.1.1.0 or less ) is vulnerable to a Cross-Site Request Forgery (CSRF) in its account management component. This flaw allows an attacker to arbitrarily create Administrator accounts by sending a crafted GET request . The attack requires network access t...

CVE-2024-56903: Cross-Site Request Forgery (CSRF)

Geovision GV-ASWeb with the version 6.1.1.0 or less allows attackers to modify POST request method with the GET against critical functionalities, such as account management. This vulnerability is used in chain with CVE-2024-56901 for a successful CSRF attack...

CVE-2024-56898: Improper Access Control

Broken access control vulnerability in Geovision GV-ASWeb with version v6.1.0.0 or less. This vulnerability allows low privilege users perform actions that they aren't authorized to, which can be leveraged to escalate privileges, create, modify or delete accounts...

CVE-2024-56901: Cross-Site Request Forgery (CSRF)

A Cross-Site Request Forgery CSRF vulnerability in Geovision GV-ASWeb application with the version 6.1.1.0 or less that allows attackers to arbitrarily create Administrator accounts via a crafted GET request method. This vulnerability is used in chain with CVE-2024-56903 for a successful CSRF...

PT-2025-3343

Name of the Vulnerable Software and Affected Versions Geovision GV-ASWeb versions 6.1.1.0 and earlier Description A Cross-Site Request Forgery CSRF issue in the Account Management component allows attackers to create admin accounts using a manipulated GET request method. This enables attackers to...

PT-2025-3345

Name of the Vulnerable Software and Affected Versions Geovision GV-ASWeb versions 6.1.1.0 and earlier Description The issue allows attackers to execute arbitrary operations via supplying a crafted HTTP request, specifically due to a Cross-Site Request Forgery CSRF in Geovision GV-ASWeb. This...

CVE-2024-12553

GeoVision GV-ASManager Missing Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of GeoVision GV-ASManager. Although authentication is required to exploit this vulnerability, default guest...