AXIS 70U - Network Document Server Privilege Escalation Cross-Site Scripting

AXIS 70U - Network Document Server Privilege Escalation Cross-Site Scripting Digital Security Research Group DSecRG Advisory DSECRG-09-004 AXIS 70U Network Document Server - Privilege Escalation and XSS http://dsecrg.com/pages/vul/show.php?id=60 Application: AXIS 70U Network Document Server Web...

AXIS 70U Network Document Server Privilege Escalation/XSS

Exploit for hardware platform in category remote exploits ========================================================= AXIS 70U Network Document Server Privilege Escalation/XSS ========================================================= Digital Security Research Group DSecRG Advisory DSECRG-09-004 AXI...

AXIS 70U Privilege Escalation / XSS

DSECRG-09-004 AXIS 70U Network Document Server - Privilege Escalation and XSS Vulnerabilities found in Web Interface of device AXIS 70U Network Document Server. 1. Local File Include and Privilege Escalation. Standard user can escalate privileges to administrator. 2. Multiple Linked XSS...

AXIS 70U - Network Document Server Privilege Escalation / Cross-Site Scripting

Digital Security Research Group DSecRG Advisory DSECRG-09-004 AXIS 70U Network Document Server - Privilege Escalation and XSS http://dsecrg.com/pages/vul/show.php?id=60 Application: AXIS 70U Network Document Server Web Interface Versions Affected: 3.0 Vendor URL: http://www.axis.com/ Bug: Local...

OpenSSL 'zlib'压缩内存泄漏远程拒绝服务漏洞

BUGTRAQ ID: 31692 CVE ID：CVE-2008-1678 CNCVE ID：CNCVE-20081678 OpenSSL是一种开放源码的SSL实现，用来实现网络通信的高强度加密。 OpenSSL 'zlib'压缩库存在一个内存泄漏问题，远程攻击者可以利用漏洞消耗大量内存而对服务程序进行拒绝服务攻击。 目前没有详细漏洞细节提供。 Axis Communications 2130 PTZ Network Camera 0.9.8h Axis Communications 2130 PTZ Network Camera 0.9.8g Axis Communications...

Backup Exec System Recovery Manager 7.0.1 - Arbitrary File Upload

Backup Exec System Recovery Manager 7.0.1 - Arbitrary File Upload File Upload POC Backup Exec System Recovery Manager 7.0File Upload POC :8443/axis/FileUpload" method="post" enctype="multipart/form-data" Remote Path: File to upload: cBastardLabs 2008. milw0rm.com 2008-02-07...

Backup Exec System Recovery Manager 7.0.1 - Arbitrary File Upload

File Upload POC Backup Exec System Recovery Manager 7.0File Upload POC :8443/axis/FileUpload" method="post" enctype="multipart/form-data" Remote Path: File to upload: cBastardLabs 2008. milw0rm.com 2008-02-07...

CVE-2003-1386

AXIS 2400 Video Server 2.00 through 2.33 allows remote attackers to obtain sensitive information via an HTTP request to /support/messages, which displays the server's /var/log/messages file...

CVE-2003-1386

Affected product: Axis 2400 Video Server 2.00–2.33. The vulnerability allows remote attackers to obtain sensitive information by requesting /support/messages, which displays the server’s /var/log/messages log. This is a network-based information disclosure with low attack complexity and no authen...

CVE-2003-1386: Undefined Security Weakness

AXIS 2400 Video Server 2.00 through 2.33 allows remote attackers to obtain sensitive information via an HTTP request to /support/messages, which displays the server's /var/log/messages file...

CVE-2007-5213

Multiple cross-site request forgery CSRF vulnerabilities in the AXIS 2100 Network Camera 2.02 with firmware 2.43 and earlier allow remote attackers to perform actions as administrators, as demonstrated by 1 an SMTP server change through the confSMTPMailServer1 parameter to ServerManager.srv and 2...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the AXIS 2100 Network Camera 2.02 with firmware 2.43 and earlier allow remote attackers to perform actions as administrators, as demonstrated by 1 an SMTP server change through the confSMTPMailServer1 parameter to ServerManager.srv and 2...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the AXIS 2100 Network Camera 2.02 with firmware before 2.43 allow remote attackers to inject arbitrary web script or HTML via 1 parameters associated with saved settings, as demonstrated by the confSMTPMailServer1 parameter to ServerManager.srv...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the AXIS 2100 Network Camera 2.02 with firmware 2.43 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the PATHINFO to the default URI associated with a directory, as demonstrated by a the root directory and b the...

CVE-2007-5212

Multiple cross-site scripting XSS vulnerabilities in the AXIS 2100 Network Camera 2.02 with firmware before 2.43 allow remote attackers to inject arbitrary web script or HTML via 1 parameters associated with saved settings, as demonstrated by the confSMTPMailServer1 parameter to ServerManager.srv...

CVE-2007-5214

Multiple cross-site scripting XSS vulnerabilities in the AXIS 2100 Network Camera 2.02 with firmware 2.43 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the PATHINFO to the default URI associated with a directory, as demonstrated by a the root directory and b the...

CVE-2007-5212

CVE-2007-5212: AXIS 2100 Network Camera 2.02 has multiple XSS vulnerabilities in firmware prior to 2.43. Attackers can inject arbitrary web script/HTML via (1) parameters tied to saved settings (e.g., conf_SMTP_MailServer1 in ServerManager.srv) and (2) the subpage parameter to wizard/first/wizard...

CVE-2007-5212

Multiple cross-site scripting XSS vulnerabilities in the AXIS 2100 Network Camera 2.02 with firmware before 2.43 allow remote attackers to inject arbitrary web script or HTML via 1 parameters associated with saved settings, as demonstrated by the confSMTPMailServer1 parameter to ServerManager.srv...

CVE-2007-5213

The CVE-2007-5213 entry describes CSRF vulnerabilities in the AXIS 2100 Network Camera 2.02 with firmware 2.43 and earlier. The affected component is the web management interface, where cross-site requests can perform administrator actions. Demonstrated vectors include (1) changing the SMTP serve...

CVE-2007-5214

Multiple cross-site scripting XSS vulnerabilities in the AXIS 2100 Network Camera 2.02 with firmware 2.43 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the PATHINFO to the default URI associated with a directory, as demonstrated by a the root directory and b the...