za-internet C-MOR Video Surveillance 安全漏洞

za-internet C-MOR Video Surveillance is a network video surveillance system from the German company za-internet. A security vulnerability exists in za-internet C-MOR Video Surveillance version 5.2401, which stems from improper input validation and results in unrestricted file uploads...

PT-2024-31455

Name of the Vulnerable Software and Affected Versions za-internet C-MOR Video Surveillance version 5.2401 Description An issue was discovered due to improper user input validation, allowing the upload of dangerous files, such as PHP code, to the system. The upload functionality for backup files...

PT-2024-31460

Name of the Vulnerable Software and Affected Versions za-internet C-MOR Video Surveillance version 5.2401 Description An issue was discovered due to improper input validation, making the C-MOR web interface vulnerable to reflected cross-site scripting XSS attacks. Different functions are prone to...

PT-2024-31457

Name of the Vulnerable Software and Affected Versions za-internet C-MOR Video Surveillance version 5.2401 Description An issue was discovered due to improper privilege management concerning sudo privileges, making C-MOR vulnerable to a privilege escalation attack. The Linux user www-data running...

PT-2024-31459

Name of the Vulnerable Software and Affected Versions za-internet C-MOR Video Surveillance version 5.2401 Description An issue was discovered where sensitive information, such as login credentials of cameras, is stored in cleartext. This allows an attacker with filesystem access, potentially gain...

za-internet C-MOR Video Surveillance 安全漏洞

za-internet C-MOR Video Surveillance is a network video surveillance system from the German company za-internet. A security vulnerability exists in za-internet C-MOR Video Surveillance version 5.2401, which originates from sensitive information being stored in plaintext...

CVE-2024-45171

The za-internet C-MOR Video Surveillance system, version 5.2401 , is vulnerable to an unrestricted upload of files with dangerous types (CWE-434) due to improper user input validation. A low-privileged authenticated user can exploit the backup file upload functionality by providing a filename con...

CVE-2024-45173

The za-internet C-MOR Video Surveillance software (affected versions 5.2401 and 6.00PL01 ) contains a privilege escalation vulnerability due to improper privilege management regarding sudo permissions. Specifically, the www-data Linux user, which runs the web interface, can execute certain OS com...

CVE-2024-45171

An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper user input validation, it is possible to upload dangerous files, for instance PHP code, to the C-MOR system. By analyzing the C-MOR web interface, it was found out that the upload functionality for backup file...

CVE-2024-45173

An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper privilege management concerning sudo privileges, C-MOR is vulnerable to a privilege escalation attack. The Linux user www-data running the C-MOR web interface can execute some OS commands as root via Sudo...

CVE-2024-45171: Unrestricted Upload of File with Dangerous Type

An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper user input validation, it is possible to upload dangerous files, for instance PHP code, to the C-MOR system. By analyzing the C-MOR web interface, it was found out that the upload functionality for backup file...

CVE-2024-45178: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper user input validation, it is possible to download arbitrary files from the C-MOR system via a path traversal attack. It was found out that different functionalities are vulnerable to path traversal attacks, du...

CVE-2024-45176: Improper Neutralization of Input During Web Page Generation

An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper input validation, the C-MOR web interface is vulnerable to reflected cross-site scripting XSS attacks. It was found out that different functions are prone to reflected cross-site scripting attacks due to...

CVE-2024-45175: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Sensitive information is stored in cleartext. It was found out that sensitive information, for example login credentials of cameras, is stored in cleartext. Thus, an attacker with filesystem access, for example exploiting a...

CVE-2024-45173: Improper Privilege Management

An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper privilege management concerning sudo privileges, C-MOR is vulnerable to a privilege escalation attack. The Linux user www-data running the C-MOR web interface can execute some OS commands as root via Sudo...

CVE-2024-45172

An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. Due to missing protection mechanisms, the C-MOR web interface is vulnerable to cross-site request forgery CSRF attacks. The C-MOR web interface offers no protection against cross-site request forgery CSRF attacks...

CVE-2024-45177

An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. Due to improper input validation, the C-MOR web interface is vulnerable to persistent cross-site scripting XSS attacks. It was found out that the camera configuration is vulnerable to a persistent cross-site...

CVE-2024-45174

An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. Due to improper validation of user-supplied data, different functionalities of the C-MOR web interface are vulnerable to SQL injection attacks. This kind of attack allows an authenticated user to execute arbitrar...

CVE-2024-45170

An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper or missing access control, low privileged users can use administrative functions of the C-MOR web interface. It was found out that different functions are only available to administrative users. However, acces...

CVE-2024-45170

An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper or missing access control, low privileged users can use administrative functions of the C-MOR web interface. It was found out that different functions are only available to administrative users. However, acces...