CVE-2024-41623

CVE-2024-41623 affects D3D Security D3D IP Camera (D8801) with v.V9.1.17.1.4-20180428. A local attacker can execute arbitrary code via a crafted payload. The connected PT-2024-29468 report specifies exploitation details: an unauthenticated attacker can trigger the issue by fuzzing with HTTP GET r...

CVE-2024-41623: Improper Control of Generation of Code

An issue in D3D Security D3D IP Camera D8801 v.V9.1.17.1.4-20180428 allows a local attacker to execute arbitrary code via a crafted payload...

PT-2024-29468 · D3D Security · D3D Ip Camera

Name of the Vulnerable Software and Affected Versions: D3D Security D3D IP Camera D8801 version V9.1.17.1.4-20180428 Description: An issue in the D3D Security D3D IP Camera allows a local attacker to execute arbitrary code via a crafted payload. Recommendations: For version V9.1.17.1.4-20180428, ...

CVE-2024-39091

An OS command injection vulnerability in the ccmdebug component of MIPC Camera firmware prior to v5.4.1.240424171021 allows attackers within the same network to execute arbitrary code via a crafted HTML request...

CVE-2024-39091

An OS command injection vulnerability in the ccmdebug component of MIPC Camera firmware prior to v5.4.1.240424171021 allows attackers within the same network to execute arbitrary code via a crafted HTML request...

CVE-2024-7616

A vulnerability was found in Edimax IC-6220DC and IC-5150W up to 3.06. It has been rated as critical. Affected by this issue is the function cgiFormString of the file ipcamcgi. The manipulation of the argument host leads to command injection. NOTE: The vendor was contacted early about this...

CVE-2024-39091: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability in the ccmdebug component of MIPC Camera firmware prior to v5.4.1.240424171021 allows attackers within the same network to execute arbitrary code via a crafted HTML request...

CVE-2024-39091

CVE-2024-39091 affects MIPC Camera firmware prior to v5.4.1.240424171021, where an OS command injection in the ccm_debug component lets attackers on the same network run arbitrary code via a crafted HTML request. Public sources (Red Hat, CNNVD, CVE listings, PT Security) confirm the vulnerability...

CVE-2024-39091

An OS command injection vulnerability in the ccmdebug component of MIPC Camera firmware prior to v5.4.1.240424171021 allows attackers within the same network to execute arbitrary code via a crafted HTML request...

CVE-2024-39091

An OS command injection vulnerability in the ccmdebug component of MIPC Camera firmware prior to v5.4.1.240424171021 allows attackers within the same network to execute arbitrary code via a crafted HTML request...

CVE-2024-7616 Edimax IC-6220DC/IC-5150W ipcam_cgi cgiFormString command injection

A vulnerability was found in Edimax IC-6220DC and IC-5150W up to 3.06. It has been rated as critical. Affected by this issue is the function cgiFormString of the file ipcamcgi. The manipulation of the argument host leads to command injection. NOTE: The vendor was contacted early about this...

gotortc vulnerable to Cross-Site Request Forgery

gotortc is a camera streaming application. Versions 1.8.5 and prior are vulnerable to Cross-Site Request Forgery. The /api/config endpoint allows one to modify the existing configuration with user-supplied values. While the API is only allowing localhost to interact without authentication, an...

gotortc Cross-site Scripting vulnerability

gotortc is a camera streaming application. Versions 1.8.5 and prior are vulnerable to DOM-based cross-site scripting. The index page index.html shows the available streams by fetching the API in the client side. Then, it uses Object.entries to iterate over the result whose first item name gets...

gotortc Cross-site Scripting vulnerability

gotortc is a camera streaming application. Versions 1.8.5 and prior are vulnerable to DOM-based cross-site scripting. The links page links.html appends the src GET parameter 0 in all of its links for 1-click previews. The context in which src is being appended is innerHTML 1, which will insert th...

GHSA-QGJ8-G9Q4-7F2P gotortc vulnerable to Cross-Site Request Forgery

gotortc is a camera streaming application. Versions 1.8.5 and prior are vulnerable to Cross-Site Request Forgery. The /api/config endpoint allows one to modify the existing configuration with user-supplied values. While the API is only allowing localhost to interact without authentication, an...

GHSA-WV8X-3W6R-6H7V gotortc Cross-site Scripting vulnerability

gotortc is a camera streaming application. Versions 1.8.5 and prior are vulnerable to DOM-based cross-site scripting. The links page links.html appends the src GET parameter 0 in all of its links for 1-click previews. The context in which src is being appended is innerHTML 1, which will insert th...

gotortc Cross-site Scripting vulnerability

gotortc is a camera streaming application. Versions 1.8.5 and prior are vulnerable to DOM-based cross-site scripting. The index page index.html shows the available streams by fetching the API in the client side. Then, it uses Object.entries to iterate over the result whose first item name gets...

Vivotek IB8367A 命令注入漏洞

Vivotek IB8367A is a network camera from China VIVOTEK Communications Vivotek. The Vivotek IB8367A VVTK-0100b suffers from a command injection vulnerability that stems from the parameter QUERYSTRING in the file uploadfile.cgi that can lead to command injection...

PT-2024-38350 · Vivotek · Vivotek Cc8160

Name of the Vulnerable Software and Affected Versions: Vivotek CC8160 VVTK-0100d affected versions not specified Description: A critical vulnerability affects the function getenv of the file upload file.cgi. The manipulation of the argument QUERY STRING leads to command injection. It is possible ...

Vivotek CC8160 安全漏洞

The Vivotek CC8160 is a 2MP highly striped network camera from China VIVOTEK Communications Vivotek. A security vulnerability exists in the Vivotek CC8160 VVTK-0100d version, which stems from the parameter QUERYSTRING in the file uploadfile. cgi that can lead to command injection...