Citilog security vulnerabilities

Citilog is a video analytics and artificial intelligence application for traffic management solutions from Citilog. A security vulnerability exists in Citilog version 8.0 that stems from the presence of an authentication degradation issue. An attacker could exploit the vulnerability to achieve HT...

CVE-2022-28860

An authentication downgrade in the server in Citilog 8.0 allows an attacker in a man in the middle position between the server and its smart camera Axis M1125 to achieve HTTP access to the camera...

CVE-2022-28860

The CVE-2022-28860 entry describes an authentication downgrade in the Citilog 8.0 server when communicating with the Axis M1125 smart camera, allowing an attacker in a man‑in‑the‑middle position to gain HTTP access to the camera. Affected component: Citilog 8.0 server; vulnerable path involves th...

Ring shares data with police without consent (but it’s in good faith), says Amazon

Ring, the Amazon-owned company behind the popular smart doorbells, has admitted to giving doorbell data to law enforcement willy-nilly. All they have to do is fill out a form called the Amazon Law Enforcement Request Tracker—no need to ask for the data owners consent, give a warrant or court orde...

CVE-2022-34537

Digital Watchdog DW MEGApix IP cameras A7.2.220211029 was discovered to contain a cross-site scripting XSS vulnerability via the component biaoneshot.cgi...

CVE-2022-34538

Digital Watchdog DW MEGApix IP cameras A7.2.220211029 was discovered to contain a command injection vulnerability in the component /admin/vca/bia/addacph.cgi. This vulnerability is exploitable via a crafted POST request...

CVE-2022-34537

Digital Watchdog DW MEGApix IP cameras A7.2.220211029 was discovered to contain a cross-site scripting XSS vulnerability via the component biaoneshot.cgi...

Command injection

Digital Watchdog DW MEGApix IP cameras A7.2.220211029 was discovered to contain a command injection vulnerability in the component /admin/vca/bia/addacph.cgi. This vulnerability is exploitable via a crafted POST request...

Digital Watchdog DW MEGApix IP Authorization Issue Vulnerability

Digital Watchdog DW MEGApix IP is a camera from Digital Watchdog. A security vulnerability exists in Digital Watchdog DW MEGApix IP cameras version A7.2.220211029, which stems from a vulnerability that allows an attacker to access core log files and perform session hijacking via a crafted session...

Digital Watchdog DW MEGApix IP Authorization Issue Vulnerability

Digital Watchdog DW MEGApix IP is a camera from Digital Watchdog. A security vulnerability exists in Digital Watchdog DW MEGApix IP cameras version A7.2.220211029, which originates from a vulnerability that allows an unauthenticated attacker to view internal paths and scripts via a web file...

CVE-2022-30621

Allows a remote user to read files on the camera's OS "GetFileContent.cgi". Reading arbitrary files on the camera's OS as root user...

CVE-2022-30621

Allows a remote user to read files on the camera's OS "GetFileContent.cgi". Reading arbitrary files on the camera's OS as root user...

CVE-2022-30620

On Cellinx Camera with guest enabled, attacker with web access can elevate privileges to administrative: "1" to "0" privileges by changing the following cookie values from "isadmin", "showConfig". Administrative Privileges which allows changing various configuration in the camera...

CVE-2022-30620

On Cellinx Camera with guest enabled, attacker with web access can elevate privileges to administrative: "1" to "0" privileges by changing the following cookie values from "isadmin", "showConfig". Administrative Privileges which allows changing various configuration in the camera...

Design/Logic Flaw

On Cellinx Camera with guest enabled, attacker with web access can elevate privileges to administrative: "1" to "0" privileges by changing the following cookie values from "isadmin", "showConfig". Administrative Privileges which allows changing various configuration in the camera...

CVE-2022-30621

CVE-2022-30621 affects Cellinx NVT IP PTZ cameras. A vulnerable component/function is GetFileContent.cgi that enables a remote attacker to read arbitrary files on the camera’s OS as root, indicating a local file inclusion-like exposure. The connected documents confirm the issue and describe the r...

CVE-2022-30621 Cellinx NVT – IP PTZ Camera local file inclusion

Allows a remote user to read files on the camera's OS "GetFileContent.cgi". Reading arbitrary files on the camera's OS as root user...

CVE-2022-30620 Cellinx NVT – IP PTZ Camera Privilege Escalation

On Cellinx Camera with guest enabled, attacker with web access can elevate privileges to administrative: "1" to "0" privileges by changing the following cookie values from "isadmin", "showConfig". Administrative Privileges which allows changing various configuration in the camera...

CVE-2022-30620

The CVE-2022-30620 entry concerns Cellinx Camera (guest-enabled) where an attacker with web access can elevate from guest to administrative privileges by modifying cookie values (notably is_admin and showConfig), enabling changes to camera configuration. Connected sources corroborate privilege es...

PT-2022-20214

Name of the Vulnerable Software and Affected Versions No specific software or version is mentioned in the provided descriptions. Description The issue allows a remote user to read files on the camera's OS using "GetFileContent.cgi". This enables reading arbitrary files on the camera's OS as the...