CVE-2020-37157: Missing Authentication for Critical Function

DBPower C300 HD Camera contains a configuration disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive credentials through an unprotected configuration backup endpoint. Attackers can download the configuration file and extract hardcoded username and password by...

DBPower C300 HD Camera 访问控制错误漏洞

The DBPower C300 HD Camera is a camera produced by the American company DBPower. The DBPower C300 HD Camera has a access control vulnerability, which stems from unprotected configuration of backup endpoints. This vulnerability may allow unverified attackers to retrieve hardcoded credentials...

CVE-2020-37157 DBPower C300 HD Camera - Remote Configuration Disclosure

DBPower C300 HD Camera contains a configuration disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive credentials through an unprotected configuration backup endpoint. Attackers can download the configuration file and extract hardcoded username and password by...

CVE-2020-37157

CVE-2020-37157 affects DBPower C300 HD Camera. A configuration disclosure vulnerability allows unauthenticated attackers to download the unprotected /tmpfs/config_backup.bin and extract hardcoded credentials (username/password). Documented impact is credential exposure with high confidentiality i...

CVE-2020-37157

DBPower C300 HD Camera contains a configuration disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive credentials through an unprotected configuration backup endpoint. Attackers can download the configuration file and extract hardcoded username and password by...

PT-2026-6824

Name of the Vulnerable Software and Affected Versions DBPower C300 HD Camera affected versions not specified Description The DBPower C300 HD Camera has a configuration disclosure issue. Unauthenticated attackers can obtain sensitive credentials by accessing an unprotected configuration backup...

DBPower C300 HD Camera - Remote Configuration Disclosure Exploit

Exploit for hardware platform in category web applications Exploit Title: DBPower C300 HD Camera - Remote Configuration Disclosure Author: Todor Donev Vendor: https://donev.eu/ CVE: N/A Copyright 2020 c Todor Donev https://donev.eu/ https://donev.eu/blog/dbpower-c300-multiple-vulnerabilities...

DBPower C300 HD Camera Remote Configuration Disclosure

!/usr/bin/perl DBPower C300 HD Camera Remote Configuration Disclosure Copyright 2020 c Todor Donev https://donev.eu/ https://donev.eu/blog/dbpower-c300-multiple-vulnerabilities Disclaimer: This or previous programs are for Educational purpose ONLY. Do not use it without permission. The usual...

CVE-2017-3209

The DBPOWER U818A WIFI quadcopter drone provides FTP access over its own local access point, and allows full file permissions to the anonymous user. The DBPower U818A WIFI quadcopter drone runs an FTP server that by default allows anonymous access without a password, and provides full filesystem...

Design/Logic Flaw

The DBPOWER U818A WIFI quadcopter drone provides FTP access over its own local access point, and allows full file permissions to the anonymous user. The DBPower U818A WIFI quadcopter drone runs an FTP server that by default allows anonymous access without a password, and provides full filesystem...

CVE-2017-3209 The DBPOWER U818A WIFI quadcopter drone provides FTP access over its own local access point, and allows full file permissions to the anonymous user

The DBPOWER U818A WIFI quadcopter drone provides FTP access over its own local access point, and allows full file permissions to the anonymous user. The DBPower U818A WIFI quadcopter drone runs an FTP server that by default allows anonymous access without a password, and provides full filesystem...

CVE-2017-3209

The CVE-2017-3209 entry concerns the DBPOWER U818A WIFI quadcopter drone, which runs an FTP server on its local AP that by default allows anonymous access with full filesystem permissions. The anonymous user can read arbitrary files (e.g., images/videos) and even replace system files such as /etc...

PT-2018-7256

Name of the Vulnerable Software and Affected Versions: DBPOWER U818A WIFI quadcopter drone affected versions not specified Description: The issue concerns the DBPOWER U818A WIFI quadcopter drone, which provides FTP access over its local access point and allows full file permissions to the anonymo...

CVE-2017-3209: Incorrect Default Permissions

The DBPOWER U818A WIFI quadcopter drone provides FTP access over its own local access point, and allows full file permissions to the anonymous user. The DBPower U818A WIFI quadcopter drone runs an FTP server that by default allows anonymous access without a password, and provides full filesystem...

DJI Launches Drone Bug Bounty Program

The lack of security in commercial drones has been well documented, but one Chinese manufacturer is working to fix that by incentivizing researchers who can poke holes in the software its drones run on. One of the largest unmanned aerial vehicle manufacturers, Dà-Jiāng Innovations Science and...

DBPOWER U818A WIFI quadcopter drone allows full filesystem permissions to anonymous FTP

Overview The DBPOWER U818A WIFI quadcopter drone provides FTP access over its own local access point, and allows full file permissions to the anonymous user. Description The DBPOWER U8181A WIFI quadcopter drone is designed to record images and video from the air. The drone provides an undocumente...

dBpower AMP Audio Player 2 Buffer Overflow

' Exploit Title: dBpowerAMP Audio Player 2 FileExists ActiveX Buffer Overflow ' Author: Hadji Samir ,[email protected] ' Tested on: Windows XP SP2 FR / IE6 ' Down : http://www.dbpoweramp.com/bin/dBpowerAMP-r2.exe buffer=String352, "A" jmp=unescape"%65%82%A6%7C" 'jmp esp from shell32.dll 0x7CA68265...