CVE-2013-3586

Samsung Web Viewer for Samsung DVR devices allows remote attackers to bypass authentication via an arbitrary SessionID value in a cookie...

CVE-2013-3586

CVE-2013-3586 affects Samsung Web Viewer for Samsung DVR devices. The vulnerability is an authentication bypass in cookie handling where any SessionID after SessionID= is accepted, enabling remote unauthenticated access to internal pages (including cameras and admin areas) and potentially exposin...

CVE-2013-3585

CVE-2013-3585 involves Samsung Web Viewer for Samsung DVR devices, where credentials are stored in cleartext (CWE-313). The vulnerability allows context-dependent attackers to obtain sensitive credentials via direct file access or through the user-setup web page. Connected sources also reference ...

AVTECH DVR Buffer Overflow / CAPTCHA Bypass

Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ AVTECH DVR multiple vulnerabilities 1. Advisory Information Title: AVTECH DVR multiple vulnerabilities Advisory ID: CORE-2013-0726 Advisory URL: http://www.coresecurity.com/advisories/avtech-dvr-multiple-vulnerabilities Date...

AVTECH DVR multiple vulnerabilities

Advisory ID Internal CORE-2013-0726 1. Advisory Information Title: AVTECH DVR multiple vulnerabilities Advisory ID: CORE-2013-0726 Advisory URL:http://www.coresecurity.com/advisories/avtech-dvr-multiple-vulnerabilities Date published: 2013-08-28 Date of last update: 2013-08-28 Vendors contacted:...

PT-2013-4498

Name of the Vulnerable Software and Affected Versions Samsung Web Viewer for Samsung DVR devices affected versions not specified Description The issue allows remote attackers to bypass authentication by using an arbitrary SessionID value in a cookie. No information is available about the estimate...

PT-2013-4497

Name of the Vulnerable Software and Affected Versions Samsung Web Viewer for Samsung DVR devices affected versions not specified Description The issue allows context-dependent attackers to obtain sensitive information. This can be achieved via two vectors: 1 direct access to a file or 2 the...

CVE-2013-3585: Undefined Security Weakness

Samsung Web Viewer for Samsung DVR devices stores credentials in cleartext, which allows context-dependent attackers to obtain sensitive information via vectors involving 1 direct access to a file or 2 the user-setup web page...

Samsung DVR Firmware 1.10 - Authentication Bypass Vulnerability

Exploit for hardware platform in category web applications Title: Samsung DVR authentication bypass Version affected: firmware version = 1.10 Vendor: Samsung - www.samsung-security.com Discovered by: Andrea Fabrizi Email: email protected Web: http://www.andreafabrizi.it Twitter: @andreaf83 Status...

Samsung Web Viewer for Samsung DVR allows authentication bypass and password disclosure

Overview Samsung Web Viewer for Samsung DVR contains multiple vulnerabilities including: Cleartext Storage in a File or on Disk CWE-313 and Authentication Bypass by Assumed-Immutable Data CWE-302. Description CWE-313: Cleartext Storage in a File or on Disk - CVE-2013-3585Web Viewer for Samsung DV...

Samsung DVR Firmware 1.10 - Authentication Bypass

Samsung DVR Firmware 1.10 - Authentication Bypass Title: Samsung DVR authentication bypass Version affected: firmware version = 1.10 Vendor: Samsung - www.samsung-security.com Discovered by: Andrea Fabrizi Email: [email protected] Web: http://www.andreafabrizi.it Twitter: @andreaf83 Status...

Samsung DVR Firmware 1.10 - Authentication Bypass

Title: Samsung DVR authentication bypass Version affected: firmware version = 1.10 Vendor: Samsung - www.samsung-security.com Discovered by: Andrea Fabrizi Email: [email protected] Web: http://www.andreafabrizi.it Twitter: @andreaf83 Status: unpatched Samsung provides a wide range of DVR...

Samsung DVR Authentication Bypass

The remote Samsung DVR is prone to an Authentication Bypass. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Samsung DVR Authentication Bypass

Title: Samsung DVR authentication bypass Version affected: firmware version = 1.10 Vendor: Samsung - www.samsung-security.com Discovered by: Andrea Fabrizi Email: [email protected] Web: http://www.andreafabrizi.it Twitter: @andreaf83 Status: unpatched Samsung provides a wide range of DVR...

Multiple DVR HTTP Server Directory Traversal Vulnerability - Active Check

The thttpd running on the remote DVR is prone to a directory traversal vulnerability because it fails to sufficiently sanitize user-supplied input. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective...

PT-2013-61: Disclosure of sensitive information in Web Viewer for Samsung DVR

The specialists of the Positive Research center have detected "Disclosure of sensitive information" vulnerability associated with Absence of Password Hashing in Web Viewer for Samsung DVR. Users credentials logins and passwords are stored in plaintext at pages, not hashed or encrypted. This...

PT-2013-62: Internal Network Resources Access in Web Viewer for Samsung DVR

The specialists of the Positive Research center have detected "Internal Network Resources Access" vulnerability in Web Viewer for Samsung DVR. The vulnerability allows attackers to get unauthorized access to view and control the cameras via unsafe cookies parsing. If an attacker sends the request...

Hunt CCTV DVR.cfg Direct Request Information Disclosure

The remote web server appears to be part of a digital video recorder DVR, such as models of Hunt CCTV, that is affected by an information disclosure vulnerability. Specifically, an unauthenticated remote attacker can retrieve the device's configuration file, 'DVR.cfg', which contains sensitive...

Multiple DVR Information Disclosure Vulnerability

Multiple DVR devices are prone to a remote information- disclosure vulnerability. Successful exploits will allow attackers to obtain sensitive information, such as credentials, that may aid in further attacks from SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted...

Multiple DVR Manufacturers Configuration Disclosure

This module takes advantage of an authentication bypass vulnerability at the web interface of multiple manufacturers DVR systems, which allows to retrieve the device configuration. This module requires Metasploit: https://metasploit.com/download Current source:...