Cross site request forgery (csrf)

Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, the config/save and config/set endpoints of Frigate do not implement any CSRF protection. This makes it possible for a request sourced from another site to update the configuration of the Frigate server e.g. via...

CVE-2023-45672

Frigate (open source NVR) contains an unsafe deserialization vulnerability in the configuration save path. The issue arises from loading user input via http.py into load_config_with_no_duplicates using yaml.loader.Loader, which can instantiate custom constructors and execute a payload at frigate/...

CVE-2023-45672 Frigate unsafe deserialization in `load_config_with_no_duplicates` of `frigate/util/builtin.py`

Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, an unsafe deserialization vulnerability was identified in the endpoints used to save configurations for Frigate. This can lead to unauthenticated remote code execution. This can be performed through the UI at /confi...

CVE-2023-45671

Frigate is an open‑source network video recorder. Prior to version 0.13.0 Beta 3, a reflected cross‑site scripting (XSS) vulnerability exists in API endpoints that rely on the / base path; values in the URL are not sanitized, enabling arbitrary JavaScript execution when an authenticated user is t...

CVE-2023-45671 Frigate reflected XSS through `/<camera_name>` API endpoints

Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, there is a reflected cross-site scripting vulnerability in any API endpoints reliant on the / base path as values provided for the path are not sanitized. Exploiting this vulnerability requires the attacker to both...

CVE-2023-45671 Frigate reflected XSS through `/<camera_name>` API endpoints

Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, there is a reflected cross-site scripting vulnerability in any API endpoints reliant on the / base path as values provided for the path are not sanitized. Exploiting this vulnerability requires the attacker to both...

CVE-2023-45670

CVE-2023-45670 : Frigate before 0.13.0 Beta 3 exposes a CSRF vulnerability in the config/save and config/set endpoints, allowing an attacker to trigger arbitrary configuration updates on a Frigate server via a crafted link. Exploitation requires the attacker to know specific server details and pe...

CVE-2023-45670 Frigate cross-site request forgery in `config_save` and `config_set` request handlers

Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, the config/save and config/set endpoints of Frigate do not implement any CSRF protection. This makes it possible for a request sourced from another site to update the configuration of the Frigate server e.g. via...

CVE-2023-45670 Frigate cross-site request forgery in `config_save` and `config_set` request handlers

Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, the config/save and config/set endpoints of Frigate do not implement any CSRF protection. This makes it possible for a request sourced from another site to update the configuration of the Frigate server e.g. via...

PT-2023-29639 · Frigate · Frigate

Name of the Vulnerable Software and Affected Versions: Frigate versions prior to 0.13.0 Beta 3 Description: Frigate is an open source network video recorder. The config/save and config/set endpoints of Frigate do not implement any CSRF protection, making it possible for a request sourced from...

Frigate Cross-Site Request Forgery Vulnerability

Frigate is a complete local NVR designed for home assistants with AI object detection from the individual developer Blake Blackshear. A cross-site request forgery vulnerability exists in Frigate versions prior to 0.13.0 Beta 3, which stems from a cross-site request forgery CSRF vulnerability in t...

Frigate Cross-Site Scripting Vulnerability

Frigate is a complete local NVR designed for home assistants with AI object detection from the individual developer Blake Blackshear. A cross-site scripting vulnerability exists in versions prior to Frigate 0.13.0 Beta 3. The vulnerability stems from the presence of a Reflected Cross-Site Scripti...

PT-2023-29640 · Frigate · Frigate

Name of the Vulnerable Software and Affected Versions: Frigate versions prior to 0.13.0 Beta 3 Description: Frigate is an open source network video recorder. There is a reflected cross-site scripting vulnerability in any API endpoints reliant on the / base path with a / parameter, as values...

Frigate Code Issue Vulnerability

Frigate is a complete local NVR designed for home assistants with AI object detection by Blake Blackshear Personal Developer. A code issue vulnerability exists in versions prior to Frigate 0.13.0 Beta 3 that stems from the presence of an insecure deserialization vulnerability that could lead to...

PT-2023-29641 · Frigate · Frigate

Name of the Vulnerable Software and Affected Versions: Frigate versions prior to 0.13.0 Beta 3 Description: Frigate is an open source network video recorder. An unsafe deserialization vulnerability was identified in the endpoints used to save configurations for Frigate, which can lead to...

Frigate Professional 'Pack File' Buffer Overflow Vulnerability

Frigate is a free file management software for Windows only, with basic copy, duplicate, delete files or directories, create directories, change file names and more. A buffer overflow vulnerability exists in Frigate Professional 'Pack File', which can be exploited by an attacker to execute...

Frigate Professional 3.36.0.9 - 'Pack File' Buffer Overflow (SEH Egghunter)

Exploit Title: Frigate Professional 3.36.0.9 - 'Pack File' Buffer Overflow SEH Egghunter Date: 2020-07-24 Exploit Author: MasterVlad Vendor Homepage: http://www.frigate3.com/ Software Link: http://www.frigate3.com/download/frigate3pro.exe Version: 3.36.0.9 Vulnerability Type: Local Buffer Overflo...

Frigate Professional 3.36.0.9 - (Pack File) Buffer Overflow (SEH Egghunter) Exploit

Exploit Title: Frigate Professional 3.36.0.9 - 'Pack File' Buffer Overflow SEH Egghunter Exploit Author: MasterVlad Vendor Homepage: http://www.frigate3.com/ Software Link: http://www.frigate3.com/download/frigate3pro.exe Version: 3.36.0.9 Vulnerability Type: Local Buffer Overflow Tested on:...

Frigate Professional 3.36.0.9 Local Buffer Overflow

Exploit Title: Frigate Professional 3.36.0.9 - 'Pack File' Buffer Overflow SEH Egghunter Date: 2020-07-24 Exploit Author: MasterVlad Vendor Homepage: http://www.frigate3.com/ Software Link: http://www.frigate3.com/download/frigate3pro.exe Version: 3.36.0.9 Vulnerability Type: Local Buffer Overflo...

Frigate 2.02 - Denial Of Service Exploit

Exploit Title: Frigate 2.02 - Denial Of Service PoC Vendor Homepage: http://www.frigate3.com/ Software Link Download: http://www.frigate3.com/download/Frigate2.exe Exploit Author: Paras Bhatia Vulnerable Software: Frigate Version: 2.02 Vulnerability Type: Denial of Service DoS Tested on: Windows ...