Basetech Ge-131 Bt-1837836 安全漏洞

The BASETech GE-131 BT-1837836 is a Wi-Fi IP CCTV camera. An arbitrary system command execution vulnerability exists in the BASETech GE-131 BT-1837836. The vulnerability stems from the device using default credentials for a telnet server. A remote attacker can exploit this vulnerability to execut...

PT-2020-16705

Name of the Vulnerable Software and Affected Versions BASETech GE-131 BT-1837836 firmware version 20180921 Description The issue allows local users to gain access to the video streaming username and password via SQLite files containing plain text credentials. This is due to an Unprotected Storage...

Basetech Ge-131 Bt-1837836 授权问题漏洞

The BASETech GE-131 BT-1837836 is a Wi-Fi IP CCTV camera. An information disclosure vulnerability exists in the BASETech GE-131 BT-1837836. An attacker can exploit the vulnerability to remotely access the video stream via an unrecorded user...

CVE-2020-27554: Cleartext Transmission of Sensitive Information

Cleartext Transmission of Sensitive Information vulnerability in BASETech GE-131 BT-1837836 firmware 20180921 exists which could leak sensitive information transmitted between the mobile app and the camera device...

CVE-2020-27558: Improper Authentication

Use of an undocumented user in BASETech GE-131 BT-1837836 firmware 20180921 allows remote attackers to view the video stream...

PT-2020-16703

Name of the Vulnerable Software and Affected Versions BASETech GE-131 BT-1837836 firmware version 20180921 Description The issue is related to the use of default credentials for the telnet server, allowing remote attackers to execute arbitrary system commands as the root user. This enables...

PT-2020-16701

Name of the Vulnerable Software and Affected Versions BASETech GE-131 BT-1837836 firmware version 20180921 Description The web-server in the system is configured with the option "DocumentRoot /etc", allowing an attacker with network access to download any files from the "/etc" folder without...

Pre-Authorization Limited Arbitrary File Read in Confluence Server - CVE-2020-29448

The ConfluenceResourceDownloadRewriteRule class in Confluence Server and Confluence Data Center allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check. h3. Affected versions: version 6.13.18 6.14.0 ≤ version 7.4....

lomisi1.ge Cross Site Scripting vulnerability OBB-1457841

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

vod.rustavi2.ge Cross Site Scripting vulnerability OBB-1450414

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

ge-technologies.com Cross Site Scripting vulnerability OBB-1444592

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

CVE-2020-16246 GE Reason S20 Ethernet Switch

The affected Reason S20 Ethernet Switch is vulnerable to cross-site scripting XSS, which may allow attackers to trick users into following a link or navigating to a page that posts a malicious JavaScript statement to the vulnerable site, causing the malicious JavaScript to be rendered by the site...

Denial of Service Vulnerability in GE PACsystem RX7i

PACsystem RX7i is an intelligent platform product from General Electric, often used for production control in steel, aluminum plants, automotive plants, nuclear power, and high-speed production lines. A denial of service vulnerability exists in GE PACsystem RX7i, which can be exploited by attacke...

CVE-2020-16242 GE Reason S20 Ethernet Switch

The affected Reason S20 Ethernet Switch is vulnerable to cross-site scripting XSS, which may allow an attacker to trick application users into performing critical application actions that include, but are not limited to, adding and updating accounts...

CVE-2020-16244

GE Digital APM Classic, Versions 4.4 and prior. Salt is not used for hash calculation of passwords, making it possible to decrypt passwords. This design flaw, along with the IDOR vulnerability, puts the entire platform at high risk because an authenticated user can retrieve all user account data...

CVE-2020-16244

GE Digital APM Classic, Versions 4.4 and prior. Salt is not used for hash calculation of passwords, making it possible to decrypt passwords. This design flaw, along with the IDOR vulnerability, puts the entire platform at high risk because an authenticated user can retrieve all user account data...

CVE-2020-16240

GE Digital APM Classic, Versions 4.4 and prior. An insecure direct object reference IDOR vulnerability allows user account data to be downloaded in JavaScript object notation JSON format by users who should not have access to such functionality. An attacker can download sensitive data related to...

CVE-2020-16240

GE Digital APM Classic, Versions 4.4 and prior. An insecure direct object reference IDOR vulnerability allows user account data to be downloaded in JavaScript object notation JSON format by users who should not have access to such functionality. An attacker can download sensitive data related to...

Design/Logic Flaw

GE Digital APM Classic, Versions 4.4 and prior. Salt is not used for hash calculation of passwords, making it possible to decrypt passwords. This design flaw, along with the IDOR vulnerability, puts the entire platform at high risk because an authenticated user can retrieve all user account data...

CVE-2020-16240

GE Digital APM Classic (Versions 4.4 and prior) is vulnerable to CVE-2020-16240: an Authorization Bypass Through User-Controlled Key (IDOR) that allows unauthorized users to download sensitive user‑account data in JSON . Root cause: insecure IDOR enabling data exfiltration. Affected product: GE D...