NUUO Multiple OS Command Injection Vulnerabilities

Summary NUUO NVRmini 2 is the lightweight, portable NVR solution with NAS functionality. Setup is simple and easy, with automatic port forwarding settings built in. NVRmini 2 supports POS integration, making this the perfect solution for small retail chain stores. NVRmini 2 also comes full equipp...

NUUO NVRmini 2 3.0.8 - Arbitrary File Deletion

NUUO Arbitrary File Deletion Vulnerability Vendor: NUUO Inc. Product web page: http://www.nuuo.com Affected version: ================================================================== Tested on: GNU/Linux 3.0.8 armv7l GNU/Linux 2.6.31.8 armv5tel lighttpd/1.4.28 PHP/5.5.3 Vulnerability discovered...

NUUO NVRmini2 NVRsolo Crystal Devices NETGEAR ReadyNAS Surveillance Application - Multiple Vulnerabilities

NUUO NVRmini2 NVRsolo Crystal Devices NETGEAR ReadyNAS Surveillance Application - Multiple Vulnerabilities Multiple vulnerabilities in NUUO NVRmini2 / NVRsolo / Crystal devices and NETGEAR ReadyNAS Surveillance application Discovered by Pedro Ribeiro [email protected], Agile Information Security...

NUUO NVRmini2 / NVRsolo / Crystal Devices / Netgear ReadyNAS Surveillance Application - Multiple Vul

Exploit for hardware platform in category remote exploits Multiple vulnerabilities in NUUO NVRmini2 / NVRsolo / Crystal devices and NETGEAR ReadyNAS Surveillance application Discovered by Pedro Ribeiro email protected, Agile Information Security http://www.agileinfosec.co.uk/...

NUUO NVRmini 2 / NETGEAR ReadyNAS Surveillance Unauthenticated Remote Code Execution

The NVRmini 2 Network Video Recorder and the ReadyNAS Surveillance application are vulnerable to an unauthenticated remote code execution on the exposed web administration interface. This results in code execution as root in the NVRmini and the 'admin' user in ReadyNAS. This exploit has been test...

NUUO NVRmini2 / NVRsolo / Crystal And NETGEAR ReadyNAS Code Execution

Multiple vulnerabilities in NUUO NVRmini2 / NVRsolo / Crystal devices and NETGEAR ReadyNAS Surveillance application Discovered by Pedro Ribeiro [email protected], Agile Information Security http://www.agileinfosec.co.uk/ ==========================================================================...

Zhejiang uniview technologies security(DVR/NVR)and other monitoring equipment command execution

In file /Interface/DevManage/VM.php in: code area .............. Code omitted.................... // Set the DNS to resolve the server address case 'setDNSServer' : shellexec'echo "nameserver '. 'DNSServerAdrr'.'"'.' /etc/resolv. conf'; 'Code' = 0; getTip; echo jsonencode; break; default :...

Netgear ReadyNAS Remote Code Execution

Unauthenticated Remote Command Execution in Netgear ReadyNAS Surveillance ========================================================================= Product Description =================== Netgear ReadyNAS Surveillance is a NVR Network Video Recorder available for Netgear NAS systems. Vulnerabilit...

D-Link NAS / NVR multiple security vulnerabilities

More than 50 different vulnerabilities...

[SEARCH-LAB advisory] More than fifty vulnerabilities in D-Link NAS and NVR devices

Overwiew -------- SEARCH-LAB performed an independent security assessment on four different D-Link devices. The assessment has identified altogether 53 unique vulnerabilities in the latest firmware dated 30-07-2014. Several vulnerabilities can be abused by a remote attacker to execute arbitrary...

Hikvision DS-7108HWI-SH XML Injection / Abuse Issues

Hello list! There are vulnerabilities in Hikvision DS-7108HWI-SH. These are XML Injection, Abuse of Functionality and Brute Force vulnerabilities. All these vulnerabilities are present in other IP cameras and DVR of Hikvision. ------------------------- Affected vendors: -------------------------...

Hikvision DS-2CD2012-I XML Injection / Abuse Issues

Hello list! There are vulnerabilities in Hikvision DS-2CD2012-I. These are XML Injection, Abuse of Functionality and Brute Force vulnerabilities. All these vulnerabilities are present in other IP cameras and DVR of Hikvision. ------------------------- Affected vendors: -------------------------...

java-1.8.0-openjdk security update

1:1.8.0.45-30.b13 - repacked sources - Resolves: RHBZ1209076 1:1.8.0.45-7.b13 - Re-add %name prefix to patches to avoid conflicts with OpenJDK 7 versions. - Remove ppc64le test case now fix has been verified. - Resolves: rhbz1194378 1:1.8.0.45-27.b13 - updated to security u45 - minor sync with 7....

NVR SP2 2.0 (nvUnifiedControl.dll 1.1.45.0) - SetText() Remote Exploit

No description provided by source. ------------------------------------------------------------------------------------------ PoC2 NVR SP2 2.0 nvUnifiedControl.AUnifiedControl.1 nvUnifiedControl.dll v. 1.1.45.0 SetText Remote BoF Heap Spray Technique url: http://www.acti.com/index.asp author:...

NVR SP2 2.0 (nvUtility.dll 1.0.14.0) - DeleteXMLFile() Inscure Method

No description provided by source. ---------------------------------------------------------------------------------------------- NVR SP2 2.0 nvUtility.Utility.1 nvUtility.dll v. 1.0.14.0 DeleteXMLFile Inscure Method url: http://www.acti.com/index.asp author: shinnai mail: shinnaiatautisticidotor...

NVR SP2 2.0 (nvUtility.dll 1.0.14.0) - SaveXMLFile() Inscure Method

No description provided by source. -------------------------------------------------------------------------------------------- NVR SP2 2.0 nvUtility.Utility.1 nvUtility.dll v. 1.0.14.0 SaveXMLFile Inscure Method url: http://www.acti.com/index.asp author: shinnai mail: shinnaiatautisticidotorg...

airVisionNVR 1.1.13 readfile() Disclosure and SQL Injection

No description provided by source. Exploit Title: airVisionNVR readfile disclosure and sql injection Google Dork: Date: Oct 13, 2012 Exploit Author: pennyGrit Vendor Homepage: http://www.ubnt.com/ Software Link: http://www.ubnt.com/downloads/airvision/airVision-v1.1.3-installer.exe Version: 1.1.1...

CVE-2013-0144

Cross-site request forgery CSRF vulnerability in cgi-bin/createuser.cgi on QNAP VioStor NVR devices with firmware 4.0.3 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts via a NEW USER action...

CVE-2013-0142

QNAP VioStor NVR devices with firmware 4.0.3, and the Surveillance Station Pro component in QNAP NAS, have a hardcoded guest account, which allows remote attackers to obtain web-server login access via unspecified vectors...

CVE-2013-0143

cgi-bin/pingping.cgi on QNAP VioStor NVR devices with firmware 4.0.3, and in the Surveillance Station Pro component in QNAP NAS, allows remote authenticated users to execute arbitrary commands by leveraging guest access and placing shell metacharacters in the query string...