CVE-2013-0143

cgi-bin/pingping.cgi on QNAP VioStor NVR devices with firmware 4.0.3, and in the Surveillance Station Pro component in QNAP NAS, allows remote authenticated users to execute arbitrary commands by leveraging guest access and placing shell metacharacters in the query string...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in cgi-bin/createuser.cgi on QNAP VioStor NVR devices with firmware 4.0.3 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts via a NEW USER action...

CVE-2013-0143

CVE-2013-0143 affects QNAP VioStor NVR devices (firmware 4.0.3 and possibly earlier) and the Surveillance Station Pro component in QNAP NAS. A remote authenticated user could trigger arbitrary command execution by supplying shell metacharacters in the query string to cgi-bin/pingping.cgi, leverag...

CVE-2013-0144

CVE-2013-0144 is a CSRF vulnerability in QNAP VioStor NVR devices (firmware 4.0.3) where an attacker can trick an authenticated administrator into crafting requests via cgi-bin/create_user.cgi?NEW USER, potentially creating new admin accounts. The related Red Hat/NVD entries describe the same iss...

CVE-2013-0142

QNAP VioStor NVR devices with firmware 4.0.3, and the Surveillance Station Pro component in QNAP NAS, have a hardcoded guest account, which allows remote attackers to obtain web-server login access via unspecified vectors...

CVE-2013-0143

cgi-bin/pingping.cgi on QNAP VioStor NVR devices with firmware 4.0.3, and in the Surveillance Station Pro component in QNAP NAS, allows remote authenticated users to execute arbitrary commands by leveraging guest access and placing shell metacharacters in the query string...

CVE-2013-0144

Cross-site request forgery CSRF vulnerability in cgi-bin/createuser.cgi on QNAP VioStor NVR devices with firmware 4.0.3 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts via a NEW USER action...

CVE-2013-0142

CVE-2013-0142 affects QNAP VioStor NVR devices (firmware 4.0.3 and possibly earlier) and the Surveillance Station Pro component in QNAP NAS. The root cause is a hardcoded guest account that can be leveraged to obtain web-server login access, enabling remote attackers to access administrative func...

QNAP VioStor NVR / QNAP NAS Devices RCE Vulnerability (Jun 2013) - Active Check

QNAP VioStor NVR / QNAP NAS devices are prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if...

QNAP VioStor NVR / QNAP NAS Devices Multiple Vulnerabilities (Jun 2013) - Active Check

QNAP VioStor NVR / QNAP NAS devices are prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

QNAP VioStor NVR firmware version 4.0.3 and QNAP NAS multiple vulnerabilities

Overview QNAP VioStor NVR firmware version 4.0.3 and possibly earlier versions and QNAP NAS contains multiple vulnerabilities which may allow an attacker to perform administrative functions against the hosted server. Description QNAP VioStor NVR firmware version 4.0.3 and possibly earlier version...

QNAP VioStor NVR QNAP NAS - Remote Code Execution

QNAP VioStor NVR QNAP NAS - Remote Code Execution source: https://www.securityfocus.com/bid/60354/info QNAP VioStor NVR and QNAP NAS are prone to a remote code-execution vulnerability. Successfully exploiting this issue may allow an attacker to execute arbitrary code with elevated privileges in t...

QNAP VioStor NVR / QNAP NAS - Remote Code Execution

source: https://www.securityfocus.com/bid/60354/info QNAP VioStor NVR and QNAP NAS are prone to a remote code-execution vulnerability. Successfully exploiting this issue may allow an attacker to execute arbitrary code with elevated privileges in the context of the user running the affected...

airVision NVR path Parameter Traversal Arbitrary File Access

The remote web server hosts airVision NVR, an application used to remotely monitor IP cameras. The installed version of airVision NVR fails to properly sanitize user-supplied input to the 'path' parameter of the 'views/file.php' script. This could allow an unauthenticated, remote attacker to read...

airVisionNVR 1.1.13 Disclosure / SQL Injection

Exploit Title: airVisionNVR readfile disclosure and sql injection Google Dork: Date: Oct 13, 2012 Exploit Author: pennyGrit Vendor Homepage: http://www.ubnt.com/ Software Link: http://www.ubnt.com/downloads/airvision/airVision-v1.1.3-installer.exe Version: 1.1.13 Tested on: WinXP SP3 CVE: Possibl...

perl-Archive-Tar security update

1.39.1-1.el5.1 - cleaning spec and nvr - Related: rhbz595733 1.40-1.el5.1 - update to real version 1.3901, but for rpm updates, it will be 1.40 - Resolves: rhbz595733 1.40-1 - update to 1.40 - Resolves: rhbz595733...

dhcp security update

3.0.1-65.1 - Correct package NVR Related: rhbz507736 3.0.1-65.EL4.1 - Fix for CVE-2009-0692 Resolves: rhbz507736...

NVR SP2 2.0 (nvUnifiedControl.dll v. 1.1.45.0) SetText() Remote Exploit

No description provided by source. ------------------------------------------------------------------------------------------ PoC2 NVR SP2 2.0 nvUnifiedControl.AUnifiedControl.1 nvUnifiedControl.dll v. 1.1.45.0 "SetText" Remote BoF Heap Spray Technique url: http://www.acti.com/index.asp author:...

Path traversal

Multiple absolute path traversal vulnerabilities in the nvUtility.Utility.1 ActiveX control in nvUtility.dll 1.0.14.0 in ACTi Network Video Recorder NVR SP2 2.0 allow remote attackers to 1 create or overwrite arbitrary files via a full pathname in the first argument to the SaveXMLFile method or 2...

Buffer overflow

Buffer overflow in the nvUnifiedControl.AUnifiedControl.1 ActiveX control in nvUnifiedControl.dll 1.1.45.0 in ACTi Network Video Recorder NVR SP2 2.0 allows remote attackers to execute arbitrary code via a long second argument to the SetText method...