COMMAX CVD-Axx DVR 5.1.4 Weak Default Credentials Stream Disclosure

Summary COMMAX offers a wide range of proven AHD CCTV systems to meet customer needs and convenience in single or multi-family homes. Description The web control panel uses weak set of default administrative credentials that can be easily guessed in remote password attacks and disclose RTSP strea...

COMMAX Biometric Access Control System 1.0.0 Authentication Bypass

Summary Biometric access control system. Description The application suffers from an authentication bypass vulnerability. An unauthenticated attacker through cookie poisoning can bypass authentication and disclose sensitive information and circumvent physical controls in smart homes and buildings...

Unauthorized Access Vulnerability in RAID Management System

Tiandiweiye is an intelligent security solution provider, based on artificial intelligence, big data, cloud computing, Internet of Things and other technologies, providing intelligent video products, system solutions and technical services for public security, politics and law, transportation,...

Logic Flaw Vulnerability in DSS PRO Web Manager of Zhejiang Dahua Technology Co.

Zhejiang Dahua Technology Co., Ltd DSS PRO is a new generation of software-hardware and intelligent integrated platform products independently developed by Dahua, which is used in public security, finance, energy, education and other industries, and is the core product for building security...

Mexican Politician Removed Over Alleged Ties to Romanian ATM Skimmer Gang

The leader of Mexicos Green Party has been removed from office following allegations that he received money from a Romanian ATM skimmer gang that stole hundreds of millions of dollars from tourists visiting Mexicos top tourist destinations over the past five years. The scandal is the latest fallo...

STVS ProVision 5.9.10 (archive.rb) Authenticated File Disclosure Vulnerability

Summary STVS is a Swiss company specializing in development of software for digital video recording for surveillance cameras as well as the establishment of powerful and user-friendly IP video surveillance networks. Description The NVR software ProVision suffers from an authenticated arbitrary fi...

Arbitrary File Deletion Vulnerability in Zhirui Public Security Information Website System

Zhirui software is a focus on network software development work team, its products voting selection system, enterprise website system, school website system, government website management system, public security public information management system is currently the most widely used website progra...

SQL Injection Vulnerability in the Management Platform of Internet Service Establishments of the Public Security Bureau (CNVD-2020-60078)

Harbin Zhonglong Baiying Technology Development Co., Ltd. was established on May 29, 2013, mainly engaged in computer hardware and software, office automation equipment, security equipment and so on. A SQL injection vulnerability exists in the management platform of the Public Security Bureau's...

SQL Injection Vulnerability in the Management Platform of Internet Service Establishments of the Public Security Bureau (CNVD-2020-60077)

Harbin Zhonglong Baiying Technology Development Co., Ltd. was established on May 29, 2013, mainly engaged in computer hardware and software, office automation equipment, security equipment and so on. A SQL injection vulnerability exists in the management platform of the Public Security Bureau's...

SQL Injection Vulnerability in the Management Platform of Internet Service Establishments of the Public Security Bureau (CNVD-2020-60076)

Harbin Zhonglong Baiying Technology Development Co., Ltd. was established on May 29, 2013, mainly engaged in computer hardware and software, office automation equipment, security equipment and so on. A SQL injection vulnerability exists in the management platform of the Public Security Bureau's...

SQL Injection Vulnerability in the Management Platform of Internet Service Establishments of the Public Security Bureau

Harbin Zhonglong Baiying Technology Development Co., Ltd. was established on May 29, 2013, mainly engaged in computer hardware and software, office automation equipment, security equipment and so on. A SQL injection vulnerability exists in the management platform of the Public Security Bureau's...

SQL Injection Vulnerability in Web Service Platform of Civil Explosives Information System

The Civil Explosives Information System Web Service Platform is a management system provided by the Ministry of Public Security for provinces to manage blasting operators. A SQL injection vulnerability exists in the Civil Explosives Information System Web Service Platform, which can be exploited ...

Guangzhou Travel Ease App has SMS Bombing Vulnerability

Guangzhou Travel Easy APP is an information service and online business processing software launched to the public by Guangzhou Public Security Traffic Management Department. There is an SMS bombing vulnerability in Guangzhou Easy Travel APP. An attacker can exploit this vulnerability to replay...

Microhard Systems 3G/4G Cellular Ethernet and Serial Gateway Hidden Features

Summary The new IPn4Gb provides a rugged, industrial strength wireless solution using the new and ultra fast 4G LTE cellular network infrastructure. The IPn4Gb features integrated Firewall, IPSec / VPN & GRE Tunneling, IP/MAC Access Control Lists. The IPn4Gb can transport critical data to and fro...

Philips' IntelliVue Patient and Avalon Fetal Monitors

1. EXECUTIVE SUMMARY CVSS v3 8.3 Vendor: Philips Equipment: IntelliVue Patient Monitors, Avalon Fetal/Maternal Monitors Vulnerabilities: Improper Authentication, Information Exposure, Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation may allow an attacker to read/write...

Internet Bug Bounty: [CVE-2018-6913] heap-buffer-overflow in S_pack_rec

pack may cause a heap buffer write overflow with a large item count. Reported to the Perl security mailing list on 5 Aug 2017. Confirmed as a security flaw by TonyC on 30 Jan 2018 CVE-2018-6913 assigned to this flaw on 11 Feb 2018 Public security advisory released on 14 April 2018...

Internet Bug Bounty: CVE-2018-6797: A crafted regular expression can cause a heap buffer write overflow in Perl 5 giving a remote attacker control over bytes written

An attacker supplies a regular expression containing one or more \xDF characters after an escape putting the regexp into unicode matching mode, such as a \N escape. Each \xDF character adds one byte of overflow, and any other text in the regular expression is written in order, providing the...

VideoFlow Digital Video Protection DVP 10 Authenticated Directory Traversal

Summary VideoFlow's Digital Video Protection DVP product is used by leading companies worldwide to boost the reliability of IP networks, including the public Internet, for professional live broadcast. DVP enables broadcast companies to confidently contribute and distribute live video over IP with...

Shaoxing Public Security App for Android has information leakage vulnerability

Shaoxing Public Security APP is a convenient application launched by Shaoxing Public Security Bureau for the public, which provides the functions of inquiry, reservation, declaration and reminder of public security business, such as office service, police-community communication, police-community...

Jiaxing Public Security App Has Arbitrary Account Login Vulnerability

Jiaxing Public Security APP is a convenient mobile application for local people in Jiaxing to find local services, mainly including motor vehicle violation inquiry, immigration office appointment, police news, security, police map, law enforcement public and other functional services. Jiaxing...