CVE-2020-19643

Cross Site Scripting XSS vulnerability in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B via all fields in the FTP settings page to the "goform/formSetFtpCfg" settings page...

Command injection

An issue was discovered in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B. An unauthenticated attacker can reboot the device causing a Denial of Service, via a hidden reboot command to '/media/?action=cmd'...

Cross site request forgery (csrf)

Cross Site Request Forgery CSRF vulnerability in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B, via all fields to WebUI...

CVE-2020-19643

Cross Site Scripting XSS vulnerability in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B via all fields in the FTP settings page to the "goform/formSetFtpCfg" settings page...

CVE-2020-19643

CVE-2020-19643 affects the INSMA Wifi Mini Spy 1080P HD Security IP Camera (firmware version 1.9.7 B). The issue is a Cross-Site Scripting (XSS) vulnerability that originates from inputs in the FTP settings page, exploitable through the goform/formSetFtpCfg endpoint. The CVSS data indicates a net...

CVE-2020-19642

Affected product: INSMA Wifi Mini Spy 1080P HD Security IP Camera (firmware version 1.9.7 B). Vulnerability: Local arbitrary code execution via editing the ‘recdata.db’ file to call a specially crafted GoAhead ASP-file stored on the SD card. Root cause / vector (as described): The GoAhead ASP-fil...

CVE-2020-19642

An issue was discovered in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B. A local attacker can execute arbitrary code via editing the 'recdata.db' file to call a specially crafted GoAhead ASP-file on the SD card...

CVE-2020-19641

An issue was discovered in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B. Authenticated attackers with the "Operator" Privilege can gain admin privileges via a crafted request to '/goform/formUserMng'...

CVE-2020-19641

CVE-2020-19641 affects INSMA Wifi Mini Spy 1080P HD Security IP Camera, firmware version 1.9.7 B. Authenticated attackers with the Operator privilege can escalate to admin by sending a crafted request to /goform/formUserMng . The connected documents corroborate administrator-privilege escalation ...

CVE-2020-19640

An issue was discovered in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B. An unauthenticated attacker can reboot the device causing a Denial of Service, via a hidden reboot command to '/media/?action=cmd'...

CVE-2020-19640

The CVE-2020-19640 issue affects INSMA Wifi Mini Spy 1080P HD Security IP Camera (version 1.9.7 B). An unauthenticated attacker can trigger a reboot via a hidden reboot command to the path /media/?action=cmd, leading to a Denial of Service. Multiple sources (NVD, CNVD, CNNVD, CVE listing) corrobo...

CVE-2020-19639

Cross Site Request Forgery CSRF vulnerability in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B, via all fields to WebUI...

CVE-2020-19639

CVE-2020-19639 affects INSMA Wifi Mini Spy 1080P HD Security IP Camera, version 1.9.7 B. The vulnerability is a Cross-Site Request Forgery (CSRF) that can be triggered via all fields to the WebUI. The connected CNVD/NVD entries corroborate CSRF in this specific camera model. Root cause details be...

INSMA Wifi Mini Spy 1080P HD Security IP Camera 代码问题漏洞

INSMA Wifi Mini Spy 1080P HD Security IP Camera is a camera from INSMA USA. A security vulnerability exists in INSMA Wifi Mini Spy 1080P HD Security IP Camera version 1.9.7 B, which can be exploited by an attacker to execute arbitrary code by editing "recdata"...

INSMA Wifi Mini Spy 1080P HD Security IP Camera 跨站脚本漏洞

INSMA Wifi Mini Spy 1080P HD Security IP Camera is a camera from INSMA USA. A cross-site scripting vulnerability exists in INSMA Wifi Mini Spy 1080P HD Security IP Camera version 1.9.7 B. The vulnerability originates from entering the "goform formSetFtpCfg" settings page via all fields of the FTP...

Russian Hackers Targeted Ukraine Authorities With Supply-Chain Malware Attack

Ukraine is formally pointing fingers at Russian hackers for hacking into one of its government systems and attempting to plant and distribute malicious documents that would install malware on target systems of public authorities. "The purpose of the attack was the mass contamination of informatio...

Trojan-Spy.Win32.SpyEyes.auqj Insecure Permissions

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/ea6ed38ab5264cd92f0d42eb020e87d8.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Trojan-Spy.Win32.SpyEyes.auqj Vulnerability: Insecure Permissions EoP Description: SpyEyes.auqj...

SolarWinds Hack Prompts Congress to Put NSA in Encryption Hot Seat

Members of Congress are demanding the U.S. National Security Agency NSA reveal what it knows about the 2015 Juniper Networks supply-chain delivery breach. In a letter sent by U.S. Senator Ron Wyden and nine additional members of Congress, the lawmakers demand a full account of the NSA-designed...

Constructor.Win32.SpyNet.a Remote Password Leak

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/1717731c32830a31e84b74641a4fdec7.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Constructor.Win32.SpyNet.a Vulnerability: Remote Password Leak Description: Spy-Net RAT v0.7,...

ADT Tech Hacks Home-Security Cameras to Spy on Women

Former ADT employee Telesforo Aviles took note when there were attractive women at a home he serviced in the Dallas area. Then he would add his personal email address to their accounts so he could have around-the-clock access to their most private moments, according to the U.S. Attorneys’ Office...