Command injection

Lack of an authentication mechanism in KERUI Wifi Endoscope Camera YPC99 allows an attacker to watch or block the camera stream. The RTSP server on port 7070 accepts the command STOP to stop streaming, and the command SETSSID to disconnect a user...

CVE-2018-13115

Affected: KERUI Wifi Endoscope Camera (YPC99). Description: Lack of authentication allows an attacker to watch or block the camera stream via the RTSP server (port 7070). The server accepts STOP to stop streaming and SETSSID to disconnect a user. CVSS metrics indicate Network access with Low atta...

Xpdf 'DCTStream::decodeImage' function out-of-bounds read vulnerability

Xpdf is Foo Labs developed an open source PDF reader , it supports decoding LZW compressed format files and read encrypted PDF files . Xpdf 4.00 version of the Stream.cc file in the 'DCTStream::decodeImage' function has an out-of-bounds read vulnerability. A remote attacker can exploit this...

Xpdf 'CCITTFaxStream::readRow()' function stack buffer overflow vulnerability

Xpdf is Foo Labs developed an open source PDF reader , it supports decoding LZW compressed format files and read encrypted PDF files . A stack buffer overflow vulnerability exists in the 'CCITTFaxStream::readRow' function in the Stream.cc file in Xpdf version 4.00. A remote attacker can exploit...

CVE-2018-18428

TP-Link TL-SC3130 1.6.18P12121101 devices allow unauthenticated RTSP stream access, as demonstrated by a /jpg/image.jpg URI...

Code injection

TP-Link TL-SC3130 1.6.18P12121101 devices allow unauthenticated RTSP stream access, as demonstrated by a /jpg/image.jpg URI...

CVE-2018-18428

TP-Link TL-SC3130 1.6.18P12121101 devices allow unauthenticated RTSP stream access, as demonstrated by a /jpg/image.jpg URI...

Moderate severity vulnerability that affects org.apache.commons:commons-compress

When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail to return the correct EOF indication after the end of the stream has been reached. When combined with a java.io.InputStreamReader this can lead to an infinite...

CVE-2018-5156

A vulnerability can occur when capturing a media stream when the media source type is changed as the capture is occurring. This can result in stream data being cast to the wrong type causing a potentially exploitable crash. This vulnerability affects Thunderbird 60, Firefox ESR 60.1, Firefox ESR...

CVE-2018-5156

A vulnerability can occur when capturing a media stream when the media source type is changed as the capture is occurring. This can result in stream data being cast to the wrong type causing a potentially exploitable crash. This vulnerability affects Thunderbird 60, Firefox ESR 60.1, Firefox ESR...

Type confusion

A vulnerability can occur when capturing a media stream when the media source type is changed as the capture is occurring. This can result in stream data being cast to the wrong type causing a potentially exploitable crash. This vulnerability affects Thunderbird 60, Firefox ESR 60.1, Firefox ESR...

CVE-2018-5156

The CVE-2018-5156 entry describes a vulnerability in media capture: when the media source type is changed during capture, stream data can be cast to the wrong type, causing a crash. Affected products include Thunderbird

CVE-2018-5156

A vulnerability can occur when capturing a media stream when the media source type is changed as the capture is occurring. This can result in stream data being cast to the wrong type causing a potentially exploitable crash. This vulnerability affects Thunderbird 60, Firefox ESR 60.1, Firefox ESR...

CVE-2018-5156

A vulnerability can occur when capturing a media stream when the media source type is changed as the capture is occurring. This can result in stream data being cast to the wrong type causing a potentially exploitable crash. This vulnerability affects Thunderbird 60, Firefox ESR 60.1, Firefox ESR...

UBUNTU-CVE-2018-18459

The function DCTStream::getBlock in Stream.cc in Xpdf 4.00 allows remote attackers to cause a denial of service NULL pointer dereference via a crafted pdf file, as demonstrated by pdftoppm...

UBUNTU-CVE-2018-18454

CCITTFaxStream::readRow in Stream.cc in Xpdf 4.00 allows remote attackers to cause a denial of service heap-based buffer over-read via a crafted pdf file, as demonstrated by pdftoppm...

PT-2018-14468 · Xpdf +2 · Xpdf +2

Name of the Vulnerable Software and Affected Versions: Xpdf version 4.00 Description: The issue allows remote attackers to cause a denial of service, specifically a heap-based buffer over-read, via a crafted pdf file. This is demonstrated by the use of pdftoppm, which exploits the...

TP-Link TL-SC3130 1.6.18 Unauthenticated RTSP Stream Disclosure

TP-Link TL-SC3130 1.6.18 Unauthenticated RTSP Stream Disclosure Vulnerability Vendor: TP-LINK Technologies Co., Ltd. Product web page: http://www.tp-link.com Affected version: 1.6.18P12121101 Summary: The TL-SC3130G surveillance camera is a versatile solution for your home and office monitoring,...

TP-Link TL-SC3130 1.6.18 - RTSP Stream Disclosure

Exploit Title: TP-Link TL-SC3130 1.6.18 - RTSP Stream Disclosure Author: Gjoko 'LiquidWorm' Krstic @zeroscience Date: 2018-10-17 Vendor: TP-LINK Technologies Co., Ltd. Product web page: http://www.tp-link.com Affected version: 1.6.18P12121101 Tested on: Boa/0.94.14rc21 CVE: N/A References: Adviso...

TP-Link TL-SC3130 1.6.18 Unauthenticated RTSP Stream Disclosure Vulnerability

Summary The TL-SC3130G surveillance camera is a versatile solution for your home and office monitoring, whose 54Mbps wireless connectivity enables you to deploy the camera where inaccessible previously by Ethernet connection such as ceiling and walls. This camera can be placed in your living room...